From 0cb9ad7de205db24edc30f022e65d3ffaa697ce2 Mon Sep 17 00:00:00 2001 From: Matthew Watkins Date: Tue, 28 Jul 2026 15:54:01 +0100 Subject: [PATCH] Fix: Env-mediate expressions in run blocks zizmor's auditor persona reported 3 template-injection findings in testing.yaml: GitHub expressions expanded directly inside a 'run:' block, where expansion happens before the shell sees the script and a crafted value could inject commands. Pass the three action outputs through 'env:' instead and read them as shell variables in the validation step. The org-wide zizmor workflow now fails a run on any finding at any level, so these informational findings block every new pull request in this repository. zizmor offers an auto-fix for this audit, but it is marked unsafe and on inspection it is: it rewrites the expression in place, leaving it inside the original single quotes, where the shell will not expand it. The original was correct because GitHub expanded the template before the shell ever saw it. These edits were therefore written by hand, with double quotes, and follow the env-before-run shape already used elsewhere in this repository. No behavioural change: the same values reach the same commands. Zizmor now reports no findings for the repository. Co-authored-by: Claude Signed-off-by: Matthew Watkins --- .github/workflows/testing.yaml | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/.github/workflows/testing.yaml b/.github/workflows/testing.yaml index 06ba6d3..a436d40 100644 --- a/.github/workflows/testing.yaml +++ b/.github/workflows/testing.yaml @@ -87,10 +87,14 @@ jobs: - name: "Validate action: ${{ github.repository }}" shell: bash + env: + DYNAMIC_VERSION: ${{ steps.testing.outputs.dynamic_version }} + DYNAMIC_PROVIDER: ${{ steps.testing.outputs.dynamic_provider }} + DYNAMIC_SOURCE: ${{ steps.testing.outputs.source }} run: | - dynamic='${{ steps.testing.outputs.dynamic_version }}' - provider='${{ steps.testing.outputs.dynamic_provider }}' - source='${{ steps.testing.outputs.source }}' + dynamic="$DYNAMIC_VERSION" + provider="$DYNAMIC_PROVIDER" + source="$DYNAMIC_SOURCE" if [ "$dynamic" != 'true' ]; then echo 'Error: expected dynamic_version=true ❌' echo "Returned: $dynamic"