mirror of
https://github.com/ZoneMinder/zoneminder.git
synced 2026-11-06 20:53:00 -05:00
Nic Boet
cb176ceffc
release-source-tarball pasted ${{ inputs.tag }},
${{ github.event.release.tag_name }} and the step outputs derived from
them straight into the run: scripts. GitHub substitutes expressions
into the script text before bash parses it, so a tag containing shell
syntax ran as code in a job with contents: write. Only people who can
publish a release or dispatch the workflow can set the tag, so this is
hardening, not an exposure.
Pass each value through env: and read it as a shell variable, as
GitHub's security hardening guide recommends. Normal tags produce the
same outputs and tarball name as before; the `with:` inputs are not
shell and are unchanged.