From b8f33f487c0225b95fc2e440e3f6a98d5f146041 Mon Sep 17 00:00:00 2001
From: Andrew Morgan <andrew@amorgan.xyz>
Date: Mon, 13 Jul 2026 17:26:51 +0100
Subject: [PATCH] Avoid shell template injection in workflows

Move values derived from GitHub expressions into step environment variables before using them in shell scripts. This prevents expression interpolation from becoming executable shell syntax.

Quote the Docker digest, Docker metadata tags, matrix distro, release ref name, and Twisted ref usages at the shell boundary while preserving the existing workflow behavior.
---
 .github/workflows/docker.yml                |  4 +++-
 .github/workflows/docs.yaml                 |  4 +++-
 .github/workflows/push_complement_image.yml | 11 +++++++----
 .github/workflows/release-artifacts.yml     |  6 ++++--
 .github/workflows/twisted_trunk.yml         |  4 +++-
 5 files changed, 20 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index dcc6653659..bd3016b57c 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -112,8 +112,10 @@ jobs:
       - name: Export digest
         run: |
           mkdir -p ${{ runner.temp }}/digests
-          digest="${{ steps.build.outputs.digest }}"
+          digest="$BUILD_DIGEST"
           touch "${{ runner.temp }}/digests/${digest#sha256:}"
+        env:
+          BUILD_DIGEST: ${{ steps.build.outputs.digest }}
 
       - name: Upload digest
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml
index 4331b3e6ba..93a8831637 100644
--- a/.github/workflows/docs.yaml
+++ b/.github/workflows/docs.yaml
@@ -68,7 +68,9 @@ jobs:
           mdbook-version: '0.5.2'
 
       - name: Set version of docs
-        run: echo 'window.SYNAPSE_VERSION = "${{ needs.pre.outputs.branch-version }}";' > ./docs/website_files/version.js
+        run: echo 'window.SYNAPSE_VERSION = "${NEEDS_PRE_OUTPUTS_BRANCH_VERSION}";' > ./docs/website_files/version.js
+        env:
+          NEEDS_PRE_OUTPUTS_BRANCH_VERSION: ${{ needs.pre.outputs.branch-version }}
 
       - name: Setup python
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
diff --git a/.github/workflows/push_complement_image.yml b/.github/workflows/push_complement_image.yml
index 5d26a2f2fe..730d0741f5 100644
--- a/.github/workflows/push_complement_image.yml
+++ b/.github/workflows/push_complement_image.yml
@@ -74,9 +74,12 @@ jobs:
         run: scripts-dev/complement.sh --build-only
       - name: Tag and push generated image
         run: |
-          for TAG in ${{ join(fromJson(steps.meta.outputs.json).tags, ' ') }}; do 
+          while IFS= read -r TAG; do
+            [ -n "$TAG" ] || continue
             echo "tag and push $TAG"
             # `localhost/complement-synapse` should match the image created by `scripts-dev/complement.sh`
-            docker tag localhost/complement-synapse $TAG
-            docker push $TAG
-          done
+            docker tag localhost/complement-synapse "$TAG"
+            docker push "$TAG"
+          done <<< "$DOCKER_METADATA_OUTPUT_TAGS"
+        env:
+          DOCKER_METADATA_OUTPUT_TAGS: ${{ steps.meta.outputs.tags }}
diff --git a/.github/workflows/release-artifacts.yml b/.github/workflows/release-artifacts.yml
index 7352382128..50a940a81a 100644
--- a/.github/workflows/release-artifacts.yml
+++ b/.github/workflows/release-artifacts.yml
@@ -96,9 +96,11 @@ jobs:
             --docker-build-arg=--cache-to=type=local,mode=max,dest=/tmp/.buildx-cache-new \
             --docker-build-arg=--progress=plain \
             --docker-build-arg=--load \
-            "${{ matrix.distro }}"
+            "${MATRIX_DISTRO}"
           rm -rf /tmp/.buildx-cache
           mv /tmp/.buildx-cache-new /tmp/.buildx-cache
+        env:
+          MATRIX_DISTRO: ${{ matrix.distro }}
 
       - name: Artifact name
         id: artifact-name
@@ -217,7 +219,7 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          gh release upload "${{ github.ref_name }}" \
+          gh release upload "${GITHUB_REF_NAME}" \
             Sdist/* \
             Wheel*/* \
             debs.tar.xz \
diff --git a/.github/workflows/twisted_trunk.yml b/.github/workflows/twisted_trunk.yml
index 991d3d3aeb..63d06a98ac 100644
--- a/.github/workflows/twisted_trunk.yml
+++ b/.github/workflows/twisted_trunk.yml
@@ -63,8 +63,10 @@ jobs:
           poetry-version: "2.4.1"
       - run: |
           poetry remove twisted
-          poetry add --extras tls git+https://github.com/twisted/twisted.git#${{ inputs.twisted_ref || 'trunk' }}
+          poetry add --extras tls "git+https://github.com/twisted/twisted.git#${TWISTED_REF}"
           poetry install --no-interaction --extras "all test"
+        env:
+          TWISTED_REF: ${{ inputs.twisted_ref || 'trunk' }}
       - name: Remove unhelpful options from mypy config
         run: sed -e '/warn_unused_ignores = True/d' -e '/warn_redundant_casts = True/d' -i mypy.ini
       - run: poetry run mypy