Avoid running malicious inputs as shell commands in the workflows for…

… managing test builds of Custome GitHub actions.
woocommerce · May 15, 2024 · fdf569d · fdf569d
1 parent 95ae802
commit fdf569d
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 2 deletions.
diff --git a/.github/workflows/github-actions-create-test-build.yml b/.github/workflows/github-actions-create-test-build.yml
@@ -20,9 +20,10 @@ jobs:
           install-deps: "no"
 
       - name: Create and commit test build
+        env:
+          BRANCH_NAME: ${{ github.ref_name }}
         run: |
           REPO_URL="${{ github.server_url }}/${{ github.repository }}"
-          BRANCH_NAME="${{ github.ref_name }}"
           TEST_BRANCH_NAME="${BRANCH_NAME}-test-build"
 
           .github/scripts/github-actions-create-and-commit-build.sh "$REPO_URL" "$BRANCH_NAME"

diff --git a/.github/workflows/github-actions-delete-test-build.yml b/.github/workflows/github-actions-delete-test-build.yml
@@ -15,8 +15,9 @@ jobs:
           ref: trunk
 
       - name: Delete test build branch
+        env:
+          BRANCH_NAME: ${{ format('{0}-test-build', github.event.ref) }}
         run: |
-          BRANCH_NAME="${{ github.event.ref }}-test-build"
           REMOTE_BRANCH_NAME="origin/${BRANCH_NAME}"
 
           git fetch --prune --no-tags --depth=1 origin