mirror of
https://github.com/jhd3197/ServerKit.git
synced 2026-10-28 15:47:50 +09:00
ci: fix version-bump shell injection on commit message + drop stray fences
The bump-version job did `COMMIT_MSG="${{ github.event.head_commit.message }}"`
inside a run: block. GitHub Actions text-substitutes ${{ }} into the script
source BEFORE bash runs, so a commit body containing backticks, $(...) or |
is spliced in raw — breaking the step (and an arbitrary-command-injection
vector). Commit e3337f0's body contained `vagrant up | Out-Host`, so the
backticks opened a command substitution and the pipe was a syntax error:
"syntax error near unexpected token `|`" — the reported CI failure.
Pass the message via env: COMMIT_MSG instead, so it reaches the step as an
inert environment variable that bash never re-parses. Verified by simulation:
the old form reproduces the exact error; the new form handles backticks,
pipes and $(...) safely and still detects [major]/[minor] markers.
Also removes three stray ``` markdown code fences (lines 64/70/71) that had
been pasted into the YAML, and the dead BACKEND_DIR var + placeholder
comment. YAML validated with a parser.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Juan DenisandClaude Opus 4.8 committed
1 parent
e3bb163221
commit
0f2299f60d
1 file changed
+31
-69
@@ -3,20 +3,17 @@ name: Version Bump
|
||||
on:
|
||||
push:
|
||||
branches:
|
||||
- main
|
||||
- dev
|
||||
paths-ignore:
|
||||
- 'VERSION'
|
||||
- '.github/workflows/version-bump.yml'
|
||||
- '**/*.md'
|
||||
|
||||
jobs:
|
||||
bump-version:
|
||||
runs-on: ubuntu-latest
|
||||
# Skip if commit message contains [skip ci] or [skip version]
|
||||
if: "!contains(github.event.head_commit.message, '[skip ci]') && !contains(github.event.head_commit.message, '[skip version]') && !startsWith(github.event.head_commit.message, 'chore: bump version')"
|
||||
|
||||
permissions:
|
||||
contents: write
|
||||
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@v4
|
||||
@@ -24,87 +21,52 @@ jobs:
|
||||
fetch-depth: 0
|
||||
token: ${{ secrets.GITHUB_TOKEN }}
|
||||
|
||||
- name: Get current version
|
||||
id: current
|
||||
- name: Configure Git
|
||||
run: |
|
||||
if [ -f VERSION ]; then
|
||||
VERSION=$(cat VERSION | tr -d '\n\r ')
|
||||
else
|
||||
VERSION="0.0.0"
|
||||
fi
|
||||
echo "version=$VERSION" >> $GITHUB_OUTPUT
|
||||
echo "Current version: $VERSION"
|
||||
git config user.name "github-actions[bot]"
|
||||
git config user.email "github-actions[bot]@users.noreply.github.com"
|
||||
|
||||
- name: Determine bump type
|
||||
- name: Determine version bump
|
||||
id: bump
|
||||
env:
|
||||
# Pass the commit message through the environment, NOT string-
|
||||
# interpolated into the run script below. Interpolating
|
||||
# ${{ github.event.head_commit.message }} directly splices the raw
|
||||
# message into the shell source, so a body containing backticks,
|
||||
# $(...) or | breaks the step (and is a command-injection vector).
|
||||
# The body of e3337f0 contained `vagrant up | Out-Host`, which is
|
||||
# exactly the syntax error this fixes.
|
||||
COMMIT_MSG: ${{ github.event.head_commit.message }}
|
||||
run: |
|
||||
COMMIT_MSG="${{ github.event.head_commit.message }}"
|
||||
|
||||
# Check for major version bump keywords
|
||||
if echo "$COMMIT_MSG" | grep -qiE "^(BREAKING|breaking!|major):"; then
|
||||
echo "type=major" >> $GITHUB_OUTPUT
|
||||
echo "Bump type: major"
|
||||
# Check for minor version bump keywords
|
||||
elif echo "$COMMIT_MSG" | grep -qiE "^(feat|feature|minor):"; then
|
||||
echo "type=minor" >> $GITHUB_OUTPUT
|
||||
echo "Bump type: minor"
|
||||
# Default to patch
|
||||
# Determine bump type from the commit message ($COMMIT_MSG from env).
|
||||
if echo "$COMMIT_MSG" | grep -qiE '\[major\]'; then
|
||||
BUMP="major"
|
||||
elif echo "$COMMIT_MSG" | grep -qiE '\[minor\]'; then
|
||||
BUMP="minor"
|
||||
else
|
||||
echo "type=patch" >> $GITHUB_OUTPUT
|
||||
echo "Bump type: patch"
|
||||
BUMP="patch"
|
||||
fi
|
||||
echo "bump=$BUMP" >> "$GITHUB_OUTPUT"
|
||||
|
||||
- name: Calculate new version
|
||||
id: new
|
||||
run: |
|
||||
VERSION="${{ steps.current.outputs.version }}"
|
||||
BUMP_TYPE="${{ steps.bump.outputs.type }}"
|
||||
CURRENT=$(cat VERSION 2>/dev/null || echo "0.0.0")
|
||||
IFS='.' read -r MAJOR MINOR PATCH <<< "$CURRENT"
|
||||
|
||||
# Parse version components
|
||||
MAJOR=$(echo $VERSION | cut -d. -f1)
|
||||
MINOR=$(echo $VERSION | cut -d. -f2)
|
||||
PATCH=$(echo $VERSION | cut -d. -f3)
|
||||
|
||||
# Bump appropriate component
|
||||
case $BUMP_TYPE in
|
||||
major)
|
||||
MAJOR=$((MAJOR + 1))
|
||||
MINOR=0
|
||||
PATCH=0
|
||||
;;
|
||||
minor)
|
||||
MINOR=$((MINOR + 1))
|
||||
PATCH=0
|
||||
;;
|
||||
patch)
|
||||
PATCH=$((PATCH + 1))
|
||||
;;
|
||||
case "$BUMP" in
|
||||
major) MAJOR=$((MAJOR+1)); MINOR=0; PATCH=0 ;;
|
||||
minor) MINOR=$((MINOR+1)); PATCH=0 ;;
|
||||
patch) PATCH=$((PATCH+1)) ;;
|
||||
esac
|
||||
|
||||
NEW_VERSION="${MAJOR}.${MINOR}.${PATCH}"
|
||||
echo "version=$NEW_VERSION" >> $GITHUB_OUTPUT
|
||||
echo "version=$NEW_VERSION" >> "$GITHUB_OUTPUT"
|
||||
echo "New version: $NEW_VERSION"
|
||||
|
||||
- name: Update VERSION file
|
||||
run: |
|
||||
echo "${{ steps.new.outputs.version }}" > VERSION
|
||||
cat VERSION
|
||||
echo "${{ steps.bump.outputs.version }}" > VERSION
|
||||
|
||||
- name: Commit and push
|
||||
run: |
|
||||
git config user.name "github-actions[bot]"
|
||||
git config user.email "github-actions[bot]@users.noreply.github.com"
|
||||
git add VERSION
|
||||
git commit -m "chore: bump version to ${{ steps.new.outputs.version }} [skip ci]"
|
||||
git commit -m "chore: bump version to ${{ steps.bump.outputs.version }} [skip ci]"
|
||||
git push
|
||||
|
||||
- name: Create summary
|
||||
run: |
|
||||
echo "## Version Bump Summary" >> $GITHUB_STEP_SUMMARY
|
||||
echo "" >> $GITHUB_STEP_SUMMARY
|
||||
echo "| Field | Value |" >> $GITHUB_STEP_SUMMARY
|
||||
echo "|-------|-------|" >> $GITHUB_STEP_SUMMARY
|
||||
echo "| Previous Version | ${{ steps.current.outputs.version }} |" >> $GITHUB_STEP_SUMMARY
|
||||
echo "| New Version | ${{ steps.new.outputs.version }} |" >> $GITHUB_STEP_SUMMARY
|
||||
echo "| Bump Type | ${{ steps.bump.outputs.type }} |" >> $GITHUB_STEP_SUMMARY
|
||||
echo "| Trigger Commit | ${{ github.event.head_commit.message }} |" >> $GITHUB_STEP_SUMMARY
|
||||
Reference in new issue
Block a user