luckberg/familysync
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(16): WR-01/WR-03 bind PR context via env; symmetric HEAD_SHA fallback

Browse Source 
Bind github.base_ref/base.sha/head.sha through env: and reference quoted
shell vars (no inline ${{ }} in run:) to close the script-injection vector.
Add a HEAD_SHA rev-parse fallback mirroring BASE_SHA and echo the final
${BASE_SHA}..${HEAD_SHA} range before gitleaks.
This commit is contained in:
Lucas Berger
2026-06-13 08:42:40 -04:00
parent 4bb205fe0f
commit 26a6b2e53f
1 changed files with 21 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/ci.yml
+21 -5
View File
@@ -358,17 +358,33 @@ jobs:
# github.event.pull_request.base.sha may be empty on some Gitea versions.
# If so, fall back to git merge-base to compute the real branch-point SHA.
- name: Probe PR base/head SHA
# WR-01: bind context values through env: so they are never substituted
# into the rendered shell body (script-injection vector — github.base_ref
# is an attacker-influenceable branch name). Reference them as already-
# quoted shell variables only.
env:
PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
PR_BASE_REF: ${{ github.base_ref }}
run: |
set -euo pipefail
echo "Event base.sha: ${{ github.event.pull_request.base.sha }}"
echo "Event head.sha: ${{ github.event.pull_request.head.sha }}"
BASE_SHA="${{ github.event.pull_request.base.sha }}"
HEAD_SHA="${{ github.event.pull_request.head.sha }}"
echo "Event base.sha: $PR_BASE_SHA"
echo "Event head.sha: $PR_HEAD_SHA"
BASE_SHA="$PR_BASE_SHA"
HEAD_SHA="$PR_HEAD_SHA"
if [ -z "$BASE_SHA" ]; then
echo "base.sha empty — computing merge-base fallback"
BASE_SHA=$(git merge-base "$(git rev-parse origin/${{ github.base_ref }})" HEAD)
BASE_SHA=$(git merge-base "$(git rev-parse "origin/$PR_BASE_REF")" HEAD)
echo "Computed BASE_SHA via merge-base: $BASE_SHA"
fi
# WR-03: mirror the base fallback for head so the scan range is never
# silently left half-empty (A.. only happens to default to A..HEAD).
if [ -z "$HEAD_SHA" ]; then
echo "head.sha empty — falling back to git rev-parse HEAD"
HEAD_SHA=$(git rev-parse HEAD)
echo "Computed HEAD_SHA via rev-parse: $HEAD_SHA"
fi
echo "Secret-scan range: ${BASE_SHA}..${HEAD_SHA}"
echo "BASE_SHA=$BASE_SHA" >> "$GITHUB_ENV"
echo "HEAD_SHA=$HEAD_SHA" >> "$GITHUB_ENV"