[Brandon Myers (bmyerz0)]

Security scans revealed a potential for code injection through triton-ref. Nightly builds hard code the ref to main, however if the template was used in another context it could be exploited.

Furthermore, the injected command could potentially read credentials from CI worker's .git/config due to persist-credentials: true.

Example

Set the workflow’s triton-ref input to main; echo COMMAND:

triton-ref: 'main; echo COMMAND'

Before the fix, GitHub interpolates that input directly into the script:

git checkout main; echo COMMAND
git log -1

Bash executes echo COMMAND as a separate command, printing COMMAND.

Mitigation

Validate the triton-ref prior to use and reject if not a hash or does not resolve to a hash.

Also set persist-credentials: false for extra hardening. The credentials are not needed after the checkout anyway.

Other changes

Pin lit version to unblock CI.

[Copilot]

🟢 Approval recommended

The changes prevent direct shell interpolation while preserving branch, tag, and commit selection, with no identified blocking issues.

0 open findings

What changed in this PR

This PR hardens Triton checkout in the plugin test workflow against shell injection through triton-ref.

Changes:

• Passes the input through an environment variable and safely resolves it to a commit.
• Validates commit hashes and uses detached checkouts.

File	Description
.github/​workflows/​test-plugin.yml	Secures ref handling, validates pinned hashes, and documents the optional input.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.