From c37773d9511b7755999639994c2a462c87291e21 Mon Sep 17 00:00:00 2001 From: Rhea Rafferty Date: Thu, 30 Jul 2026 05:54:24 +0000 Subject: [PATCH] Route step outputs through the environment in publish workflows Follow-up to #393, which fixed the workflow_dispatch input but left a second feed into the same sink: step outputs interpolated with ${{ }} inside run:. Those are substituted as script text before bash parses the line, and the values derive from repository content, which any write-access collaborator can change on a branch that workflow_dispatch can select. The version equality check does not help, because both sides come from the same package.json. Also fixes four sites the original scan never inspected: it only matched block scalars (run: |) and skipped single-line run:. That includes publish-cli's two npm publish invocations, where the packed path comes from a find(1) glob, and both publish-android-sdk gradle calls. The android gradle arguments are now quoted as well; they were bare before. Remaining ${{ }} reaching a shell: 6, all Actions-typed (dry_run boolean x4, containers_rollout choice x2). Co-Authored-By: Claude Opus 5 Signed-off-by: Rhea Rafferty --- .github/workflows/publish-android-sdk.yml | 7 +++++-- .github/workflows/publish-cli.yml | 10 +++++++--- .github/workflows/publish-electron-sdk.yml | 4 +++- .github/workflows/publish-node.yml | 4 +++- .github/workflows/publish-ohos-sdk.yml | 9 ++++++--- 5 files changed, 24 insertions(+), 10 deletions(-) diff --git a/.github/workflows/publish-android-sdk.yml b/.github/workflows/publish-android-sdk.yml index de5946f..60446b2 100644 --- a/.github/workflows/publish-android-sdk.yml +++ b/.github/workflows/publish-android-sdk.yml @@ -53,7 +53,9 @@ jobs: echo "value=${VERSION}" >> "$GITHUB_OUTPUT" - name: Build SDK and run central publication gate - run: gradle -p clients/android testReleaseUnitTest verifyReleaseElfAlignment -PVERSION_NAME=${{ steps.version.outputs.value }} + env: + RESOLVED_VERSION: ${{ steps.version.outputs.value }} + run: gradle -p clients/android testReleaseUnitTest verifyReleaseElfAlignment "-PVERSION_NAME=$RESOLVED_VERSION" - name: Verify local and remote publication task graphs env: @@ -70,4 +72,5 @@ jobs: - name: Publish SDK to GitHub Packages env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - run: gradle -p clients/android publish -PVERSION_NAME=${{ steps.version.outputs.value }} + RESOLVED_VERSION: ${{ steps.version.outputs.value }} + run: gradle -p clients/android publish "-PVERSION_NAME=$RESOLVED_VERSION" diff --git a/.github/workflows/publish-cli.yml b/.github/workflows/publish-cli.yml index 8753e7e..57b7136 100644 --- a/.github/workflows/publish-cli.yml +++ b/.github/workflows/publish-cli.yml @@ -92,18 +92,22 @@ jobs: - name: Publish dry run if: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run }} - run: npm publish "${{ steps.pack.outputs.path }}" --access public --dry-run + run: npm publish "$PACKAGE_PATH" --access public --dry-run env: NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} + PACKAGE_PATH: ${{ steps.pack.outputs.path }} - name: Publish to npm if: ${{ github.event_name != 'workflow_dispatch' || !inputs.dry_run }} - run: npm publish "${{ steps.pack.outputs.path }}" --access public + run: npm publish "$PACKAGE_PATH" --access public env: NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} + PACKAGE_PATH: ${{ steps.pack.outputs.path }} - name: Summary shell: bash + env: + RESOLVED_VERSION: ${{ steps.version.outputs.value }} run: | { echo "### CLI publish" @@ -111,6 +115,6 @@ jobs: echo "| Field | Value |" echo "|---|---|" echo "| Package | \`@botiverse/hands-cli\` |" - echo "| Version | \`${{ steps.version.outputs.value }}\` |" + echo "| Version | \`${RESOLVED_VERSION}\` |" echo "| Dry run | \`${{ github.event_name == 'workflow_dispatch' && inputs.dry_run }}\` |" } >> "$GITHUB_STEP_SUMMARY" diff --git a/.github/workflows/publish-electron-sdk.yml b/.github/workflows/publish-electron-sdk.yml index 1dfdb84..a18ad60 100644 --- a/.github/workflows/publish-electron-sdk.yml +++ b/.github/workflows/publish-electron-sdk.yml @@ -86,6 +86,8 @@ jobs: - name: Summary shell: bash + env: + RESOLVED_VERSION: ${{ steps.version.outputs.value }} run: | { echo "### Electron SDK publish" @@ -93,6 +95,6 @@ jobs: echo "| Field | Value |" echo "|---|---|" echo "| Package | \`@botiverse/hands-electron\` |" - echo "| Version | \`${{ steps.version.outputs.value }}\` |" + echo "| Version | \`${RESOLVED_VERSION}\` |" echo "| Dry run | \`${{ github.event_name == 'workflow_dispatch' && inputs.dry_run }}\` |" } >> "$GITHUB_STEP_SUMMARY" diff --git a/.github/workflows/publish-node.yml b/.github/workflows/publish-node.yml index b8bc071..bcc5db2 100644 --- a/.github/workflows/publish-node.yml +++ b/.github/workflows/publish-node.yml @@ -90,6 +90,8 @@ jobs: - name: Summary shell: bash + env: + RESOLVED_VERSION: ${{ steps.version.outputs.value }} run: | { echo "### Hands Node SDK publish" @@ -97,6 +99,6 @@ jobs: echo "| Field | Value |" echo "|---|---|" echo "| Package | \`@botiverse/hands-node\` |" - echo "| Version | \`${{ steps.version.outputs.value }}\` |" + echo "| Version | \`${RESOLVED_VERSION}\` |" echo "| Dry run | \`${{ github.event_name == 'workflow_dispatch' && inputs.dry_run }}\` |" } >> "$GITHUB_STEP_SUMMARY" diff --git a/.github/workflows/publish-ohos-sdk.yml b/.github/workflows/publish-ohos-sdk.yml index 55d2c16..c78b449 100644 --- a/.github/workflows/publish-ohos-sdk.yml +++ b/.github/workflows/publish-ohos-sdk.yml @@ -101,6 +101,7 @@ jobs: shell: bash env: REQUESTED_VERSION: ${{ inputs.version }} + RESOLVED_VERSION: ${{ steps.version.outputs.value }} run: | set -euo pipefail packaged_manifest="$RUNNER_TEMP/hands-oh-package.json5" @@ -113,8 +114,8 @@ jobs: "${GITHUB_REF_TYPE}" \ "${GITHUB_REF_NAME}" \ "${REQUESTED_VERSION:-}")" - if [[ "$packaged_version" != "${{ steps.version.outputs.value }}" ]]; then - echo "Packed HAR version $packaged_version differs from resolved version ${{ steps.version.outputs.value }}." >&2 + if [[ "$packaged_version" != "${RESOLVED_VERSION}" ]]; then + echo "Packed HAR version $packaged_version differs from resolved version ${RESOLVED_VERSION}." >&2 exit 1 fi @@ -197,6 +198,8 @@ jobs: - name: Summary if: always() shell: bash + env: + RESOLVED_VERSION: ${{ steps.version.outputs.value }} run: | { echo "### OHOS SDK" @@ -204,6 +207,6 @@ jobs: echo "| Field | Value |" echo "|---|---|" echo "| Package | \`@botiverse/hands\` |" - echo "| Version | \`${{ steps.version.outputs.value }}\` |" + echo "| Version | \`${RESOLVED_VERSION}\` |" echo "| Dry run | \`${{ github.event_name == 'pull_request' || (github.event_name == 'workflow_dispatch' && inputs.dry_run) }}\` |" } >> "$GITHUB_STEP_SUMMARY"