ci: address review feedback on dist rebuild workflows

bdehamer · Copilot · bdehamer · commit a4018e9feb67 · 2026-07-10T12:56:57.000-07:00
- Grant pull-requests: read in rebuild-dist.yml, required by
  dependabot/fetch-metadata.
- Harden commit-dist.yml: strictly validate head-ref/head-sha read from
  the PR-context artifact (40-hex sha, safe ref charset, single line) and
  require head-sha to exist before use, preventing workflow-command
  injection into $GITHUB_OUTPUT.

Co-authored-by: Copilot App &lt;223556219+Copilot@users.noreply.github.com&gt;
diff --git a/.github/workflows/commit-dist.yml b/.github/workflows/commit-dist.yml
@@ -40,17 +40,33 @@ jobs:
           path: incoming
 
       # No artifact => the builder found dist/ already up to date. Nothing to do.
+      # The head-ref/head-sha values come from an artifact produced in the
+      # (unprivileged) PR context, so validate them strictly before writing to
+      # $GITHUB_OUTPUT to avoid workflow-command injection.
       - name: Check for artifact
         id: check
         run: |
-          if [ -d incoming/dist ] && [ -f incoming/dist-meta/head-ref ]; then
-            echo "present=true" >> "$GITHUB_OUTPUT"
-            echo "head-ref=$(cat incoming/dist-meta/head-ref)" >> "$GITHUB_OUTPUT"
-            echo "head-sha=$(cat incoming/dist-meta/head-sha)" >> "$GITHUB_OUTPUT"
-          else
+          if [ ! -d incoming/dist ] || [ ! -f incoming/dist-meta/head-ref ] || [ ! -f incoming/dist-meta/head-sha ]; then
             echo "present=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          head_ref="$(head -n1 incoming/dist-meta/head-ref | tr -d '\r\n')"
+          head_sha="$(head -n1 incoming/dist-meta/head-sha | tr -d '\r\n')"
+
+          if ! printf '%s' "$head_sha" | grep -Eq '^[0-9a-f]{40}$'; then
+            echo "Invalid head-sha; refusing to proceed." >&2
+            exit 1
+          fi
+          if ! printf '%s' "$head_ref" | grep -Eq '^[A-Za-z0-9._/-]+$'; then
+            echo "Invalid head-ref; refusing to proceed." >&2
+            exit 1
           fi
 
+          echo "present=true" >> "$GITHUB_OUTPUT"
+          echo "head-ref=$head_ref" >> "$GITHUB_OUTPUT"
+          echo "head-sha=$head_sha" >> "$GITHUB_OUTPUT"
+
       - name: Checkout PR branch
         if: steps.check.outputs.present == 'true'
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
diff --git a/.github/workflows/rebuild-dist.yml b/.github/workflows/rebuild-dist.yml
@@ -12,6 +12,7 @@ on:
 
 permissions:
   contents: read
+  pull-requests: read # required by dependabot/fetch-metadata
 
 jobs:
   rebuild:
