ci: pass mirror-sync event fields through env instead of interpolating them #109

Closed

Grandiras wants to merge 1 commit from fix-mirror-workflow-injection into main

Grandiras commented

2026-09-24 12:26:00 +00:00

Owner

The mirror-sync workflows (GitHub sync-issues, sync-prs, sync-comments, and Forgejo sync-to-github) spliced event fields into run: scripts with ${{ }} expressions. Those fields are issue/PR titles and bodies, branch names and comment bodies, and they ended up next to FORGEJO_TOKEN / GH_MIRROR_TOKEN.

Every event field is now passed through env: and read as a quoted shell variable. The cat <<'BODYEOF' heredocs are gone.
The pull_request_target checkout sets persist-credentials: false.
The unused STATE variable in sync-issues.yml was dropped.

Verified by parsing all four workflows and asserting no ${{ remains inside any run: block, plus bash -n on each extracted script. The behaviour of the scripts is otherwise unchanged.

Follow-up for the maintainer: rotate FORGEJO_TOKEN (GitHub secret) and GH_MIRROR_TOKEN (Forgejo secret).

🤖 Generated with Claude Code

The mirror-sync workflows (GitHub `sync-issues`, `sync-prs`, `sync-comments`, and Forgejo `sync-to-github`) spliced event fields into `run:` scripts with `${{ }}` expressions. Those fields are issue/PR titles and bodies, branch names and comment bodies, and they ended up next to `FORGEJO_TOKEN` / `GH_MIRROR_TOKEN`. - Every event field is now passed through `env:` and read as a quoted shell variable. The `cat <<'BODYEOF'` heredocs are gone. - The `pull_request_target` checkout sets `persist-credentials: false`. - The unused `STATE` variable in `sync-issues.yml` was dropped. Verified by parsing all four workflows and asserting no `${{` remains inside any `run:` block, plus `bash -n` on each extracted script. The behaviour of the scripts is otherwise unchanged. **Follow-up for the maintainer:** rotate `FORGEJO_TOKEN` (GitHub secret) and `GH_MIRROR_TOKEN` (Forgejo secret). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

Grandiras added 1 commit

2026-09-24 12:26:00 +00:00

ci: pass mirror-sync event fields through env instead of interpolating them

Sync Closures to GitHub / sync-closure (pull_request) Successful in 8s

Details

CI / pds-integration (pull_request) Successful in 26s

Details

CI / build-and-test (pull_request) Successful in 57s

Details

cf5e3c9208

The GitHub sync-issues/sync-prs/sync-comments workflows and the Forgejo
sync-to-github workflow spliced issue, PR and comment titles, bodies and
branch names into run: scripts with ${{ }} expressions, next to the forge
tokens. Every event field now reaches the script as an environment
variable read as a quoted shell variable, the body heredocs are gone, and
the pull_request_target checkout no longer persists credentials.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Grandiras commented

2026-09-24 12:26:19 +00:00

Author

Owner

Superseded by #108, which fixes the same injection more thoroughly (permissions: {}, bare fetch instead of checkout, CI-config guard). Closing this duplicate.

Grandiras closed this pull request

2026-09-24 12:26:19 +00:00