Merge pull request #286 from adfinis-forks/ci/harden-shell-interpolation

ci(workflows): harden release input handling

Author: domenkozar

.github/workflows/ffi-build.yml

@@ -136,6 +136,7 @@ jobs:
         shell: bash
         env:
           GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ inputs.release_tag || github.ref_name }}
         run: |
           set -euo pipefail
           mapfile -t assets < <(
@@ -148,4 +149,4 @@ jobs:
             exit 1
           fi
           bash scripts/upload-release-asset.sh \
-            "${{ inputs.release_tag || github.ref_name }}" "${assets[@]}"
+            "$RELEASE_TAG" "${assets[@]}"

.github/workflows/go-embed.yml

@@ -146,6 +146,7 @@ jobs:
         shell: bash
         env:
           GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ inputs.release_tag || github.ref_name }}
         run: |
           set -euo pipefail
           mapfile -t assets < <(find staged -type f -name 'secretspec_ffi_*' -print | sort)
@@ -155,7 +156,7 @@ jobs:
             exit 1
           fi
           bash scripts/upload-release-asset.sh \
-            "${{ inputs.release_tag || github.ref_name }}" "${assets[@]}"
+            "$RELEASE_TAG" "${assets[@]}"
 
       - name: Publish the Go module tag
         if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')

.github/workflows/go-static.yml

@@ -136,9 +136,10 @@ jobs:
         shell: bash
         env:
           GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ inputs.release_tag || github.ref_name }}
         run: |
           set -euo pipefail
           asset="secretspec-go-static-x86_64-linux-musl.tar.gz"
           tar -czf "$asset" -C staged .
           bash scripts/upload-release-asset.sh \
-            "${{ inputs.release_tag || github.ref_name }}" "$asset"
+            "$RELEASE_TAG" "$asset"

.github/workflows/php-ext.yml

@@ -148,4 +148,6 @@ jobs:
         shell: bash
         env:
           GH_TOKEN: ${{ github.token }}
-        run: bash scripts/upload-release-asset.sh "${{ inputs.release_tag || github.ref_name }}" "${{ steps.stage.outputs.asset }}"
+          RELEASE_ASSET: ${{ steps.stage.outputs.asset }}
+          RELEASE_TAG: ${{ inputs.release_tag || github.ref_name }}
+        run: bash scripts/upload-release-asset.sh "$RELEASE_TAG" "$RELEASE_ASSET"

.github/workflows/swift-package.yml

@@ -173,7 +173,8 @@ jobs:
       - name: Attach the XCFramework to the GitHub Release
         env:
           GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ inputs.release_tag || github.ref_name }}
         run: >-
           bash scripts/upload-release-asset.sh
-          "${{ inputs.release_tag || github.ref_name }}"
+          "$RELEASE_TAG"
           artifacts/CSecretSpec.xcframework.zip

scripts/upload-release-asset.sh

@@ -10,9 +10,21 @@
 # retry). Needs GH_TOKEN with contents: write.
 set -euo pipefail
 
+if (( $# < 2 )); then
+  echo "usage: upload-release-asset.sh <tag> <asset> [asset...]" >&2
+  exit 2
+fi
+
 tag="$1"
 shift
 
+# Release publication uses version tags. Reject malformed input before it is
+# passed to gh, while allowing SemVer prerelease and build suffixes.
+if [[ ! "$tag" =~ ^v[0-9]+\.[0-9]+\.[0-9]+([+-][0-9A-Za-z][0-9A-Za-z.+-]*)?$ ]]; then
+  echo "invalid release tag: $tag" >&2
+  exit 2
+fi
+
 files=()
 for asset in "$@"; do
   # Record only the basename so `sha256sum -c` works after users download the