fix(security): remediate command injection vulnerabilities in GitHub Actions#2932
Merged
Conversation
…Actions Fixes command injection vulnerabilities (VLN-418) by moving GitHub context variables to environment variables to prevent shell injection attacks. Changes: - version-bump.yml: Move all github context and steps outputs to env variables - trigger-downstream-updates.yml: Move github.event.inputs.target-sha to INPUT_TARGET_SHA - Apply pattern consistently across both workflow files This prevents untrusted user input from being interpreted as shell commands, following the same security pattern applied in temporalio/frontend-workflow-runner#9. Refs: VLN-418
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
jackdawm
approved these changes
Sep 30, 2025
temporal-cicd Bot
pushed a commit
that referenced
this pull request
Oct 8, 2025
Auto-generated version bump from 2.40.1 to 2.41.0 Bump type: minor Changes included: - [`904ca347`](904ca34) fix(workflows): add GitHub App token to version bump PR creation (#2910) - [`bd50889e`](bd50889) fix(workflows): fix changelog generation and PR body formatting in version bump (#2912) - [`ce91ecf6`](ce91ecf) style: fix formatting in version-bump workflow (#2914) - [`352e9f66`](352e9f6) ci(workflows): add path filter to trigger-downstream-updates (#2916) - [`9e39fa81`](9e39fa8) Add test sentence in README. - [`68f75a20`](68f75a2) Remove test sentence - [`73c83894`](73c8389) Start Delay UI improvements (#2907) - [`f7924cd0`](f7924cd) Fix issue with localActivity decoding with Java sdk (#2921) - [`474091aa`](474091a) add switch icon (#2895) - [`a6ec2611`](a6ec261) remove monaco in favor of codemirror (#2920) - [`b0042390`](b004239) Add quotes around allowOrigins (#2923) - [`b809fb51`](b809fb5) feat(holocene): add VerticalNav component (#2924) - [`e72ca8ac`](e72ca8a) Try adding overflow css to codemirror (#2929) - [`9c472385`](9c47238) add change event to dark mode in top nav (#2930) - [`bb750c9c`](bb750c9) fix(security): remediate command injection vulnerabilities in GitHub Actions (#2932) - [`e54f3dc9`](e54f3dc) Add try catch around decodeForSvelte on bad params (#2934) - [`cfc4998c`](cfc4998) replace v5 with crypto.randomuuid (#2927) - [`a47970e9`](a47970e) Fix NaN in Batch Operations results (#2938) - [`6cb24dec`](6cb24de) Migrate layout files to Svelte 5 (#2937) - [`f424f03d`](f424f03) Bump tar-fs from 3.0.9 to 3.1.1 (#2926) - [`3255f31d`](3255f31) Saved Workflow Query Views (#2931)
Alex-Tideman
added a commit
that referenced
this pull request
Oct 8, 2025
Auto-generated version bump from 2.40.1 to 2.41.0 Bump type: minor Changes included: - [`904ca347`](904ca34) fix(workflows): add GitHub App token to version bump PR creation (#2910) - [`bd50889e`](bd50889) fix(workflows): fix changelog generation and PR body formatting in version bump (#2912) - [`ce91ecf6`](ce91ecf) style: fix formatting in version-bump workflow (#2914) - [`352e9f66`](352e9f6) ci(workflows): add path filter to trigger-downstream-updates (#2916) - [`9e39fa81`](9e39fa8) Add test sentence in README. - [`68f75a20`](68f75a2) Remove test sentence - [`73c83894`](73c8389) Start Delay UI improvements (#2907) - [`f7924cd0`](f7924cd) Fix issue with localActivity decoding with Java sdk (#2921) - [`474091aa`](474091a) add switch icon (#2895) - [`a6ec2611`](a6ec261) remove monaco in favor of codemirror (#2920) - [`b0042390`](b004239) Add quotes around allowOrigins (#2923) - [`b809fb51`](b809fb5) feat(holocene): add VerticalNav component (#2924) - [`e72ca8ac`](e72ca8a) Try adding overflow css to codemirror (#2929) - [`9c472385`](9c47238) add change event to dark mode in top nav (#2930) - [`bb750c9c`](bb750c9) fix(security): remediate command injection vulnerabilities in GitHub Actions (#2932) - [`e54f3dc9`](e54f3dc) Add try catch around decodeForSvelte on bad params (#2934) - [`cfc4998c`](cfc4998) replace v5 with crypto.randomuuid (#2927) - [`a47970e9`](a47970e) Fix NaN in Batch Operations results (#2938) - [`6cb24dec`](6cb24de) Migrate layout files to Svelte 5 (#2937) - [`f424f03d`](f424f03) Bump tar-fs from 3.0.9 to 3.1.1 (#2926) - [`3255f31d`](3255f31) Saved Workflow Query Views (#2931) Co-authored-by: Alex-Tideman <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes command injection vulnerabilities (VLN-418) by moving GitHub context variables to environment variables to prevent shell injection attacks.
Security Impact
Changes
github.event.inputs.*,steps.*.outputs.*to environment variablesgithub.event.inputs.target-shatoINPUT_TARGET_SHAenvironment variableModified Files
.github/workflows/version-bump.yml.github/workflows/trigger-downstream-updates.ymlReferences
This prevents untrusted user input from being interpreted as shell commands.