Skip to content

docs(rules): flag GitHub Actions template injection in agent rules (EXSC-578) #2062

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
0xDEnYO merged 3 commits into from
Jul 16, 2026
+25 −0
Merged

docs(rules): flag GitHub Actions template injection in agent rules (EXSC-578) #2062

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
33a996b
docs(rules): add GHA template-injection convention (CONV:ACTIONS-NO-I…
0xDEnYO Jul 16, 2026
4656a8a
docs(rules): address CodeRabbit — custom env name, scope safety claim
0xDEnYO Jul 16, 2026
c576c46
docs(rules): set shell: bash in workflow example (CodeRabbit)
0xDEnYO Jul 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions .agents/rules/500-github-actions.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,30 @@ paths:
- uses: some-action@main
```

### No template injection in `run:` scripts ([CONV:ACTIONS-NO-INJECTION])

- **Never interpolate `${{ github.* }}` (or any other `${{ ... }}` expression carrying attacker-influenced data) directly into a `run:` shell script.** The expression is substituted into the script body **before** the shell runs, so a crafted value (e.g. a branch name, PR title, commit message, or actor login containing shell metacharacters) executes as code on the runner.
- **Highest-risk contexts** (attacker-controllable on `pull_request`/`issue`/`issue_comment` triggers): `github.actor`, `github.event.*` (`.pull_request.title`, `.pull_request.body`, `.pull_request.head.ref`, `.issue.title`, `.comment.body`, `.label.name`, `.action`), `github.head_ref`. Treat every `github.event.*` field as untrusted.
- **Fix**: bind the expression to an `env:` entry on the step, then reference the shell variable (quoted) inside `run:`. Values passed via `env:` reach the script as data, never as code.
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Outdated
- **Example (correct)**:

```yaml
- name: Check for authorized actor
env:
GITHUB_ACTOR: ${{ github.actor }}
run: |
if [[ "$GITHUB_ACTOR" == "lifi-action-bot" ]]; then echo "authorized"; fi
```
Comment thread
coderabbitai[bot] marked this conversation as resolved.

- **Anti-pattern (forbidden)**:

```yaml
- run: |
if [[ "${{ github.actor }}" == "lifi-action-bot" ]]; then echo "authorized"; fi
```

- `${{ secrets.* }}` and `${{ github.* }}` inside `if:`/`with:`/`env:` values are fine — only direct interpolation into the `run:` script body is the injection sink.

### Foundry installation ([CONV:FOUNDRY-SETUP])

- **Always install foundry via the project's `./.github/actions/setup-foundry` composite action.** Do not call `foundry-rs/foundry-toolchain` directly from a workflow.
Expand Down
Loading