Skip to content

fix(ci): use feat: prefix in release PR title for semantic-release #385

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
skevetter merged 1 commit into from
May 19, 2026
Merged

fix(ci): use feat: prefix in release PR title for semantic-release #385

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions .github/workflows/create-release-pr.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,9 @@ jobs:
gh pr create \
--base release \
--head main \
--title "release: promote main to stable" \
--title "feat(release): promote main to stable" \
--body "## Commits being promoted

${{ steps.commits.outputs.log }}"
${{ steps.commits.outputs.log }}

> **Merge with rebase** to preserve individual commit messages for semantic-release."
Comment on lines 44 to +48

@coderabbitai coderabbitai Bot May 19, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

Avoid shell/template injection when building PR body (Line 46).

steps.commits.outputs.log is injected into a double-quoted shell argument. If a commit message contains shell metacharacters (for example $(...) or quotes), it can be executed/interpreted in this step.

🔒 Safer pattern using --body-file 
       - name: Create PR
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          COMMITS_LOG: ${{ steps.commits.outputs.log }}
         run: |
+          {
+            printf '## Commits being promoted\n\n'
+            printf '%s\n\n' "$COMMITS_LOG"
+            printf '> **Merge with rebase** to preserve individual commit messages for semantic-release.\n'
+          } > pr_body.md
+
           gh pr create \
             --base release \
             --head main \
             --title "feat(release): promote main to stable" \
-            --body "## Commits being promoted
-
-          ${{ steps.commits.outputs.log }}
-
-          > **Merge with rebase** to preserve individual commit messages for semantic-release."
+            --body-file pr_body.md
🧰 Tools
🪛 zizmor (1.25.2)

[info] 46-46: code injection via template expansion (template-injection): may expand into attacker-controllable code

(template-injection)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/create-release-pr.yml around lines 44 - 48, Replace
interpolating ${{ steps.commits.outputs.log }} directly into the double-quoted
--body argument (which allows shell/template injection) by writing the output
safely to a file and passing that file to the GitHub CLI via --body-file;
specifically, capture steps.commits.outputs.log into a temp file using a safe
write (e.g. printf '%s' "${{ steps.commits.outputs.log }}" > pr_body.txt) and
then call gh pr create ... --body-file pr_body.txt (instead of --body "...${{
steps.commits.outputs.log }}...") so special characters in the commit log are
not interpreted by the shell or CLI.

Loading