From 943a3d32605019666837798829b57e7f0adc1eda Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Christian=20Gonz=C3=A1lez=20Di=20Antonio?= Date: Sun, 18 Oct 2026 13:54:20 +0200 Subject: [PATCH] ci: the summary reads the pull request through env The summary step wrote the pull request's title, author and branches into its script as expressions. They reach it as environment variables now, as GitHub's hardening guide asks: what the author writes is data to the script, never part of it. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/pr.yaml | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml index 52073b6..12cf21c 100644 --- a/.github/workflows/pr.yaml +++ b/.github/workflows/pr.yaml @@ -35,15 +35,23 @@ jobs: with: go-version-file: ./go.mod + # What the pull request's author writes (its title, its branch, its + # login) reaches the script as environment variables, never spliced + # into it: an expression in a script is text in the script. - name: Summary Information + env: + PR_TITLE: ${{ github.event.pull_request.title }} + PR_AUTHOR: ${{ github.event.pull_request.user.login }} + PR_HEAD: ${{ github.event.pull_request.head.ref }} + PR_BASE: ${{ github.event.pull_request.base.ref }} run: | echo "# Pull Request Summary" > $GITHUB_STEP_SUMMARY echo "" >> $GITHUB_STEP_SUMMARY echo "**Repository:** ${{ github.repository }}" >> $GITHUB_STEP_SUMMARY - echo "**Pull Request:** ${{ github.event.pull_request.title }}" >> $GITHUB_STEP_SUMMARY - echo "**Author:** ${{ github.event.pull_request.user.login }}" >> $GITHUB_STEP_SUMMARY - echo "**Branch:** ${{ github.event.pull_request.head.ref }}" >> $GITHUB_STEP_SUMMARY - echo "**Base:** ${{ github.event.pull_request.base.ref }}" >> $GITHUB_STEP_SUMMARY + echo "**Pull Request:** ${PR_TITLE}" >> $GITHUB_STEP_SUMMARY + echo "**Author:** ${PR_AUTHOR}" >> $GITHUB_STEP_SUMMARY + echo "**Branch:** ${PR_HEAD}" >> $GITHUB_STEP_SUMMARY + echo "**Base:** ${PR_BASE}" >> $GITHUB_STEP_SUMMARY echo "**Commits:** ${{ github.event.pull_request.commits }}" >> $GITHUB_STEP_SUMMARY echo "**Changed Files:** ${{ github.event.pull_request.changed_files }}" >> $GITHUB_STEP_SUMMARY echo "**Additions:** ${{ github.event.pull_request.additions }}" >> $GITHUB_STEP_SUMMARY