Skip to content

fix(workflows): Prevent shell injection in fast-revert workflow #4309

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
aldy505 merged 2 commits into from
May 12, 2026
Merged

fix(workflows): Prevent shell injection in fast-revert workflow #4309

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7c6ae0e
fix(workflows): Prevent shell injection in fast-revert workflow
fix-it-felix-sentry[bot] Apr 28, 2026
5abf93c
Merge branch 'master' into fix/di-1872-shell-injection-fast-revert
aldy505 May 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 9 additions & 3 deletions .github/workflows/fast-revert.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,11 +30,17 @@ jobs:
committer_email: bot@sentry.io
token: ${{ secrets.BUMP_SENTRY_TOKEN }}
- name: comment on failure
env:
GITHUB_TOKEN: ${{ secrets.BUMP_SENTRY_TOKEN }}

@sentry sentry Bot May 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: The workflow attempts to overwrite the reserved GITHUB_TOKEN environment variable. This is ignored, and the subsequent API call will use a token with no permissions, causing it to fail.
Severity: MEDIUM

Suggested Fix

Instead of trying to overwrite GITHUB_TOKEN, use a different environment variable name for your PAT, for example, GH_TOKEN. Then, update the curl command to use this new variable: Authorization: Bearer ${{ env.GH_TOKEN }}.

Prompt for AI Agent 
Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.

Location: .github/workflows/fast-revert.yml#L34

Potential issue: The workflow at `.github/workflows/fast-revert.yml` attempts to
overwrite the reserved `GITHUB_TOKEN` environment variable with a secret PAT at line 34.
GitHub Actions silently ignores this assignment. Because the workflow also specifies
`permissions: {}` at line 11, the default `GITHUB_TOKEN` that is ultimately used has no
permissions. As a result, the `curl` command that relies on this token to post a comment
to the pull request will fail with a 403 error, preventing the failure notification from
being sent.

Did we get this right? 👍 / 👎 to inform future reviews.

GITHUB_REPOSITORY: ${{ github.repository }}
GITHUB_RUN_ID: ${{ github.run_id }}

@cursor cursor Bot Apr 28, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reserved env var names override silently ignored

Low Severity

GITHUB_REPOSITORY and GITHUB_RUN_ID are reserved GitHub Actions default environment variables that the documentation states cannot be overwritten. Setting them in the step-level env: block is silently ignored at runtime. This works today only because the default values happen to match what's being assigned, but using reserved names is unnecessary and could break if GitHub starts enforcing this restriction with a hard error. Using non-reserved names (e.g., GH_REPO, RUN_ID) would be more robust.

Fix in Cursor Fix in Web

Reviewed by Cursor Bugbot for commit 7c6ae0e. Configure here.

REPOSITORY_ID: ${{ github.event.repository.id }}
PR_NUMBER: ${{ github.event.number || github.event.inputs.pr }}
run: |
curl \
--silent \
-X POST \
-H 'Authorization: token ${{ secrets.BUMP_SENTRY_TOKEN }}' \
-d'{"body": "revert failed (conflict? already reverted?) -- [check the logs](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }})"}' \
https://api.github.com/repositories/${{ github.event.repository.id }}/issues/${{ github.event.number || github.event.inputs.pr }}/comments
-H "Authorization: token $GITHUB_TOKEN" \
-d"{\"body\": \"revert failed (conflict? already reverted?) -- [check the logs](https://github.com/$GITHUB_REPOSITORY/actions/runs/$GITHUB_RUN_ID)\"}" \
"https://api.github.com/repositories/$REPOSITORY_ID/issues/$PR_NUMBER/comments"
if: failure()
Loading