mirror of
https://github.com/docker/docs.git
synced 2026-10-23 18:09:02 +03:00
f90b2db317
## Description The `release-notes-pr-trigger` workflow was interpolating PR context values (`html_url`, `title`, `user.login`) directly into a shell heredoc. A specially crafted PR title or author name could break out of the JSON string and execute arbitrary commands. This change moves the GitHub context values into environment variables and uses `jq` to safely construct the JSON artifact, eliminating the injection vector. ## Related issues or tickets None ## Reviews - [x] Technical review Signed-off-by: Lorena Rangel <lorena.rangel@docker.com>
31 lines
869 B
YAML
31 lines
869 B
YAML
name: Release Notes PR Trigger
|
|
|
|
on:
|
|
pull_request:
|
|
types: [opened]
|
|
paths:
|
|
- content/manuals/desktop/release-notes.md
|
|
|
|
jobs:
|
|
trigger:
|
|
runs-on: ubuntu-24.04
|
|
if: github.repository_owner == 'docker'
|
|
steps:
|
|
- name: Save PR details
|
|
env:
|
|
PR_URL: ${{ github.event.pull_request.html_url }}
|
|
PR_TITLE: ${{ github.event.pull_request.title }}
|
|
PR_AUTHOR: ${{ github.event.pull_request.user.login }}
|
|
run: |
|
|
jq -n \
|
|
--arg url "$PR_URL" \
|
|
--arg title "$PR_TITLE" \
|
|
--arg author "$PR_AUTHOR" \
|
|
'{url: $url, title: $title, author: $author}' > pr-details.json
|
|
|
|
- name: Upload PR details
|
|
uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
|
|
with:
|
|
name: pr-details
|
|
path: pr-details.json
|