ci(workflows): use environment variables in scripts to prevent command injection

.github/actions/upload-frontend-build-output-to-s3/action.yml

@@ -23,8 +23,10 @@ runs:
   - name: Upload to S3
     working-directory: ${{ inputs.frontend-path }}
     shell: bash
+    env:
+      PACKAGE_VERSION: ${{ inputs.package-version }}
     run: |
-      PKG_NAME=$(npm pkg get name | tr -d '"')
+      PKG_NAME=$(npm pkg get name | tr -d '\"')
       FILENAME=$(npm pack | tail -n1)
-      tar -xvf $FILENAME
-      aws s3 cp package s3://limecloud-static-files/packages/$PKG_NAME/${{ inputs.package-version }} --recursive --follow-symlinks
+      tar -xvf "$FILENAME"
+      aws s3 cp "package" "s3://limecloud-static-files/packages/$PKG_NAME/$PACKAGE_VERSION" --recursive --follow-symlinks

.github/workflows/cleanup.yml

@@ -27,4 +27,7 @@ jobs:
     - run: npm ci
     - run: git config --global user.email "[email protected]"
     - run: git config --global user.name "Lime Technologies OSS"
-    - run: npm run docs:publish -- --remove=PR-${{ github.event.pull_request.number }}
+    - name: Remove PR docs
+      env:
+        PR_NUMBER: ${{ github.event.pull_request.number }}
+      run: npm run docs:publish -- --remove="PR-$PR_NUMBER"

.github/workflows/create-backport-branch.yml

@@ -38,70 +38,75 @@ jobs:
     steps:
       - name: Extract Last Release Major and Minor Versions
         id: extract_last_versions
+        env:
+          LAST_RELEASE_VERSION: ${{ inputs.last_release_version }}
         run: |
-          last_version='${{ inputs.last_release_version }}'
-          IFS='.' read -r last_major last_minor last_patch <<< "$last_version"
-          echo "last_major=$last_major" >> $GITHUB_OUTPUT
-          echo "last_minor=$last_minor" >> $GITHUB_OUTPUT
+          IFS='.' read -r last_major last_minor last_patch <<< "$LAST_RELEASE_VERSION"
+          echo "last_major=$last_major" >> "$GITHUB_OUTPUT"
+          echo "last_minor=$last_minor" >> "$GITHUB_OUTPUT"
           echo "last major: $last_major"
           echo "last minor: $last_minor"
 
       - name: Extract New Release Major and Minor Versions
         id: extract_new_versions
+        env:
+          NEW_RELEASE_VERSION: ${{ inputs.new_release_version }}
         run: |
-          new_version='${{ inputs.new_release_version }}'
-          IFS='.' read -r new_major new_minor new_patch <<< "$new_version"
-          echo "new_major=$new_major" >> $GITHUB_OUTPUT
-          echo "new_minor=$new_minor" >> $GITHUB_OUTPUT
+          IFS='.' read -r new_major new_minor new_patch <<< "$NEW_RELEASE_VERSION"
+          echo "new_major=$new_major" >> "$GITHUB_OUTPUT"
+          echo "new_minor=$new_minor" >> "$GITHUB_OUTPUT"
           echo "new major: $new_major"
           echo "new minor: $new_minor"
 
       - name: Determine Bump Type
         id: determine_bump
+        env:
+          NEW_MAJOR: ${{ steps.extract_new_versions.outputs.new_major }}
+          NEW_MINOR: ${{ steps.extract_new_versions.outputs.new_minor }}
+          LAST_MAJOR: ${{ steps.extract_last_versions.outputs.last_major }}
+          LAST_MINOR: ${{ steps.extract_last_versions.outputs.last_minor }}
         run: |
-          new_major='${{ steps.extract_new_versions.outputs.new_major }}'
-          new_minor='${{ steps.extract_new_versions.outputs.new_minor }}'
-          last_major='${{ steps.extract_last_versions.outputs.last_major }}'
-          last_minor='${{ steps.extract_last_versions.outputs.last_minor }}'
-
-          if [ "$new_major" -gt "$last_major" ]; then
-            echo "bump_type=major" >> $GITHUB_OUTPUT
+          if [ "$NEW_MAJOR" -gt "$LAST_MAJOR" ]; then
+            echo "bump_type=major" >> "$GITHUB_OUTPUT"
             echo 'bump type is `major`'
-          elif [ "$new_major" -eq "$last_major" ] && [ "$new_minor" -gt "$last_minor" ]; then
-            echo "bump_type=minor" >> $GITHUB_OUTPUT
+          elif [ "$NEW_MAJOR" -eq "$LAST_MAJOR" ] && [ "$NEW_MINOR" -gt "$LAST_MINOR" ]; then
+            echo "bump_type=minor" >> "$GITHUB_OUTPUT"
             echo 'bump type is `minor`'
           else
-            echo "bump_type=patch" >> $GITHUB_OUTPUT
+            echo "bump_type=patch" >> "$GITHUB_OUTPUT"
             echo 'bump type is `patch` or other'
           fi
 
       - name: Determine Branch Name
         id: determine_branch_name
+        env:
+          BUMP_TYPE: ${{ steps.determine_bump.outputs.bump_type }}
+          LAST_MAJOR: ${{ steps.extract_last_versions.outputs.last_major }}
+          LAST_MINOR: ${{ steps.extract_last_versions.outputs.last_minor }}
         run: |
-          bump_type='${{ steps.determine_bump.outputs.bump_type }}'
-          last_major='${{ steps.extract_last_versions.outputs.last_major }}'
-          last_minor='${{ steps.extract_last_versions.outputs.last_minor }}'
-
-          if [ "$bump_type" = "major" ]; then
-            branch_name="${last_major}.x.x"
-          elif [ "$bump_type" = "minor" ]; then
-            branch_name="${last_major}.${last_minor}.x"
+          if [ "$BUMP_TYPE" = "major" ]; then
+            branch_name="${LAST_MAJOR}.x.x"
+          elif [ "$BUMP_TYPE" = "minor" ]; then
+            branch_name="${LAST_MAJOR}.${LAST_MINOR}.x"
           else
             branch_name=""
           fi
-          echo "branch_name=$branch_name" >> $GITHUB_OUTPUT
+          echo "branch_name=$branch_name" >> "$GITHUB_OUTPUT"
           echo "branch name: $branch_name"
 
       - name: Set Last Release Git Tag
         id: set_git_tag
         if: ${{ steps.determine_branch_name.outputs.branch_name != '' }}
+        env:
+          LAST_RELEASE_GIT_TAG_INPUT: ${{ inputs.last_release_git_tag }}
+          LAST_RELEASE_VERSION_INPUT: ${{ inputs.last_release_version }}
         run: |
-          if [ -z "${{ inputs.last_release_git_tag }}" ]; then
-            git_tag="v${{ inputs.last_release_version }}"
+          if [ -z "$LAST_RELEASE_GIT_TAG_INPUT" ]; then
+            git_tag="v$LAST_RELEASE_VERSION_INPUT"
           else
-            git_tag="${{ inputs.last_release_git_tag }}"
+            git_tag="$LAST_RELEASE_GIT_TAG_INPUT"
           fi
-          echo "last_release_git_tag=${git_tag}" >> $GITHUB_OUTPUT
+          echo "last_release_git_tag=${git_tag}" >> "$GITHUB_OUTPUT"
           echo "last release git tag: ${git_tag}"
 
       - name: Checkout Code
@@ -113,9 +118,12 @@ jobs:
 
       - name: Create Release Branch
         if: ${{ steps.determine_branch_name.outputs.branch_name != '' }}
+        env:
+          LAST_RELEASE_GIT_TAG: ${{ steps.set_git_tag.outputs.last_release_git_tag }}
+          BRANCH_NAME: ${{ steps.determine_branch_name.outputs.branch_name }}
         run: |
-          git fetch origin "refs/tags/${{ steps.set_git_tag.outputs.last_release_git_tag }}:refs/tags/${{ steps.set_git_tag.outputs.last_release_git_tag }}"
-          git checkout "${{ steps.set_git_tag.outputs.last_release_git_tag }}"
-          git checkout -b "${{ steps.determine_branch_name.outputs.branch_name }}"
-          git push origin "${{ steps.determine_branch_name.outputs.branch_name }}"
-          echo "branch created: ${{ steps.determine_branch_name.outputs.branch_name }}"
+          git fetch origin "refs/tags/$LAST_RELEASE_GIT_TAG:refs/tags/$LAST_RELEASE_GIT_TAG"
+          git checkout "$LAST_RELEASE_GIT_TAG"
+          git checkout -b "$BRANCH_NAME"
+          git push origin "$BRANCH_NAME"
+          echo "branch created: $BRANCH_NAME"

.github/workflows/pr-checks.yml

@@ -94,4 +94,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Automerge
-        run: "curl -L -X PUT -H \"Accept: application/vnd.github+json\" -H \"Authorization: Bearer ${{ secrets.MERGE_AUTOMATIC_PR }}\" -H \"X-GitHub-Api-Version: 2022-11-28\" https://api.github.com/repos/Lundalogik/lime-elements/pulls/${{ github.event.pull_request.number }}/merge -d '{\"merge_method\":\"rebase\"}'"
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          MERGE_TOKEN: ${{ secrets.MERGE_AUTOMATIC_PR }}
+        run: |
+          curl -L -X PUT \
+            -H "Accept: application/vnd.github+json" \
+            -H "Authorization: Bearer $MERGE_TOKEN" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            https://api.github.com/repos/Lundalogik/lime-elements/pulls/$PR_NUMBER/merge \
+            -d '{"merge_method":"rebase"}'

.github/workflows/publish-docs.yml

@@ -41,9 +41,16 @@ jobs:
     - run: git config --global user.name "Lime Technologies OSS"
     - name: Publish docs
       if: inputs.buildOnly == false
-      run: npm run docs:publish -- --v=${{ inputs.version }} ${{ inputs.forcePush && '--forcePush' }}
       env:
+        DOCS_VERSION: ${{ inputs.version }}
+        FORCE_PUSH: ${{ inputs.forcePush }}
         GH_TOKEN: ${{ secrets.PUBLISH_DOCS }}
+      run: |
+        if [ "$FORCE_PUSH" = "true" ]; then
+          npm run docs:publish -- --v="$DOCS_VERSION" --forcePush
+        else
+          npm run docs:publish -- --v="$DOCS_VERSION"
+        fi
     - name: Build docs, but do not publish
       if: inputs.buildOnly
       run: npm run docs:build

publish-docs.js

@@ -50,11 +50,6 @@ usage: npm run docs:publish [-- [--v=<version>] [--remove=<pattern>]
     --noTeardown    Run no cleanup at end of script. Implies --noCleanOnFail.
     --noCleanOnFail Do not run cleanup if script fails. Unless --noTeardown
                     is set, cleanup will still be run if script is successful.
-
-    --authorName    Commit author name. Will update the local git config if set.
-                    Will use existing git config if omitted.
-    --authorEmail   Commit author email address. Will update the local git
-                    config if set. Will use existing git config if omitted.
     `);
 } else if (removeSpecific || pruneDev) {
     let commitMessage;
@@ -385,19 +380,17 @@ function commit(message) {
     message = message || `chore(docs): create docs ${version}`;
     shell.cd('docsDist');
 
-    if (argv.authorName) {
-        shell.echo('setting git config user.name');
-        shell.exec(`git config --local user.name '${argv.authorName}'`);
-    }
-
-    if (argv.authorEmail) {
-        shell.echo('setting git config user.email');
-        shell.exec(`git config --local user.email '${argv.authorEmail}'`);
-    }
-
     shell.exec('git add -A --ignore-errors');
 
-    if (shell.exec(`git commit -m "${message}"`).code !== 0) {
+    const result = shell.exec('git commit -m "$COMMIT_MESSAGE"', {
+        env: { ...process.env, COMMIT_MESSAGE: message },
+    });
+    // If commit fails for any reason other than "nothing to commit", treat as error
+    if (
+        result.code !== 0 &&
+        !result.stdout.includes('nothing to commit') &&
+        !result.stdout.includes('no changes added to commit')
+    ) {
         shell.echo('git commit failed!');
         shell.cd('..');
         teardown();