Skip to content

The game patch string is checked before it reaches a shell - #1

Open
JIRPOS wants to merge 1 commit into
mainfrom
harden/actions-least-privilege
Open

The game patch string is checked before it reaches a shell#1
JIRPOS wants to merge 1 commit into
mainfrom
harden/actions-least-privilege

Conversation

@JIRPOS

@JIRPOS JIRPOS commented Aug 9, 2026

Copy link
Copy Markdown
Owner

Review notes

CHANGED: The patch version read from poe-tool-dev/latest-patch-version must be a dotted number and nothing else, or the run stops.

  • It is another project's file, and from here it reached both $GITHUB_OUTPUT and a command line in a job that can write to this repository. A second line in it would have written a step output of its own; a metacharacter would have run in the build step.
  • Tested with [[ =~ ]] rather than grep, which anchors per line and so accepts a string whose first line is a version and whose second is anything at all.

CHANGED: The build step takes the patch string through the environment instead of interpolating it into the script.

CHANGED: The data version is stamped once and reused for both --data-version and --tag. Two date calls either side of UTC midnight would have tagged a bundle with a day its own manifest disagrees with.

Nothing here changes the published bundle, so there are no release notes.

🤖 Generated with Claude Code

CHANGED: The patch version read from `poe-tool-dev/latest-patch-version` must be a dotted number
and nothing else, or the run stops.

- It is another project's file, and from here it reached both `$GITHUB_OUTPUT` and a command
  line in a job that can write to this repository. A second line in it would have written a
  step output of its own; a metacharacter would have run in the build step.
- Tested with `[[ =~ ]]` rather than `grep`, which anchors per line and passes a string whose
  first line is a version.

CHANGED: The build step takes the patch string through the environment instead of interpolating
it into the script.

CHANGED: The data version is stamped once and reused for both `--data-version` and `--tag`. Two
`date` calls either side of UTC midnight would have tagged a bundle with a day its own manifest
disagrees with.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant