ci: read GITHUB_REF from the environment, version the package from the tag - #504
Merged
Conversation
…e tag Interpolating github.ref into the Bash source lets a crafted tag execute shell code on a runner holding the NuGet key before the regex check runs; reading $GITHUB_REF from the environment removes the injection point. PackageVersion now comes from the tag so a tag no longer has to match the csproj version for the push path to exist. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
WalkthroughThe GitHub Actions workflow now reads the release tag from ChangesPackage versioning
Estimated code review effort: 2 (Simple) | ~10 minutes ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Same hardening as applied across the other package repos (flagged by review on NosCoreIO/NosCore.Shared#260):
${{ github.ref }}interpolated into the Bash[[ ... =~ ]]check is evaluated by the shell before the regex filters it — a tag like1.2.3$(...)would execute on a runner that holds the NuGet API key. Reading$GITHUB_REFfrom the environment removes the injection point.dotnet pack -p:PackageVersion=${TAG_NAME}— the pushed filename is derived from the tag, so the package version must match it; previously a tag that didn't match the csproj version madedotnet nuget pushfail on a missing file (the usual "bump csproj before tagging" dance).🤖 Generated with Claude Code
Summary by CodeRabbit