From 94a1d354920710247cf6a7cb1951f9ea17951b6a Mon Sep 17 00:00:00 2001 From: Jarek Potiuk Date: Thu, 2 Apr 2026 00:08:45 +0200 Subject: [PATCH] Prevent workflow command injection in verify action build output Wrap the verify-action-build.py invocation with ::stop-commands:: so that strings like ##[add-matcher] or ::error:: in action diffs are not interpreted as GitHub Actions workflow commands. --- .github/workflows/verify_dependabot_action.yml | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/.github/workflows/verify_dependabot_action.yml b/.github/workflows/verify_dependabot_action.yml index 5b0850a4..1bd86717 100644 --- a/.github/workflows/verify_dependabot_action.yml +++ b/.github/workflows/verify_dependabot_action.yml @@ -39,6 +39,15 @@ jobs: - run: pipx install uv - name: Verify action build - run: uv run utils/verify-action-build.py --ci --from-pr "${{ github.event.pull_request.number }}" + run: | + # Disable workflow command processing so that strings like + # "##[add-matcher]" or "::error::" in action diffs are not + # interpreted as GitHub Actions commands. + stop_token="$(uuidgen)" + echo "::stop-commands::${stop_token}" + uv run utils/verify-action-build.py --ci --from-pr "${{ github.event.pull_request.number }}" + rc=$? + echo "::${stop_token}::" + exit $rc env: GH_TOKEN: ${{ github.token }}