From 52a3bb0aea4b5bf43ef6545b78e87b3e4b91b3e6 Mon Sep 17 00:00:00 2001 From: Vaibhav Jain Date: Fri, 24 Jul 2026 14:19:30 -0700 Subject: [PATCH 1/3] Update gh token --- .github/workflows/release.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 942ddd9..ff7fff8 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -105,7 +105,7 @@ jobs: - name: Commit Release env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + GITHUB_TOKEN: ${{ secrets.GH_PUBLISH_TOKEN }} GIT_AUTHOR_NAME: amplitude-sdk-bot GIT_AUTHOR_EMAIL: amplitude-sdk-bot@users.noreply.github.com GIT_COMMITTER_NAME: amplitude-sdk-bot From b1e46b8ba03ab1d5471bf491e0fa29db0f211972 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Fri, 24 Jul 2026 21:22:39 +0000 Subject: [PATCH 2/3] Fix release workflow to use GH_PUBLISH_TOKEN for git push actions/checkout persists the default GITHUB_TOKEN in local git config by default. Setting GITHUB_TOKEN in a later step env block does not override those persisted credentials. Disable persist-credentials on checkout and configure the origin remote with GH_PUBLISH_TOKEN before pushing release commits and tags. Co-authored-by: Vaibhav Jain --- .github/workflows/release.yaml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index ff7fff8..41384dd 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -18,6 +18,8 @@ jobs: - name: Checkout uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3 + with: + persist-credentials: false - name: Set up Java 17 uses: actions/setup-java@17f84c3641ba7b8f6deff6309fc4c864478f5d62 # v3 @@ -105,12 +107,13 @@ jobs: - name: Commit Release env: - GITHUB_TOKEN: ${{ secrets.GH_PUBLISH_TOKEN }} + GH_PUBLISH_TOKEN: ${{ secrets.GH_PUBLISH_TOKEN }} GIT_AUTHOR_NAME: amplitude-sdk-bot GIT_AUTHOR_EMAIL: amplitude-sdk-bot@users.noreply.github.com GIT_COMMITTER_NAME: amplitude-sdk-bot GIT_COMMITTER_EMAIL: amplitude-sdk-bot@users.noreply.github.com run: | + git remote set-url origin "https://x-access-token:${GH_PUBLISH_TOKEN}@github.com/${{ github.repository }}" git commit -am "release: ${{ github.event.inputs.version }}" git tag v${{ github.event.inputs.version }} git push From 9eff25e92c206e3d3da11da5cd70b72db0abecb3 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Fri, 24 Jul 2026 21:43:32 +0000 Subject: [PATCH 3/3] Fix Semgrep run-shell-injection in release git push step Avoid interpolating github context directly in run scripts. Use env vars for VERSION and authenticate via http.extraheader instead of embedding the token in the git remote URL. Co-authored-by: Vaibhav Jain --- .github/workflows/release.yaml | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml index 41384dd..1cb5546 100644 --- a/.github/workflows/release.yaml +++ b/.github/workflows/release.yaml @@ -108,13 +108,16 @@ jobs: - name: Commit Release env: GH_PUBLISH_TOKEN: ${{ secrets.GH_PUBLISH_TOKEN }} + VERSION: ${{ github.event.inputs.version }} GIT_AUTHOR_NAME: amplitude-sdk-bot GIT_AUTHOR_EMAIL: amplitude-sdk-bot@users.noreply.github.com GIT_COMMITTER_NAME: amplitude-sdk-bot GIT_COMMITTER_EMAIL: amplitude-sdk-bot@users.noreply.github.com run: | - git remote set-url origin "https://x-access-token:${GH_PUBLISH_TOKEN}@github.com/${{ github.repository }}" - git commit -am "release: ${{ github.event.inputs.version }}" - git tag v${{ github.event.inputs.version }} + git config --local http.https://github.com/.extraheader \ + "AUTHORIZATION: basic $(printf 'x-access-token:%s' "$GH_PUBLISH_TOKEN" | base64 -w0)" + git commit -am "release: ${VERSION}" + git tag "v${VERSION}" git push git push --tags + git config --local --unset-all http.https://github.com/.extraheader