git.iko.soy/typeable/oauth2-proxy
on master help sign in
ci: ensure release branches originate from the local repository and reduce residual risk of command injection (#3337)

Signed-off-by: Jan Larwig <jan@larwig.com>

commite7724f3a745ac36225305f3d17b59931b647dc6e authorJan Larwig <jan@larwig.com> dateThu 12 Feb 2026, 21:18 (8 months ago) parent3a55dad
1 file changed+4−3
.github/workflows/publish-release.yml+4−3
.github/workflows/publish-release.yml+4−3
@@ -14,7 +14,7 @@ permissions:
1414
1515jobs:
1616 publish:
17− if: github.event.pull_request.merged && startsWith(github.event.pull_request.head.ref, 'release/')
17+ if: github.event.pull_request.merged && startsWith(github.event.pull_request.head.ref, 'release/') && github.event.pull_request.head.repo.full_name == github.repository
1818 runs-on: ubuntu-latest
1919 outputs:
2020 tag: ${{ steps.tag.outputs.version }}
@@ -27,14 +27,15 @@ jobs:
2727 fetch-tags: true
2828
2929 - name: Tag release
30+ env:
31+ BRANCH: ${{ github.event.pull_request.head.ref }}
3032 run: |
3133 # Set up github-actions[bot] user
3234 git config --local user.name "github-actions[bot]"
3335 git config --local user.email "41898282+github-actions[bot]@users.noreply.github.com"
3436
3537 # Get the version from the branch name
36− branch="${{ github.event.pull_request.head.ref }}"
37− version="${branch#release/}"
38+ version="${BRANCH#release/}"
3839 echo ${version}
3940
4041 # Tag and create release