External/CloakBrowser
1
0
Fork 0
mirror of https://github.com/CloakHQ/CloakBrowser.git synced 2026-06-23 11:41:46 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): isolate workflow_dispatch input to avoid shell injection in attest-release (#223)

Browse Source 
Security hardening: route workflow_dispatch input through env var to prevent shell injection in attest-release workflow.
This commit is contained in:
@aaronjmars
2026-05-12 15:53:31 +02:00
committed by GitHub
parent 23f1d4098c
commit 95a98b6747
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/attest-release.yml
+2 -1
View File
@@ -16,9 +16,10 @@ jobs:
contents: write # Download release assets contents: write # Download release assets
steps: steps:
- name: Download release binaries - name: Download release binaries
run: gh release download ${{ github.event.inputs.tag }} --repo CloakHQ/cloakbrowser --pattern "cloakbrowser-*.tar.gz" --pattern "cloakbrowser-*.zip" run: gh release download "$RELEASE_TAG" --repo CloakHQ/cloakbrowser --pattern "cloakbrowser-*.tar.gz" --pattern "cloakbrowser-*.zip"
env: env:
GH_TOKEN: ${{ github.token }} GH_TOKEN: ${{ github.token }}
RELEASE_TAG: ${{ github.event.inputs.tag }}
- name: Attest build provenance - name: Attest build provenance
uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0 uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0