Development record
release.yml feeds an unvalidated tag name into 'make build VERSION=$TAG', splicing it textually into the -ldflags shell recipe. TAG is inputs.tag or github.ref_name with no shape-check; the release job runs 'make build VERSION="${TAG}"' and Make substitutes $(VERSION) textually into 'go build -ldflags "...Version=$(VERSION)"', so a tag containing a double-quote closes the quoting and splices a shell command (reproduced: VERSION='v9.9.9";echo INJECTED;x="'). Such a tag is a legal git ref matching the v* trigger. site.yml shape-checks the identical value with a [[ =~ ]] vX.Y.Z pattern and documents why; release.yml shape-checks the sha but not the tag. Bounded: the injectable step is behind the release environment's required reviewer and github.ref_name is settable only by an insider who can already run code in CI, so it grants no new capability — defense-in-depth, but a real shape-check-parity gap that also propagates to the scaffold template (release.yml.tmpl). RECORDED NOT FIXED this round: release.yml cannot be exercised by CI, so an autonomous edit to the release pipeline is deferred to the maintainer. Proposed fix: add a tag=$TAG shape-check step (the site.yml regex, [[ =~ ]] not grep) before make build, in both release.yml and the scaffold template.
release.yml feeds an unvalidated tag name into 'make build VERSION=$TAG', splicing it textually into the -ldflags shell recipe. TAG is inputs.tag or github.ref_name with no shape-check; the release job runs 'make build VERSION="${TAG}"' and Make substitutes $(VERSION) textually into 'go build -ldflags "...Version=$(VERSION)"', so a tag containing a double-quote closes the quoting and splices a shell command (reproduced: VERSION='v9.9.9";echo INJECTED;x="'). Such a tag is a legal git ref matching the v* trigger. site.yml shape-checks the identical value with a [[ =~ ]] vX.Y.Z pattern and documents why; release.yml shape-checks the sha but not the tag. Bounded: the injectable step is behind the release environment's required reviewer and github.ref_name is settable only by an insider who can already run code in CI, so it grants no new capability — defense-in-depth, but a real shape-check-parity gap that also propagates to the scaffold template (release.yml.tmpl). RECORDED NOT FIXED this round: release.yml cannot be exercised by CI, so an autonomous edit to the release pipeline is deferred to the maintainer. Proposed fix: add a tag=$TAG shape-check step (the site.yml regex, [[ =~ ]] not grep) before make build, in both release.yml and the scaffold template.
Grounds
- pursued: a v* tag carrying a quote, a newline or no X.Y.Z core is refused before any step consumes it; shown wrong by a release job reaching make build with such a tag
Frontmatter
| id | iss-2608261041218890 |
|---|---|
| type | issue |
| lifecycle | resolved |
| severity | minor |
.abcd/work/issues/resolved/iss-2608261041218890-release-yml-tag-not-shape-checked-before.md
open on GitHub ↗ · commit history ↗
mentions2
- dcn-26082600000000012026-08-26 — bughunt round 7 (state #368): hardened the new issue-resolution
- iss-2608270559310755launch scaffold's release.yml.tmpl is hardcoded to abcd-cli's OWN artifact shape, so it calls itself a 'generic bare-repo' workflow but is not generic: it runs 'make build' to cross-compile 'the four binaries', 'sha256sum abcd-* > checksums.txt', and 'gh release create <tag> bin/abcd-* bin/checksums.txt' as literals (only the verify/Run step is a <% %> substitution). A scaffolded repo that is not a Go CLI producing four abcd-* binaries via make build therefore gets a release workflow that builds/publishes the wrong (or no matching) assets, and its install path expects artifacts the release never produces. This is the confirmed 'asset gap' seen in a scaffolded non-abcd-cli repo (its install expected four tarballs + SHA256SUMS the workflow does not publish). Fix requires a product decision on how a non-abcd-cli repo declares/derives its build+artifact shape (parameterise the build command / artifact glob / checksum name via render.go substitutions with a repo-declared shape; or detect Go-CLI vs other; or scaffold only the generic release plumbing by default and make binary build/publish opt-in). Neighbour iss-2608261041218890 (release.yml tag not shape-checked before make build) is a different defect in the same template. Do NOT touch abcd-cli's own .github/workflows/release.yml.