From ac14a51b6b704c76476542fad67594518093e272 Mon Sep 17 00:00:00 2001
From: leonard-tesnov <ltesnovs@gocardless.com>
Date: Mon, 14 Sep 2026 15:52:40 +0300
Subject: [PATCH] Pass release version to shell via env, not interpolation

The release workflow interpolated ${{ steps.version.outputs.version }}
directly into three `run:` bodies. Actions substitutes that textually
before the shell runs, so the value is parsed as shell source rather
than read as data. The version is read from build.gradle, and one of the
affected steps is the one holding the release token.

Bind the value through step-level `env:` so the shell reads it as data,
and reject a version that is not plain semver at the point it is read.

Ref: SEC-11868

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .github/workflows/auto-release.yml | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/auto-release.yml b/.github/workflows/auto-release.yml
index 82622df7..e1cb0487 100644
--- a/.github/workflows/auto-release.yml
+++ b/.github/workflows/auto-release.yml
@@ -19,12 +19,18 @@ jobs:
         id: version
         run: |
           VERSION=$(grep "^version = " build.gradle | sed "s/version = '\(.*\)'/\1/")
+          # Guard against a crafted version string reaching later shell commands.
+          if [[ ! "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+([-+][0-9A-Za-z.-]+)?$ ]]; then
+            echo "Refusing to release: '$VERSION' is not a valid semantic version"
+            exit 1
+          fi
           echo "version=$VERSION" >> $GITHUB_OUTPUT
 
       - name: Check if tag exists
         id: check
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
         run: |
-          VERSION="${{ steps.version.outputs.version }}"
           if git rev-parse "v${VERSION}" >/dev/null 2>&1; then
             echo "Tag v${VERSION} already exists, skipping release"
             echo "should_release=false" >> $GITHUB_OUTPUT
@@ -36,8 +42,9 @@ jobs:
       - name: Extract changelog notes for this version
         id: notes
         if: steps.check.outputs.should_release == 'true'
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
         run: |
-          VERSION="${{ steps.version.outputs.version }}"
           NOTES=""
           if [ -f CHANGELOG.md ]; then
             NOTES=$(awk -v ver="$VERSION" '
@@ -57,7 +64,7 @@ jobs:
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
-          TAG="v${{ steps.version.outputs.version }}"
+          TAG="v${VERSION}"
           git tag "$TAG"
           git push origin "$TAG"
           if [ -n "$(echo "$NOTES" | tr -d '[:space:]')" ]; then
@@ -67,4 +74,5 @@ jobs:
           fi
         env:
           GITHUB_TOKEN: ${{ secrets.GOCARDLESS_CI_ROBOT_TOKEN }}
+          VERSION: ${{ steps.version.outputs.version }}
           NOTES: ${{ steps.notes.outputs.notes }}