7 commits

Author	SHA1	Message	Date
emozilla	2abe11a7fe	security(ci): pass untrusted refs through env, not run: interpolation ... lint.yml inlined github.head_ref (the fork PR branch name, attacker- controlled) into the diff-summary run: block. GitHub expands ${{ }} into the script text before bash tokenizes it, so a branch like x$(id) runs on the lint runner. The pull_request trigger keeps the token read-only, but the sink still allows CI resource abuse and cache/artifact tampering, and would become RCE-with-secrets under pull_request_target. Route head_ref through an env var (env values are not subject to expression injection) and reference "$HEAD_REF". Apply the same to the two docker.yml sites that interpolate github.event.release.tag_name. Fixes GHSA-jpw6-c7jr-c56v, GHSA-2843-hjmf-7x96. Credit: @technotion, @youngstar-eth.	2026-07-03 12:44:30 -04:00
ethernet	cca8b4ef4e	fix(ci): unify amd64/arm64 docker pipelines	2026-06-29 19:17:04 -07:00
ethernet	2fa66950e8	change(ci): upload-artifact from v4 -> v7	2026-06-26 19:15:18 -07:00
ethernet	4b0a2040e7	change(ci): use run_tests in docker	2026-06-26 19:15:18 -07:00
ethernet	18f7ad49ab	change(ci): update all UV installs	2026-06-26 19:15:18 -07:00
ethernet	f0cb049217	change(ci): migrate docker smoketests to real tests	2026-06-26 19:15:18 -07:00
ethernet	fb1dd1bf91	change(ci): docker-publish.yml -> docker.yml	2026-06-26 19:15:18 -07:00

Renamed from .github/workflows/docker-publish.yml (Browse further)