fix: Prevent script injection in GitHub Actions workflows

[fix-it-felix-sentry]

Summary

This PR fixes a high-severity security vulnerability where untrusted input from GitHub context data could be directly interpolated into shell commands, allowing potential code injection attacks.

Changes

updater/action.yml

• Use environment variables for inputs.name, inputs.path, inputs.changelog-entry, inputs.pr-strategy, and inputs.post-update-script in validation steps
• Changed from direct interpolation ${{ inputs.* }} to using env: with quoted environment variable references "$env:VAR_NAME"

sentry-cli/integration-test/action.yml

• Use environment variables for github.action_path and inputs.path
• Changed from direct interpolation to using env: with quoted environment variable references

Security Impact

The previous implementation was vulnerable to script injection because GitHub context data (like inputs.* and github.*) can contain arbitrary user input. By directly interpolating these values into shell commands, an attacker could potentially:

• Execute arbitrary code in the GitHub Actions runner
• Steal secrets and repository code
• Compromise the build pipeline

The fix uses intermediate environment variables which prevents the injection by treating the input as data rather than executable code.

References

• Parent ticket: https://linear.app/getsentry/issue/VULN-1100
• Child ticket: https://linear.app/getsentry/issue/DI-1657
• GitHub Actions Security Hardening Guide
• GitHub Security Lab: Untrusted Input
• Semgrep Rule

Testing

The existing test suite should validate that the functionality remains intact. The validation logic is unchanged, only the method of passing the values to the shell has been made secure.

[linear]

VULN-1100 Command Injection vulnerabilities in getsentry/github-workflows in 4 locations

DI-1657 Command Injection vulnerabilities in getsentry/github-workflows in 4 locations

[github-actions]

	Fails
🚫	Please consider adding a changelog entry for the next release.

	Warnings
⚠️	Could not load custom Dangerfile: .github/test-dangerfile-curl.js Error: ENOENT: no such file or directory, lstat '/github/workspace/.github/test-dangerfile-curl.js'

Instructions and example for changelog

Please add an entry to CHANGELOG.md to the "Unreleased" section. Make sure the entry includes this PR's number.

Example:

## Unreleased

### Fixes

- Prevent script injection in GitHub Actions workflows ([#150](https://github.com/getsentry/github-workflows/pull/150))

If none of the above apply, you can opt out of this check by adding #skip-changelog to the PR description or adding a skip-changelog label.

Generated by 🚫 dangerJS against ed9d09f

[sentry]

Bug: Using double-quoted environment variables in PowerShell allows for subexpression evaluation and command injection before the validation logic is executed.
_{Severity: CRITICAL}

Suggested Fix

Replace double quotes with single quotes when referencing environment variables in PowerShell validation checks. For example, change "$env:DEPENDENCY_NAME" to '$env:DEPENDENCY_NAME'. This ensures PowerShell treats the variable's content as a literal string, preventing subexpression evaluation and command injection.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: updater/action.yml#L80-L81

Potential issue: The use of double-quoted environment variables in PowerShell, such as
`"$env:DEPENDENCY_NAME"`, allows for subexpression evaluation. If an input contains a
payload like `test$(Write-Host 'injected')`, the malicious command within `$()` is
executed before the regex validation runs. This happens because PowerShell expands the
variable and evaluates any subexpressions within it before passing the result to the
`-notmatch` operator. This vulnerability is present in the input validation steps and
subsequent script invocations, undermining the intended security fix.

_{Did we get this right? 👍 / 👎 to inform future reviews.}