Skip to content

fix: use env vars for GitHub context expressions in run steps to prevent injection#8852

Merged
Jason3S merged 4 commits into
mainfrom
copilot/fix-security-issues-in-workflows
May 23, 2026
Merged

fix: use env vars for GitHub context expressions in run steps to prevent injection#8852
Jason3S merged 4 commits into
mainfrom
copilot/fix-security-issues-in-workflows

Conversation

Copilot AI commented May 23, 2026

Copy link
Copy Markdown
Contributor

Summary

This PR fixes script injection and secret exposure security issues found in GitHub Actions workflows and composite actions. In each case, a GitHub expression (${{ ... }}) was used directly inside a run: shell command instead of being passed through an environment variable — the recommended approach per GitHub's security hardening guide.

Issues Fixed

🔴 Secrets exposed in process arguments (visible via ps aux)

File Issue
update-readme.yml pnpm update-contributors ${{ secrets.GITHUB_TOKEN }} — token as CLI arg
reuseable-load-integrations-repo-list.yml ./tester.js list --json $DIRTY -t ${{ secrets.GITHUB_TOKEN }} — token as CLI arg
build-version-release.yml "https://${{ secrets.GITHUB_TOKEN }}@github.com/..." — token inline in URL

🔴 GITHUB_ENV injection (allows setting arbitrary environment variables)

File Issue
set-env/action.yaml echo "${{ inputs.name }}<<delimiter" >> $GITHUB_ENV — name injected directly

🟠 Shell script injection via unsanitised expressions in run: steps

File Expression
build-version-release.yml ${{ steps.version.outputs.version }} in lerna/gh commands
publish.yml ${{ steps.dist_tag.outputs.value }} in lerna publish command
integration-test.yml ${{ matrix.repo }} in shell run and jq selector
update-dictionaries.yml ${{ matrix.repo }} in shell run and jq selector
update-integration-repositories.yml ${{ matrix.repo }} and ${{ github.event.inputs.ref }} in run steps
reuseable-pr-from-artifact.yml ${{ inputs.patch_path }} in git apply command
update-dependencies-old.yml ${{ toJson(github.event.inputs) }} in echo command

Fix Pattern

For each issue, the expression is moved to an env: block and referenced via shell variable:

# Before (unsafe)
run: some-command ${{ github.event.inputs.ref }}

# After (safe)
env:
  REF: ${{ github.event.inputs.ref }}
run: some-command "$REF"

For jq queries using matrix.repo, the injection-safe --arg flag is used:

# Before (jq injection risk)
run: jq '.[] | select(.path == "${{ matrix.repo }}")'

# After (safe)
env:
  REPO: ${{ matrix.repo }}
run: jq --arg repo "$REPO" '.[] | select(.path == $repo)'

Copilot AI requested a review from Jason3S May 23, 2026 16:51
@github-actions github-actions Bot added the fix label May 23, 2026
@Jason3S Jason3S marked this pull request as ready for review May 23, 2026 17:07
@github-actions

github-actions Bot commented May 23, 2026

Copy link
Copy Markdown
Contributor

Performance Report

Daily Performance 
xychart-beta
    title Files Per Second by Day
    y-axis Files per Second
    x-axis Date [May-4, May-19, May-23]
    bar [186.25, 187.94, 194.83]
    line [35.07, 33.61, 33.61]
    line [140.01, 135.42, 141.02]
    line [53.38, 53.17, 61.69]
    line [38.18, 20.00, 21.39]
    line [46.04, 43.44, 46.93]
    line [71.11, 69.47, 66.58]
    line [100.08, 77.54, 78.67]
    line [81.26, 84.52, 86.35]
    line [191.37, 176.15, 214.04]
    line [166.55, 126.61, 150.76]
    line [119.17, 123.77, 126.62]
    line [17.95, 22.53, 20.36]
    line [24.56, 24.84, 25.25]
    line [24.93, 21.05, 26.01]
    line [91.75, 92.82, 98.34]
    line [102.79, 98.35, 97.90]
    line [382.99, 374.77, 364.18]
    line [158.32, 153.28, 150.66]
    line [13.72, 16.48, 15.69]
    line [6.46, 6.48, 6.95]
    line [229.32, 234.71, 224.49]
    line [189.78, 185.86, 187.24]
    line [240.52, 257.39, 266.56]
    line [37.38, 45.35, 36.30]
    line [218.55, 254.57, 234.88]
    line [127.00, 147.92, 129.44]
    line [215.39, 212.55, 216.41]
    line [226.51, 267.13, 237.19]
    line [353.58, 346.15, 341.56]
    line [160.29, 160.94, 165.78]
    line [213.17, 213.72, 210.62]
    line [129.13, 127.71, 126.19]
    line [94.12, 93.35, 93.70]
    line [138.03, 140.07, 141.47]
    line [213.15, 208.87, 215.72]
    line [84.38, 85.95, 85.10]
    line [321.24, 319.57, 291.15]
    line [41.81, 48.29, 54.89]
    line [126.81, 116.06, 118.55]
    line [144.52, 126.78, 142.90]
    line [263.11, 260.36, 248.86]
    line [172.93, 177.15, 175.73]
    line [258.73, 266.74, 250.31]
    line [97.37, 104.19, 101.73]
    line [263.28, 254.35, 254.16]
    line [403.25, 398.12, 450.82]
    line [209.84, 213.89, 207.66]
    line [222.86, 217.73, 205.56]
    line [193.68, 201.86, 201.58]
    line [170.59, 170.67, 197.00]
Loading
Time to Process Files
Repository Elapsed Min/Avg/Max SD SD Graph
AdaDoom3/AdaDoom3 2.83 2.2 / 2.5 / 2.8 0.27 ┣━━┻━━╋━━●━━┫
alexiosc/megistos 7.04 6.7 / 6.8 / 6.9 0.09 ┣━━┻━━╋━━┻━━┫ ●
apollographql/apollo-server 2.77 2.5 / 2.5 / 2.6 0.07 ┣━┻━━╋━━┻━┫ ●
aspnetboilerplate/aspnetboilerplate 8.92 8.7 / 8.9 / 9.2 0.19 ┣━━┻━━●━━┻━━┫
aws-amplify/docs 12.46 10.1 / 12.0 / 13.1 1.14 ┣━━┻━━╋●━┻━━┫
Azure/azure-rest-api-specs 10.45 9.3 / 9.5 / 9.6 0.12 ┣━┻╋┻━┫ ●
bitjson/typescript-starter 0.96 0.8 / 1.0 / 1.1 0.11 ┣━┻━━●━━┻━┫
caddyserver/caddy 3.39 3.0 / 3.3 / 3.4 0.16 ┣━━┻━━╋━●┻━━┫
canada-ca/open-source-logiciel-libre 1.01 1.0 / 1.1 / 1.1 0.05 ┣●┻━━╋━━┻━┫
chef/chef 4.87 4.7 / 4.9 / 4.9 0.10 ┣━┻━━●━━┻━┫
dart-lang/sdk 56.55 55.7 / 57.0 / 58.7 1.09 ┣━━━┻●━╋━━┻━━━┫
django/django 13.81 13.4 / 13.8 / 14.2 0.30 ┣━━┻━━●━━┻━━┫
eslint/eslint 9.93 9.5 / 9.7 / 9.9 0.15 ┣━━┻━━╋━━┻●━┫
exonum/exonum 3.29 3.3 / 3.4 / 3.5 0.08 ┣●┻━━╋━━┻━┫
flutter/samples 11.42 11.7 / 12.7 / 13.6 0.72 ●━━┻━━╋━━┻━━┫
gitbucket/gitbucket 3.16 2.5 / 2.9 / 3.4 0.43 ┣━━┻━━╋━●┻━━┫
googleapis/google-cloud-cpp 120.41 95.0 / 115.7 / 123.3 11.96 ┣━━━┻━━━╋━●━┻━━━┫
graphql/express-graphql 0.88 1.0 / 1.2 / 1.3 0.09 ● ┣━┻━━╋━━┻━┫
graphql/graphql-js 2.58 2.6 / 2.7 / 2.9 0.09 ┣●┻━━╋━━┻━┫
graphql/graphql-relay-js 1.05 1.1 / 1.1 / 1.2 0.03 ● ┣━━┻━╋━┻━━┫
graphql/graphql-spec 1.21 1.0 / 1.2 / 1.4 0.16 ┣━┻━●╋━━┻━┫
iluwatar/java-design-patterns 11.73 11.5 / 11.7 / 11.9 0.15 ┣━━┻━━●━━┻━━┫
ktaranov/sqlserver-kit 5.65 5.7 / 5.8 / 6.0 0.14 ┣━●┻━━╋━━┻━━┫
liriliri/licia 3.80 3.8 / 3.9 / 4.1 0.14 ┣━━┻●━╋━━┻━━┫
MartinThoma/LaTeX-examples 6.41 5.9 / 6.1 / 6.1 0.11 ┣━━┻━━╋━━┻━━┫ ●
mdx-js/mdx 1.77 1.4 / 1.7 / 1.9 0.19 ┣━┻━━╋●━┻━┫
microsoft/TypeScript-Website 5.43 5.3 / 5.5 / 5.6 0.11 ┣━━┻━●╋━━┻━━┫
MicrosoftDocs/PowerShell-Docs 23.91 24.0 / 24.7 / 25.7 0.68 ┣━●┻━━╋━━┻━━┫
neovim/nvim-lspconfig 5.26 5.1 / 5.3 / 5.4 0.11 ┣━━┻━━●━━┻━━┫
pagekit/pagekit 3.35 3.4 / 3.5 / 3.6 0.06 ●┣━┻━━╋━━┻━┫
php/php-src 25.12 23.6 / 24.3 / 25.6 0.79 ┣━━━┻━━╋━━●━━━┫
plasticrake/tplink-smarthome-api 1.02 1.3 / 1.3 / 1.5 0.09 ● ┣━┻━━╋━━┻━┫
prettier/prettier 7.74 7.6 / 7.7 / 7.9 0.13 ┣━━┻━━●━━┻━━┫
pycontribs/jira 1.20 1.4 / 1.5 / 1.6 0.07 ● ┣━┻━━╋━━┻━┫
RustPython/RustPython 6.80 6.2 / 6.5 / 6.7 0.22 ┣━━┻━━╋━━┻●━┫
shoelace-style/shoelace 2.83 2.8 / 2.9 / 3.0 0.11 ┣━┻━●╋━━┻━┫
slint-ui/slint 13.22 11.3 / 13.1 / 13.8 1.04 ┣━━┻━━●━━┻━━┫
SoftwareBrothers/admin-bro 1.83 2.3 / 2.4 / 2.6 0.10 ● ┣━┻━╋━┻━┫
sveltejs/svelte 17.29 21.6 / 22.0 / 22.5 0.38 ● ┣┻╋┻┫
TheAlgorithms/Python 5.64 5.2 / 5.5 / 5.7 0.18 ┣━━┻━━╋━━●━━┫
twbs/bootstrap 1.63 1.7 / 1.7 / 1.9 0.11 ┣━●━━╋━━┻━┫
typescript-cheatsheets/react 1.11 1.1 / 1.2 / 1.4 0.10 ┣━●━━╋━━┻━┫
typescript-eslint/typescript-eslint 4.49 4.0 / 4.2 / 4.6 0.23 ┣━━┻━━╋━━●━━┫
vitest-dev/vitest 10.05 10.1 / 10.5 / 11.1 0.35 ┣━●┻━━╋━━┻━━┫
w3c/aria-practices 3.23 2.5 / 3.0 / 3.3 0.32 ┣━━┻━━╋━●┻━━┫
w3c/specberus 1.87 1.8 / 1.9 / 2.0 0.08 ┣━┻●━╋━━┻━┫
webdeveric/webpack-assets-manifest 1.18 1.2 / 1.2 / 1.4 0.08 ┣━┻━●╋━━┻━┫
webpack/webpack 5.69 5.2 / 5.3 / 5.4 0.08 ┣━━┻━╋━┻━━┫ ●
wireapp/wire-desktop 1.34 1.3 / 1.3 / 1.4 0.06 ┣━┻━━╋●━┻━┫
wireapp/wire-webapp 11.96 11.7 / 11.9 / 12.2 0.16 ┣━━┻━━●━━┻━━┫

Note:

  • Elapsed time is in seconds.
Files per Second over Time
Repository Files Sec Fps Rel Trend Fps N
AdaDoom3/AdaDoom3 103 2.83 36.44 -11.25% ▃▇█▂▃ 4
alexiosc/megistos 583 7.04 82.78 -3.67% ▆▇▇█▅ 4
apollographql/apollo-server 255 2.77 91.96 -8.81% █▆▅█▃ 4
aspnetboilerplate/aspnetboilerplate 2286 8.92 256.22 0.08% █▅▇▆▇ 4
aws-amplify/docs 2959 12.46 237.50 -4.78% ▂▄█▃▃ 4
Azure/azure-rest-api-specs 2497 10.45 238.89 -9.34% ▆██▇▂ 4
bitjson/typescript-starter 20 0.96 20.76 0.11% ▂█▄▄▄ 4
caddyserver/caddy 313 3.39 92.43 -3.13% ▄▄▄█▄ 4
canada-ca/open-source-logiciel-libre 7 1.01 6.95 7.30% ▆▄██ 3
chef/chef 1032 4.87 212.11 -0.21% ▇▆▆█▆ 4
dart-lang/sdk 11396 56.55 201.51 0.88% ▅▇█▇▇ 4
django/django 2912 13.81 210.81 0.13% ▆█▇▅▇ 4
eslint/eslint 2072 9.93 208.72 -2.14% ▇█▆▇▆ 4
exonum/exonum 421 3.29 127.86 3.93% ▅▆▇▇█ 4
flutter/samples 1695 11.42 148.43 10.89% ▇▄▃▆█ 4
gitbucket/gitbucket 417 3.16 131.95 -10.45% █▃▂█▃ 4
googleapis/google-cloud-cpp 20926 120.41 173.79 -5.05% ▃▂▃█▃ 4
graphql/express-graphql 26 0.88 29.52 31.88% ▅▃▂▃█ 4
graphql/graphql-js 371 2.58 144.03 4.96% ▇▇▄▆█ 4
graphql/graphql-relay-js 28 1.05 26.60 8.39% ▅▅▆▄█ 4
graphql/graphql-spec 19 1.21 15.69 0.87% ▂▃█▅ 3
iluwatar/java-design-patterns 2061 11.73 175.73 -0.01% ▆▇█▇ 3
ktaranov/sqlserver-kit 490 5.65 86.77 3.22% ▅█▆██ 4
liriliri/licia 1438 3.80 378.71 2.20% █▆█▄█ 4
MartinThoma/LaTeX-examples 1409 6.41 219.80 -5.25% ▆▆█▆▄ 4
mdx-js/mdx 140 1.77 78.98 -5.27% █▂▄▃▃ 4
microsoft/TypeScript-Website 765 5.43 141.01 0.71% ▆█▆█▇ 4
MicrosoftDocs/PowerShell-Docs 3126 23.91 130.74 3.32% █▆█▅█ 4
neovim/nvim-lspconfig 857 5.26 163.02 0.22% ▆▅▆█▆ 4
pagekit/pagekit 741 3.35 221.44 3.98% ▇▅▇▆█ 4
php/php-src 2290 25.12 91.15 -3.30% ▇▅██▅ 4
plasticrake/tplink-smarthome-api 62 1.02 60.60 29.24% ▂▄▄▄█ 4
prettier/prettier 2674 7.74 345.56 -0.09% █▇▇▆▇ 4
pycontribs/jira 80 1.20 66.80 23.52% ▃▂▄▅█ 4
RustPython/RustPython 779 6.80 114.60 -4.79% █▄▅▇▄ 4
shoelace-style/shoelace 440 2.83 155.64 1.97% ██▅▄▇ 4
slint-ui/slint 3164 13.22 239.24 -0.13% ▂█▃▄▄ 4
SoftwareBrothers/admin-bro 441 1.83 241.43 32.23% ▄▃▂▃█ 4
sveltejs/svelte 8784 17.29 508.04 27.56% ▃▃▂▃█ 4
TheAlgorithms/Python 1407 5.64 249.29 -3.40% ▇█▅▅▅ 4
twbs/bootstrap 118 1.63 72.28 6.72% █▇▇▃█ 4
typescript-cheatsheets/react 24 1.11 21.66 -12.76% █▂▁▂▂ 4
typescript-eslint/typescript-eslint 1322 4.49 294.52 -5.61% ▇▆█▄▄ 4
vitest-dev/vitest 2685 10.05 267.15 4.63% ▄▆▇██ 4
w3c/aria-practices 414 3.23 128.33 -7.24% ▂▃█▃▃ 4
w3c/specberus 196 1.87 104.70 3.53% ▄█▅▅▇ 4
webdeveric/webpack-assets-manifest 55 1.18 46.47 3.08% ▇█▃█▇ 4
webpack/webpack 1169 5.69 205.56 -6.32% █▆▇▃ 3
wireapp/wire-desktop 45 1.34 33.48 -1.57% ██▄▆▆ 4
wireapp/wire-webapp 2236 11.96 187.03 -0.11% ██▆▇▇ 4
Data Throughput
Repository Files Sec Kps Rel Trend Kps N
AdaDoom3/AdaDoom3 103 2.83 774.49 -11.25% ▃▇█▂▃ 4
alexiosc/megistos 583 7.04 650.43 -3.67% ▆▇▇█▅ 4
apollographql/apollo-server 255 2.77 759.81 -8.79% █▆▅█▃ 4
aspnetboilerplate/aspnetboilerplate 2286 8.92 623.40 0.08% █▅▇▆▇ 4
aws-amplify/docs 2959 12.46 858.82 -4.75% ▂▄█▃▃ 4
Azure/azure-rest-api-specs 2497 10.45 715.22 -9.28% ▆██▇▂ 4
bitjson/typescript-starter 20 0.96 83.05 0.11% ▂█▄▄▄ 4
caddyserver/caddy 313 3.39 826.25 -3.16% ▄▄▄█▄ 4
canada-ca/open-source-logiciel-libre 7 1.01 57.58 7.30% ▆▄██ 3
chef/chef 1032 4.87 1038.58 -0.14% ▆▆▆█▆ 4
dart-lang/sdk 11396 56.55 1377.37 0.90% ▅▇█▇▇ 4
django/django 2912 13.81 1351.87 0.30% ▆█▇▅▇ 4
eslint/eslint 2072 9.93 1451.95 -2.14% ▇█▆▇▆ 4
exonum/exonum 421 3.29 1223.07 3.93% ▅▆▇▇█ 4
flutter/samples 1695 11.42 888.41 10.89% ▇▄▃▆█ 4
gitbucket/gitbucket 417 3.16 629.04 -9.76% ▇▃▂█▃ 4
googleapis/google-cloud-cpp 20926 120.41 1483.28 -5.05% ▃▂▃█▃ 4
graphql/express-graphql 26 0.88 135.09 31.88% ▅▃▂▃█ 4
graphql/graphql-js 371 2.58 853.28 4.96% ▇▇▄▆█ 4
graphql/graphql-relay-js 28 1.05 104.49 8.39% ▅▅▆▄█ 4
graphql/graphql-spec 19 1.21 523.63 0.87% ▂▃█▅ 3
iluwatar/java-design-patterns 2061 11.73 541.68 -0.01% ▆▇█▇ 3
ktaranov/sqlserver-kit 490 5.65 1314.42 3.22% ▅█▆██ 4
liriliri/licia 1438 3.80 451.92 2.25% █▇█▄█ 4
MartinThoma/LaTeX-examples 1409 6.41 453.96 -5.25% ▆▆█▆▄ 4
mdx-js/mdx 140 1.77 369.52 -5.32% █▂▄▃▃ 4
microsoft/TypeScript-Website 765 5.43 971.23 0.71% ▆█▆█▇ 4
MicrosoftDocs/PowerShell-Docs 3126 23.91 1393.16 3.28% █▆█▅█ 4
neovim/nvim-lspconfig 857 5.26 477.85 0.33% ▅▅▆█▆ 4
pagekit/pagekit 741 3.35 461.71 3.98% ▇▅▇▆█ 4
php/php-src 2290 25.12 1603.13 -3.29% ▇▅██▅ 4
plasticrake/tplink-smarthome-api 62 1.02 327.45 29.24% ▂▄▄▄█ 4
prettier/prettier 2674 7.74 474.53 -0.09% █▇▇▆▇ 4
pycontribs/jira 80 1.20 471.77 23.52% ▃▂▄▅█ 4
RustPython/RustPython 779 6.80 1951.95 -3.18% ▇▅▆█▅ 4
shoelace-style/shoelace 440 2.83 751.67 1.98% ██▅▄▇ 4
slint-ui/slint 3164 13.22 1249.61 -4.37% ▆█▃▃▄ 4
SoftwareBrothers/admin-bro 441 1.83 532.12 32.23% ▄▃▂▃█ 4
sveltejs/svelte 8784 17.29 344.71 27.56% ▃▃▂▃█ 4
TheAlgorithms/Python 1407 5.64 636.59 -3.40% ▇█▅▅▅ 4
twbs/bootstrap 118 1.63 593.57 6.72% █▇▇▃█ 4
typescript-cheatsheets/react 24 1.11 194.94 -6.42% █▃▂▃▃ 4
typescript-eslint/typescript-eslint 1322 4.49 1594.26 -5.59% ▇▆█▄▄ 4
vitest-dev/vitest 2685 10.05 691.00 -0.54% █▄▄▅▅ 4
w3c/aria-practices 414 3.23 1199.00 -7.24% ▂▃█▃▃ 4
w3c/specberus 196 1.87 341.35 3.43% ▄█▅▅▇ 4
webdeveric/webpack-assets-manifest 55 1.18 106.46 3.08% ▇█▃█▇ 4
webpack/webpack 1169 5.69 1034.50 -5.30% ▇██▄ 3
wireapp/wire-desktop 45 1.34 147.30 -1.57% ██▄▆▆ 4
wireapp/wire-webapp 2236 11.96 781.42 0.25% ██▇██ 4

@Jason3S Jason3S merged commit c529096 into main May 23, 2026
113 of 116 checks passed
@Jason3S Jason3S deleted the copilot/fix-security-issues-in-workflows branch May 23, 2026 17:33
@github-actions github-actions Bot mentioned this pull request May 23, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer
@Jason3S Jason3S Jason3S approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

@Jason3S Jason3S

Copilot code review Copilot

Labels

fix

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@Jason3S