From 46602be0b319bf2afa890faadc7fc1e891934c55 Mon Sep 17 00:00:00 2001 From: Innei Date: Fri, 27 Mar 2026 01:18:35 +0800 Subject: [PATCH] =?UTF-8?q?=F0=9F=90=9B=20fix(workflow):=20prevent=20shell?= =?UTF-8?q?=20injection=20in=20auto-tag=20release=20(#13319)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .github/workflows/auto-tag-release.yml | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/.github/workflows/auto-tag-release.yml b/.github/workflows/auto-tag-release.yml index 640253733d..7c2e5ee945 100644 --- a/.github/workflows/auto-tag-release.yml +++ b/.github/workflows/auto-tag-release.yml @@ -26,8 +26,9 @@ jobs: - name: Detect release PR (version from title) id: release + env: + PR_TITLE: ${{ github.event.pull_request.title }} run: | - PR_TITLE="${{ github.event.pull_request.title }}" echo "PR Title: $PR_TITLE" # Match "🚀 release: v{x.x.x}" format (strict semver: x.y.z with optional -prerelease or +build) @@ -44,9 +45,10 @@ jobs: - name: Detect patch PR (branch first, title fallback) id: patch if: steps.release.outputs.should_tag != 'true' + env: + HEAD_REF: ${{ github.event.pull_request.head.ref }} + PR_TITLE: ${{ github.event.pull_request.title }} run: | - HEAD_REF="${{ github.event.pull_request.head.ref }}" - PR_TITLE="${{ github.event.pull_request.title }}" echo "Head ref: $HEAD_REF" echo "PR Title: $PR_TITLE"