Merge pull request #6208 from mozilla/MNTOR-5072

MNTOR-5072: secure usage of Github parameters

Author: mansaj

.github/workflows/docker_build_deploy.yml

@@ -59,7 +59,8 @@ jobs:
       - name: Deploy to Dockerhub
         env:
           DOCKERHUB_REPO: ${{ env.DOCKERHUB_REPO }}
+          TAGS: ${{ steps.meta.outputs.tags }}
         run: |
           # deploy main
-          docker tag blurts-server ${{ steps.meta.outputs.tags }}
-          docker push ${{ steps.meta.outputs.tags }}
+          docker tag blurts-server $TAGS
+          docker push $TAGS

.github/workflows/docker_build_deploy_v2.yml

@@ -68,13 +68,15 @@ jobs:
 
       - name: Build and push Docker image to GAR
         id: build-and-push
+        env:
+          TAGS: ${{ steps.meta.outputs.tags }}
         uses: docker/build-push-action@v6
         with:
           context: .
           # Push is true to push to GAR after build
           push: true
           # Tags generated by the metadata action (only GAR tag)
-          tags: ${{ steps.meta.outputs.tags }}
+          tags: ${{ env.TAGS }}
           # Pass build arguments
           build-args: |
             SENTRY_RELEASE=${{ github.sha }} # Use full SHA for Sentry release clarity
@@ -87,5 +89,7 @@ jobs:
           cache-to: type=gha,mode=max
 
       - name: Print Image URI
+        env:
+          TAGS: ${{ steps.meta.outputs.tags }}
         run: |
-          echo "Pushed GAR image: ${{ steps.meta.outputs.tags }}" 
+          echo "Pushed GAR image: $TAGS"

.github/workflows/release_cron_daily.yml

@@ -84,16 +84,22 @@ jobs:
         tags: type=sha,format=short,prefix=
 
     - name: Pull Docker image from GAR with commit tag
-      run: docker pull ${{ env.GAR_IMAGE_BASE }}:${{ steps.meta.outputs.version }}
+      env:
+        VERSION: ${{ steps.meta.outputs.version }}
+      run: docker pull ${{ env.GAR_IMAGE_BASE }}:$VERSION
 
     - name: Tag Docker image for Docker Hub with release tag
-      run: docker tag ${{ env.GAR_IMAGE_BASE }}:${{ steps.meta.outputs.version }} ${{ env.DOCKERHUB_IMAGE }}:${{ env.CURRENT_DATE }}
+      env:
+        VERSION: ${{ steps.meta.outputs.version }}
+      run: docker tag ${{ env.GAR_IMAGE_BASE }}:$VERSION ${{ env.DOCKERHUB_IMAGE }}:${{ env.CURRENT_DATE }}
 
     - name: Push Docker image to Docker Hub with release tag
       run: docker push ${{ env.DOCKERHUB_IMAGE }}:${{ env.CURRENT_DATE }}
 
     - name: Tag Docker image for GAR with release tag
-      run: docker tag ${{ env.GAR_IMAGE_BASE }}:${{ steps.meta.outputs.version }} ${{ env.GAR_IMAGE_BASE }}:${{ env.CURRENT_DATE }}
+      env:
+        VERSION: ${{ steps.meta.outputs.version }}
+      run: docker tag ${{ env.GAR_IMAGE_BASE }}:$VERSION ${{ env.GAR_IMAGE_BASE }}:${{ env.CURRENT_DATE }}
 
     - name: Push Docker image to GAR with release tag
       run: docker push ${{ env.GAR_IMAGE_BASE }}:${{ env.CURRENT_DATE }}

.github/workflows/release_retag.yaml

@@ -32,10 +32,14 @@ jobs:
         tags: type=sha,format=short,prefix=
 
     - name: Pull Docker image with commit tag
-      run: docker pull ${{ steps.meta.outputs.tags }}
+      env:
+        TAGS: ${{ steps.meta.outputs.tags }}
+      run: docker pull $TAGS
 
     - name: Tag Docker image with release tag
-      run: docker tag ${{ steps.meta.outputs.tags }} mozilla/blurts-server:${{ github.ref_name }}
+      env:
+        TAGS: ${{ steps.meta.outputs.tags }}
+      run: docker tag $TAGS mozilla/blurts-server:${{ github.ref_name }}
 
     - name: Push Docker image with release tag
       run: docker push mozilla/blurts-server:${{ github.ref_name }}

.github/workflows/release_retag_v2.yaml

@@ -55,20 +55,29 @@ jobs:
       run: echo "name=${{ env.GAR_IMAGE_BASE }}:${{ github.ref_name }}" >> $GITHUB_OUTPUT
 
     - name: Pull Docker image with commit tag from GAR
+      env:
+        TAGS: ${{ steps.meta.outputs.tags }}
       run: |
-        echo "Pulling ${{ steps.meta.outputs.tags }}"
-        docker pull ${{ steps.meta.outputs.tags }}
+        echo "Pulling $TAGS"
+        docker pull $TAGS
 
     - name: Tag Docker image with release tag
+      env:
+        TAGS: ${{ steps.meta.outputs.tags }}
+        NAME: ${{ steps.release_tag_info.outputs.name }}
       run: |
-        echo "Tagging ${{ steps.meta.outputs.tags }} as ${{ steps.release_tag_info.outputs.name }}"
-        docker tag ${{ steps.meta.outputs.tags }} ${{ steps.release_tag_info.outputs.name }}
+        echo "Tagging $TAGS as $NAME"
+        docker tag $TAGS $NAME
 
     - name: Push Docker image with release tag to GAR
+      env:
+        NAME: ${{ steps.release_tag_info.outputs.name }}
       run: |
-        echo "Pushing ${{ steps.release_tag_info.outputs.name }}"
-        docker push ${{ steps.release_tag_info.outputs.name }}
+        echo "Pushing $NAME"
+        docker push $NAME
 
     - name: Print Image URI
+      env:
+        NAME: ${{ steps.release_tag_info.outputs.name }}
       run: |
-        echo "Retagged and pushed GAR image: ${{ steps.release_tag_info.outputs.name }}" 
+        echo "Retagged and pushed GAR image: $NAME"