From 09690e5c779e88a80f5ece11f2d7ed9f5b96b407 Mon Sep 17 00:00:00 2001
From: Xavier Karma <xavier@bongbetic.com>
Date: Fri, 6 Nov 2026 19:29:21 +0530
Subject: [PATCH] fix(ci): pass release tag and repo to shell through env

Semgrep's run-shell-injection rule flags ${{ github.ref_name }} and
${{ github.repository }} interpolated into run: blocks. The tag name is
attacker-influenced input (git allows $, ( and ; in ref names), so the
release upload steps now read both through step env and quote them.
---
 .github/workflows/release.yml | 33 ++++++++++++++++++++++-----------
 1 file changed, 22 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 57c7450..9fc3b5d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -372,10 +372,12 @@ jobs:
       - name: Attach to release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ github.ref_name }}
+          REPO: ${{ github.repository }}
         run: |
-          gh release upload "${{ github.ref_name }}" \
+          gh release upload "$TAG" \
             dist/*.AppImage \
-            --repo ${{ github.repository }} \
+            --repo "$REPO" \
             --clobber
 
   # The .deb and .rpm are thin: they depend on the distro's Python, GTK,
@@ -424,10 +426,12 @@ jobs:
       - name: Attach to release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ github.ref_name }}
+          REPO: ${{ github.repository }}
         run: |
-          gh release upload "${{ github.ref_name }}" \
+          gh release upload "$TAG" \
             dist/*.deb dist/*.rpm \
-            --repo ${{ github.repository }} \
+            --repo "$REPO" \
             --clobber
 
   build-native-arm64:
@@ -470,10 +474,12 @@ jobs:
       - name: Attach to release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ github.ref_name }}
+          REPO: ${{ github.repository }}
         run: |
-          gh release upload "${{ github.ref_name }}" \
+          gh release upload "$TAG" \
             dist/*.deb dist/*.rpm \
-            --repo ${{ github.repository }} \
+            --repo "$REPO" \
             --clobber
 
   # Pins match .github/workflows/flatpak.yml. These jobs start with the tag
@@ -783,12 +789,14 @@ jobs:
       - name: Attach to release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ github.ref_name }}
+          REPO: ${{ github.repository }}
         run: |
           set -euo pipefail
           ls -la dist/*.flatpak
-          gh release upload "${{ github.ref_name }}" \
+          gh release upload "$TAG" \
             dist/*.flatpak \
-            --repo ${{ github.repository }} \
+            --repo "$REPO" \
             --clobber
 
   # Runs last because the aarch64 AppImage, both Flatpak bundles, the native
@@ -848,10 +856,12 @@ jobs:
       - name: Attach SHA256SUMS to the release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ github.ref_name }}
+          REPO: ${{ github.repository }}
         run: |
-          gh release upload "${{ github.ref_name }}" \
+          gh release upload "$TAG" \
             dist/SHA256SUMS \
-            --repo ${{ github.repository }} \
+            --repo "$REPO" \
             --clobber
 
   publish-pypi:
@@ -1078,11 +1088,12 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TAG: ${{ github.ref_name }}
+          REPO: ${{ github.repository }}
         run: |
           set -euo pipefail
           ls -la dist/*.snap
           gh release upload "$TAG" dist/*.snap \
-            --repo ${{ github.repository }} \
+            --repo "$REPO" \
             --clobber
 
   publish-snap: