[Bug]: GitHub Actions workflows vulnerable to expression injection #10113

Is there an existing issue already for this bug?

• I have searched for an existing issue, and could not find anything. I believe this is a new bug.

I have read the troubleshooting guide

• I have read the troubleshooting guide and I think this is a new bug.

I am running a supported version of CloudNativePG

• I have read the troubleshooting guide and I think this is a new bug.

Contact Details

N/A

Version

trunk (main)

What version of Kubernetes are you using?

N/A

What is your Kubernetes environment?

Other

How did you install the operator?

Other

What happened?

Several GitHub Actions workflows use ${{ }} expressions referencing potentially attacker-controlled values directly inside run: shell blocks. Since GitHub expands these expressions before the shell processes the script, shell quoting provides zero protection and the values can be used to inject arbitrary commands.

This is the same class of vulnerability exploited in the hackerbot-claw campaign disclosed by StepSecurity.

Additionally, several $GITHUB_ENV and $GITHUB_OUTPUT writes use the single-line KEY=VALUE format with potentially tainted values, which is vulnerable to newline injection.

The fix follows a consistent pattern: move ${{ }} expressions from run: blocks into step-level env: blocks, then reference them as properly-quoted shell variables. For $GITHUB_ENV/$GITHUB_OUTPUT writes, use the heredoc delimiter syntax instead of single-line KEY=VALUE.

Fix PRs

• fix(security): harden GitHub Actions workflows against expression injection #10114
• fix(security): harden GitHub Actions workflows against expression injection postgres-trunk-containers#121
• fix(security): harden GitHub Actions workflows against expression injection postgres-containers#407
• fix(security): harden GitHub Actions workflows against expression injection postgres-extensions-containers#127
• fix(security): harden GitHub Actions workflows against expression injection pgbouncer-containers#82
• fix(security): harden GitHub Actions workflows against expression injection docs#56
• fix(security): harden GitHub Actions workflows against expression injection charts#823
• fix(security): harden GitHub Actions workflows against expression injection chaos-testing#4
• fix(security): harden GitHub Actions workflows against expression injection grafana-dashboards#54
• fix(security): harden GitHub Actions workflows against expression injection cnpg-i-hello-world#205
• fix(security): harden GitHub Actions workflows against expression injection plugin-barman-cloud#773

Cluster resource

N/A

Relevant log output

N/A

Code of Conduct

• I agree to follow this project's Code of Conduct