Skip to content

Fix expression injection in composite actions #6

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jeremy merged 3 commits into from
Mar 5, 2026
Merged

Fix expression injection in composite actions #6

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
6e15b4a
Fix expression injection in rubric-check action
jeremy Mar 5, 2026
5f1b134
Fix expression injection in surface-compat action
jeremy Mar 5, 2026
02aee6e
Replace workflow commands with stderr for user-controlled values
jeremy Mar 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 9 additions & 4 deletions actions/rubric-check/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,18 +26,23 @@ runs:
steps:
- name: Verify binary exists
shell: bash
env:
INPUT_CLI_BINARY: ${{ inputs.cli-binary }}
run: |
if [ ! -x "${{ inputs.cli-binary }}" ]; then
echo "::error::CLI binary not found or not executable: ${{ inputs.cli-binary }}"
if [ ! -x "$INPUT_CLI_BINARY" ]; then
echo "ERROR: CLI binary not found or not executable: $INPUT_CLI_BINARY" >&2
exit 1
fi

- name: Score rubric
id: score
shell: bash
env:
INPUT_CLI_BINARY: ${{ inputs.cli-binary }}
INPUT_PROFILE: ${{ inputs.profile }}
run: |
BINARY="${{ inputs.cli-binary }}"
PROFILE="${{ inputs.profile }}"
BINARY="$INPUT_CLI_BINARY"
PROFILE="$INPUT_PROFILE"
PASSED=0
FAILED=0
TOTAL=0
Expand Down
21 changes: 14 additions & 7 deletions actions/surface-compat/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,21 +22,26 @@ runs:
steps:
- name: Verify inputs
shell: bash
env:
INPUT_CLI_BINARY: ${{ inputs.cli-binary }}
INPUT_BASELINE: ${{ inputs.baseline }}
run: |
if [ ! -x "${{ inputs.cli-binary }}" ]; then
echo "::error::CLI binary not found: ${{ inputs.cli-binary }}"
if [ ! -x "$INPUT_CLI_BINARY" ]; then
echo "ERROR: CLI binary not found: $INPUT_CLI_BINARY" >&2
exit 1
Comment thread
jeremy marked this conversation as resolved.
fi
if [ ! -f "${{ inputs.baseline }}" ]; then
echo "::error::Baseline file not found: ${{ inputs.baseline }}"
if [ ! -f "$INPUT_BASELINE" ]; then
echo "ERROR: Baseline file not found: $INPUT_BASELINE" >&2
exit 1
Comment thread
jeremy marked this conversation as resolved.
fi

- name: Generate current surface
shell: bash
env:
INPUT_CLI_BINARY: ${{ inputs.cli-binary }}
run: |
# Walk the CLI command tree and produce surface snapshot
BINARY="${{ inputs.cli-binary }}"
BINARY="$INPUT_CLI_BINARY"
ROOT_NAME=$(basename "$BINARY")

walk_commands() {
Expand All @@ -48,7 +53,7 @@ runs:

local json
json=$("$BINARY" "${args[@]}" --help --agent 2>/dev/null) || {
echo "::warning::--help --agent failed for: $cmd_path"
echo "WARNING: --help --agent failed for: $cmd_path" >&2
return 0
}

Expand All @@ -72,8 +77,10 @@ runs:
- name: Diff surfaces
id: diff
shell: bash
env:
INPUT_BASELINE: ${{ inputs.baseline }}
run: |
BASELINE="${{ inputs.baseline }}"
BASELINE="$INPUT_BASELINE"
CURRENT="/tmp/surface-current.txt"

# comm requires sorted input — sort both with consistent locale
Expand Down
Loading