fix(ci): route dispatcher pr_number through env in remaining run steps (MAPPS-306) #371

Merged

Claude-Run merged 1 commit from fix/MAPPS-306-pr-number-injection into main

2026-06-26 09:31:17 +02:00

Claude-Run commented

2026-06-26 09:29:14 +02:00

Member

MAPPS-307 routed PR_TITLE, PR_BRANCH, HEAD_SHA, and EXTRA_INSTRUCTIONS through env: in the Build failure context, Run Claude Code, and Commit and push steps, but two run: scripts still interpolated the dispatcher-supplied ${{ inputs.pr_number }} directly into their bodies: Get PR metadata (curl URL and the echo "PR #..." line) and Post PR comment (the comments API URL). pr_number is untrusted dispatcher input, so a crafted value could be expanded by the workflow templater into the script and parsed as shell.

Pass pr_number through env: PR_NUMBER in both steps and reference it as quoted "$PR_NUMBER", matching the safer pattern already used elsewhere. github.server_url and github.repository stay as direct expressions since they are platform-trusted contexts, not shell-parsed untrusted data.

#MAPPS-306

MAPPS-307 routed PR_TITLE, PR_BRANCH, HEAD_SHA, and EXTRA_INSTRUCTIONS through `env:` in the Build failure context, Run Claude Code, and Commit and push steps, but two `run:` scripts still interpolated the dispatcher-supplied `${{ inputs.pr_number }}` directly into their bodies: Get PR metadata (curl URL and the `echo "PR #..."` line) and Post PR comment (the comments API URL). pr_number is untrusted dispatcher input, so a crafted value could be expanded by the workflow templater into the script and parsed as shell. Pass pr_number through `env: PR_NUMBER` in both steps and reference it as quoted "$PR_NUMBER", matching the safer pattern already used elsewhere. github.server_url and github.repository stay as direct expressions since they are platform-trusted contexts, not shell-parsed untrusted data. #MAPPS-306

Claude-Run added 1 commit

2026-06-26 09:29:14 +02:00

fix(ci): route dispatcher pr_number through env in remaining run steps (MAPPS-306)

Check / fmt + clippy + tests (pull_request) Successful in 1m31s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

3db14242b5

MAPPS-307 routed PR_TITLE, PR_BRANCH, HEAD_SHA, and EXTRA_INSTRUCTIONS through `env:` in the Build failure context, Run Claude Code, and Commit and push steps, but two `run:` scripts still interpolated the dispatcher-supplied `${{ inputs.pr_number }}` directly into their bodies: Get PR metadata (curl URL and the `echo "PR #..."` line) and Post PR comment (the comments API URL). pr_number is untrusted dispatcher input, so a crafted value could be expanded by the workflow templater into the script and parsed as shell.

Pass pr_number through `env: PR_NUMBER` in both steps and reference it as quoted "$PR_NUMBER", matching the safer pattern already used elsewhere. github.server_url and github.repository stay as direct expressions since they are platform-trusted contexts, not shell-parsed untrusted data.

#MAPPS-306