From e7d153b7ea54210a00258dfc1c9205e32dac1ff1 Mon Sep 17 00:00:00 2001 From: erwan-joly Date: Sun, 30 Aug 2026 20:49:53 +1200 Subject: [PATCH] ci: read GITHUB_REF from the environment, version the package from the tag Interpolating github.ref into the Bash source lets a crafted tag execute shell code on a runner holding the NuGet key before the regex check runs; reading $GITHUB_REF from the environment removes the injection point. PackageVersion now comes from the tag so a tag no longer has to match the csproj version for the push path to exist. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/dotnet.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/dotnet.yml b/.github/workflows/dotnet.yml index e5a4cc50..26a83c31 100644 --- a/.github/workflows/dotnet.yml +++ b/.github/workflows/dotnet.yml @@ -22,7 +22,7 @@ jobs: - name: Check Tag id: check-tag run: | - if [[ ${{ github.ref }} =~ ^refs/tags/[0-9]+\.[0-9]+\.[0-9]+$ ]]; then + if [[ "$GITHUB_REF" =~ ^refs/tags/[0-9]+.[0-9]+.[0-9]+$ ]]; then echo "match=true" >> $GITHUB_OUTPUT fi @@ -39,7 +39,7 @@ jobs: TAG_NAME=${GITHUB_REF#refs/tags/} dotnet restore dotnet build -c Release - dotnet pack -c Release -o /tmp/nupkgs -v m -p:IncludeSymbols=true -p:SymbolPackageFormat=snupkg + dotnet pack -c Release -o /tmp/nupkgs -v m -p:IncludeSymbols=true -p:SymbolPackageFormat=snupkg -p:PackageVersion=${TAG_NAME} dotnet nuget push /tmp/nupkgs/NosCore.Packets.${TAG_NAME}.nupkg -s https://api.nuget.org/v3/index.json -k ${{secrets.NUGET_API_KEY}} echo "ARTIFACT_PATH=/tmp/nupkgs/NosCore.Packets.${TAG_NAME}.nupkg" >> $GITHUB_OUTPUT echo "ARTIFACT_NAME=NosCore.Packets.${TAG_NAME}.nupkg" >> $GITHUB_OUTPUT