harden: sanitize shell/subprocess call in action.yaml (CWE-78)

[anupamme]

Using variable interpolation ${{...}} with github context data in a run: step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. github context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with env: to store the data and use the environment variable in the run: script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR". This is defence-in-depth at action.yaml:29 rather than a vulnerability I can show is exploitable here — it makes the failure mode explicit and bounded. Close it freely if the pattern is intentional.

Reference: CWE-78

What changed

• action.yaml

Verification

No automated check could be run against this repository, so this change is unverified beyond review. Please treat it as a suggestion.

---

Automated security fix by OrbisAI Security

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 2b567bec-6bf8-418f-a85f-f3c9e5285d39

📥 Commits

Reviewing files that changed from the base of the PR and between e55fcc6 and de52b18.

📒 Files selected for processing (1)

• action.yaml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Walkthrough

The action now passes cli-version and serviceId through environment variables. The install step downloads, runs, and removes a local script. The deploy step passes the service ID to the Render CLI.

Changes

Render CLI input handling

Layer / File(s)	Summary
Shell input handling action.yaml	The install step sets CLI_VERSION, downloads the script with curl -o, runs it with sh, and removes it. The deploy step sets SERVICE_ID and passes it to render deploys create.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the security hardening change in action.yaml and references CWE-78.
Description check	✅ Passed	The description explains the shell injection risk, the environment-variable mitigation, the affected file, and the verification status.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
1 Accepted issue

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request

[rhahao]

@anupamme: thanks for identifying this potential command-injection risk and improving the workflow’s handling of user-provided inputs. I’ll merge the changes as submitted.

[rhahao]

🎉 This PR is included in version 2.1.1 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀