nandi.uk
Fork of daniellemaywood.uk/gleam — Wasm codegen work
Fix template injection in build-release action
Move action inputs to environment variables and use shell variable
expansion instead of direct template expansion to prevent potential
code injection.
See: https://docs.zizmor.sh/audits/#template-injection
author
Jonatan Männchen
committer
Louis Pilfold
date
(Apr 6, 2026, 3:47 PM +0100)
commit
b26596f6
b26596f6f14f3db7a83ca85a25bf2e6bd05ec893
parent
5664f27d
5664f27d2c1b48890a9567bc8ace6393d2d68c21
+7
-4
+7
-4
.github/actions/build-release/action.yml
+7
-4
.github/actions/build-release/action.yml
···
85
85
if: ${{ inputs.expected-binary-architecture }}
86
86
shell: bash
87
87
run: |
88
-
BINARY_PATH="target/${{ inputs.target }}/release/gleam"
89
-
if [[ "${{ inputs.target }}" == *"windows"* ]]; then
88
+
BINARY_PATH="target/${INPUTS_TARGET}/release/gleam"
89
+
if [[ "${INPUTS_TARGET}" == *"windows"* ]]; then
90
90
BINARY_PATH="${BINARY_PATH}.exe"
91
91
fi
92
92
93
-
if ! file -b "$BINARY_PATH" | grep -iq "${{ inputs.expected-binary-architecture }}"; then
93
+
if ! file -b "$BINARY_PATH" | grep -iq "${INPUTS_EXPECTED_BINARY_ARCHITECTURE}"; then
94
94
echo "error: Architecture mismatch"
95
-
echo "Expected architecture: '${{ inputs.expected-binary-architecture }}'"
95
+
echo "Expected architecture: '${INPUTS_EXPECTED_BINARY_ARCHITECTURE}'"
96
96
echo "Found binary type: '$(file -b "$BINARY_PATH")'"
97
97
exit 1
98
98
fi
99
99
echo "ok: Architecture match"
100
+
env:
101
+
INPUTS_TARGET: ${{ inputs.target }}
102
+
INPUTS_EXPECTED_BINARY_ARCHITECTURE: ${{ inputs.expected-binary-architecture }}
100
103
101
104
# We use Azure Trusted Signing to sign the Windows binaries.
102
105
# This is done to ensure that the binaries are trusted and can be