Skip to content

Pass the release tag through the environment, not interpolation - #241

Merged
hanthor merged 1 commit into
mainfrom
fix/release-tag-injection
Sep 27, 2026
Merged

hanthor merged 1 commit into
mainfrom
fix/release-tag-injection

Conversation

@hanthor

@hanthor hanthor commented Sep 27, 2026

Copy link
Copy Markdown
Member

Fixes #227. The runner expands expressions before bash parses the step, so an interpolated manual tag runs as code before the format check rejects it. Same shape fixed in api-release.yml as defense in depth.

The runner expands expressions before bash parses the step, so an
interpolated manual tag runs as code before the format check rejects
it. Same shape fixed in api-release.yml as defense in depth.
@hanthor
hanthor merged commit d45aab3 into main Sep 27, 2026
13 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[sec-check] Stop release tag input from being interpolated into shell

1 participant