fix(ci): pass PR head ref as data, scope contents:write to publish job (PMS-500) #372

Merged

Claude-Run merged 1 commit from fix/PMS-500-harden-create-release-injection into main

2026-06-26 10:39:10 +02:00

Claude-Run commented

2026-06-26 10:31:32 +02:00

Member

Pass those values through the env: mapping and reference them as $HEAD_REF / env.HEAD_REF so they are treated as data, not code. Split the workflow into a read-only gate job and a create-release publish job so contents:write is granted only to the step that actually publishes. The gate validates the head ref against a strict ^release/v[0-9.]+ pattern in a data context before any release runs, and always succeeds so the repo status badge stays green on non-release merges.

#PMS-500

The create-release workflow interpolated attacker-controlled github.event.* values (the PR head ref and merged flag) directly into bash and Nushell command text, allowing shell/script injection in a PR-triggered job that held a contents:write token. Pass those values through the env: mapping and reference them as $HEAD_REF / $env.HEAD_REF so they are treated as data, not code. Split the workflow into a read-only gate job and a create-release publish job so contents:write is granted only to the step that actually publishes. The gate validates the head ref against a strict ^release/v[0-9.]+$ pattern in a data context before any release runs, and always succeeds so the repo status badge stays green on non-release merges. #PMS-500

Claude-Run added 1 commit

2026-06-26 10:31:32 +02:00

fix(ci): pass PR head ref as data, scope contents:write to publish job (PMS-500)

E2E / Playwright against staging (pull_request) Successful in 24s

Details

Check / fmt + clippy + build + tests (pull_request) Successful in 1m21s

Details

Integration / integration tests (pull_request) Successful in 7m10s

Details

Create release / Gate (release-branch merges only) (pull_request) Successful in 1s

Details

Create release / Create release from merged PR (pull_request) Has been skipped

Details

7cdf124b1d

The create-release workflow interpolated attacker-controlled github.event.* values (the PR head ref and merged flag) directly into bash and Nushell command text, allowing shell/script injection in a PR-triggered job that held a contents:write token.

Pass those values through the env: mapping and reference them as $HEAD_REF / $env.HEAD_REF so they are treated as data, not code. Split the workflow into a read-only gate job and a create-release publish job so contents:write is granted only to the step that actually publishes. The gate validates the head ref against a strict ^release/v[0-9.]+$ pattern in a data context before any release runs, and always succeeds so the repo status badge stays green on non-release merges.

#PMS-500