diff options
| author | Ned Batchelder <ned@nedbatchelder.com> | 2022-07-17 06:36:10 -0400 |
|---|---|---|
| committer | Ned Batchelder <ned@nedbatchelder.com> | 2022-07-17 06:36:10 -0400 |
| commit | 6dff85d81bb77d6212b9fb6a9937729d5012c065 (patch) | |
| tree | a2a133520110df3841341c1a617db66ea62d29a4 /.github/workflows | |
| parent | 09be476a63c5aa2c39bdaff4db9b244da2a39a4a (diff) | |
| download | python-coveragepy-git-6dff85d81bb77d6212b9fb6a9937729d5012c065.tar.gz | |
build: avoid a script injection attack
Details here: https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable
Found with https://rhysd.github.io/actionlint/
Diffstat (limited to '.github/workflows')
| -rw-r--r-- | .github/workflows/coverage.yml | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml index 20c0bcc3..622a4c2a 100644 --- a/.github/workflows/coverage.yml +++ b/.github/workflows/coverage.yml @@ -185,6 +185,8 @@ jobs: path: reports_repo/${{ env.report_dir }} - name: "Push to report repo" + env: + COMMIT_MESSAGE: ${{ github.event.head_commit.message }} run: | set -xe # Make the redirect to the latest report. @@ -192,7 +194,7 @@ jobs: echo "<meta http-equiv='refresh' content='0;url=${{ env.url }}' />" >> reports_repo/latest.html echo "<body>Coverage report redirect..." >> reports_repo/latest.html # Make the commit message. - echo "${{ env.total }}% - ${{ github.event.head_commit.message }}" > commit.txt + echo "${{ env.total }}% - $COMMIT_MESSAGE" > commit.txt echo "" >> commit.txt echo "${{ env.url }}" >> commit.txt echo "${{ env.sha10 }}: ${{ env.branch }}" >> commit.txt |