How much should I care about github.ref_name?

[funnelfiasco]

I'm running zizmor against guac-visualizer's release workflow and one of the issues it reports is a template injection because we use github.ref_name in a couple of places. I agree that in the abstract, that's a vector for injecting bad things into the workflow. However, in our specific case, the workflow only runs on v* tags, which essentially means anyone who could take advantage of this can already do plenty of damage.

It seems reasonable to me that we can simply ignore it. It might possibly be nice to be able to flag to zizmor somehow ("somehow" is doing a lot of work here) that it should always ignore a particular issue on a particular line because it's not a problem in reality (VEX statements, but for zizmor!). Alternatively, I think I could trick zizmor into not seeing it by shoving the output of git describe --tags --abbrev=0 into an environment variable.

I'm curious what others would do here.

[miketheman]

re: ignore, see #12 for that

[woodruffw]

Yep, agreed that this is the general solution! I'll also leave an adjacent comment about github.ref_name in particular, since it's one of the contexts that GitHub provides an equivalent envvar for already 🙂

[woodruffw]

I'm running zizmor against guac-visualizer's release workflow and one of the issues it reports is a template injection because we use github.ref_name in a couple of places. I agree that in the abstract, that's a vector for injecting bad things into the workflow. However, in our specific case, the workflow only runs on v* tags, which essentially means anyone who could take advantage of this can already do plenty of damage.

FWIW, for github.ref_name in particular, should be able to use the GITHUB_REF_NAME environment variable as a direct replacement for it.

In your particular case, I think that would be:

          pack build --env NODE_ENV=production ${IMAGE_URI}:${GITHUB_REF_NAME} --builder ${BUILDER} --buildpack ${BUILDPACK} --publish --sbom-output-dir ${BUILDPACK_SBOM_OUTPUT_DIR}
          echo "IMAGE_DIGEST=$(crane digest ${IMAGE_URI}:${GITHUB_REF_NAME})" >> $GITHUB_OUTPUT

(I recognize that this isn't a super satisfying general answer, but I figured I'd mention it just in case you weren't aware!)