arcodange/dance-lessons-coach
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

🐛 fix(ci): replace ${{ head_commit.message }} expression with git log to avoid shell injection

Browse Source 
PR #31 added a fallback to git log -1 --pretty=%B for the workflow_dispatch
case (where head_commit.message is empty), but kept ${{ ... }} as the primary
source. That expression is interpolated literally into the rendered shell
script — so a commit body containing a backtick, an unbalanced quote, or even
just a newline at an unfortunate position breaks the line that follows.

Symptom: every PR since #31 has shown:
  /var/run/act/workflow/12.sh: line 34: syntax error: unexpected newline
  ❌  Failure - Main Update badges and version (multiple commits, single push)

Fix: skip the expression entirely. git log -1 --pretty=%B reads the same
information from the actual commit and has no shell-injection surface.
This commit is contained in:
Gabriel Radureau
2026-05-05 07:29:10 +02:00
parent ee4e8b2ee1
commit bbac3e7ff9
1 changed files with 5 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
.gitea/workflows/ci-cd.yaml
View File

@@ -299,13 +299,11 @@ jobs:
# Check for version bump on main branch # Check for version bump on main branch
if [ "${{ github.ref }}" = "refs/heads/main" ]; then if [ "${{ github.ref }}" = "refs/heads/main" ]; then
echo "🔖 Checking for version bump..." echo "🔖 Checking for version bump..."
# ${{ github.event.head_commit.message }} is empty on workflow_dispatch (manual trigger). # Always read from git log: ${{ github.event.head_commit.message }} expression
# Fall back to the latest commit message from `git log` so the script always has input. # is interpolated literally into the shell script, so any backtick, unbalanced
COMMIT_MSG="${{ github.event.head_commit.message }}" # quote, or special char in a commit body breaks the next line of the script
if [ -z "$COMMIT_MSG" ]; then # (observed on PR #32-#35: 'syntax error: unexpected newline'). git log is safe.
COMMIT_MSG=$(git log -1 --pretty=%B) COMMIT_MSG=$(git log -1 --pretty=%B)
echo " (using git log -1 because head_commit.message is empty - probably workflow_dispatch)"
fi
./scripts/ci-version-bump.sh "$COMMIT_MSG" --no-push ./scripts/ci-version-bump.sh "$COMMIT_MSG" --no-push
fi fi