Repository navigation
ci: pass the release tag to the publish script through env - #46
Conversation
The tag name was spliced into the run script with ${{ }}, so a tag
holding shell syntax would have run in the job that holds the MCP
Registry OIDC token. Read it from the environment instead.
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info
📝 Walkthrough
Merge Risk: ⚪ Minimal · up to
|
| Check name | Status | Explanation |
|---|---|---|
| Description Check |  |
Check skipped - CodeRabbit’s high-level summary is enabled. |
| Title check | |
The title clearly and concisely describes the main change: passing the release tag to the publish script through an environment variable. |
| Docstring Coverage | |
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… |
| Linked Issues check | |
Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | |
Check skipped because no linked issues were found for this pull request. |
Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
✨ Finishing Touches
-
🧪 Generate unit tests (beta)
-
- Commit to this branch
- Create a new PR
-
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
Comment @coderabbitai help to get the list of available commands.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #46 +/- ##
=========================================
Coverage 100.00% 100.00%
=========================================
Files 2 2
Lines 279 279
=========================================
Hits 279 279 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Before: the
publish-mcp-registryjob spliced the release tag into its script:GitHub substitutes
${{ }}into the script text before bash runs it, and a tag name can hold shell syntax ($(...),;,|are all legal in a ref name). That job holdsid-token: writefor the MCP Registry login. Only someone who can create a release picks the tag, so this is hardening rather than an open hole.After: the tag comes in through
env:and the script reads$RELEASE_TAG; the next step reads$VERSIONthe same way.Checked with bash, using a tag name that
git check-ref-formataccepts:tag name: v1.0.0$(echo${IFS}INJECTED>&2) -before: INJECTED ← the command in the tag ran - tag=v1.0.0 +after: tag=v1.0.0$(echo${IFS}INJECTED>&2)A normal tag like
v0.3.0still givesversion=0.3.0.Summary by CodeRabbit