Skip to content

fix: template injection vulns and excessive permissions in workflows #99

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
daithihearn merged 6 commits into from
Mar 5, 2026
Merged

fix: template injection vulns and excessive permissions in workflows #99

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
e816ac4
fix: template injection vulns and excessive permissions
Vombato Feb 26, 2026
62baed0
fix: adapt permission for gradle and GH packages push
Vombato Mar 4, 2026
62edd87
Merge branch 'main' into fix/worlfow-vuln-fixes
Vombato Mar 4, 2026
ee992fa
fix: permissions for publish test result workflow
Vombato Mar 4, 2026
e04a44b
Merge branch 'main' into fix/worlfow-vuln-fixes
Vombato Mar 4, 2026
0c2ff79
Merge branch 'main' into fix/worlfow-vuln-fixes
Vombato Mar 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion .github/workflows/on-main.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,9 @@ jobs:
steps:
- name: Get latest tag
id: latest-tag
run: echo "latest-tag=${{ github.ref == 'refs/heads/main' && 'dev-latest' || github.ref_name }}" >> "$GITHUB_OUTPUT"
env:
LATEST_TAG: ${{ github.ref == 'refs/heads/main' && 'dev-latest' || github.ref_name }}
run: echo "latest-tag=$LATEST_TAG" >> "$GITHUB_OUTPUT"
test:
name: Test
uses: ./.github/workflows/test.yml
Expand Down
9 changes: 5 additions & 4 deletions .github/workflows/on-release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,8 +5,7 @@ on:
types: [published]

permissions:
contents: write
pull-requests: write
contents: read
packages: write

jobs:
Expand All @@ -30,9 +29,11 @@ jobs:
echo "DEFAULT_PROJECT_VERSION=$(./gradlew properties -q | grep '^version:' | awk '{print $2}')" >> $GITHUB_ENV

- name: Ensure the default project version matches the tag name (the workflow will fail if they don't match)
env:
RELEASE_TAG: ${{ github.event.release.tag_name }}
run: |
if [ "${{ github.event.release.tag_name }}" != "$DEFAULT_PROJECT_VERSION" ]; then
echo "Error: Tag name (${{ github.event.release.tag_name }}) does not match the project version ($DEFAULT_PROJECT_VERSION)"
if [ "$RELEASE_TAG" != "$DEFAULT_PROJECT_VERSION" ]; then
echo "Error: Tag name ($RELEASE_TAG) does not match the project version ($DEFAULT_PROJECT_VERSION)"
exit 1
fi

Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/publish-test-results.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,12 +5,12 @@ on:

permissions:
contents: read
pages: write
id-token: write
packages: write

jobs:
publish-test-reports:
permissions:
pages: write
id-token: write
environment:
name: github-pages
url: ${{ steps.deployment.outputs.page_url }}
Expand Down
2 changes: 0 additions & 2 deletions .github/workflows/test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,8 +5,6 @@ on:

permissions:
contents: read
id-token: write
packages: write
checks: write

jobs:
Expand Down