b6f8688df8
Pre-existing latent bug surfaced by PR #17's CI run. The Decide step's inline `${{ github.event.pull_request.body }}` interpolation pastes arbitrary PR-body text directly into a bash script. When the body contains shell metacharacters (parens, pipes, backticks, redirections, etc.) the resulting script either errors out at YAML-load time OR — worse — executes attacker-controlled shell. This bit PR #17 with a real syntax error ("unexpected token `('") because the PR body contains parenthesized phrases like "(was: 10-minute timeout)". Every Decide-step run in this repo has been one badly-formatted PR body away from breaking the gate. Fix: forward `github.event.pull_request.body` and `github.event.pull_request.head.repo.fork` through the step's `env:` block as `PR_BODY` and `PR_IS_FORK`, then quote them in shell (`"$PR_BODY"`, `"$PR_IS_FORK"`). The env-var path leaves the values as plain strings rather than syntactically embedded code, which is the standard GitHub Actions hardening pattern (see GitHub's "Security hardening for GitHub Actions" → "Using a third-party action"). Same change in both workflows; ~9 LOC each. This fix is technically beyond Brief 1's scope (which targeted only Vercel-bypass plumbing) but is added in this convoy because the bug actively blocks Brief 1's success criterion from being validated on PR #17. Documented in the convoy file's "Anything flagged but not acted on" follow-up pass. Co-authored-by: Cursor <cursoragent@cursor.com> |
||
|---|---|---|
| .. | ||
| workflows | ||
| CODEOWNERS | ||
| PULL_REQUEST_TEMPLATE.md | ||