Skip to content

ci: Harden release workflow handling#12715

Merged
anthonyshew merged 1 commit intomainfrom
shew/more-gha-hardening
May 4, 2026
Merged

ci: Harden release workflow handling#12715
anthonyshew merged 1 commit intomainfrom
shew/more-gha-hardening

Conversation

@anthonyshew
Copy link
Copy Markdown
Contributor

@anthonyshew anthonyshew commented May 4, 2026

  • Remove shell-injection patterns from Rust change detection by routing GitHub contexts through environment variables and quoting shell inputs.
  • Reduce release workflow data exposure by avoiding token-bearing Vercel CLI output in logs.
  • Harden docs alias failure notifications against over-privileged tokens and JSON injection from branch-controlled version.txt.
  • Add a local safety boundary before recursively cleaning turbo-releaser package output directories.

@anthonyshew anthonyshew requested a review from a team as a code owner May 4, 2026 18:17
@anthonyshew anthonyshew requested review from tknickman and removed request for a team May 4, 2026 18:17
@vercel
Copy link
Copy Markdown
Contributor

vercel Bot commented May 4, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
examples-basic-web Ready Ready Preview, Comment, Open in v0 May 4, 2026 6:18pm
examples-designsystem-docs Ready Ready Preview, Comment, Open in v0 May 4, 2026 6:18pm
examples-gatsby-web Ready Ready Preview, Comment, Open in v0 May 4, 2026 6:18pm
examples-kitchensink-blog Ready Ready Preview, Comment, Open in v0 May 4, 2026 6:18pm
examples-nonmonorepo Ready Ready Preview, Comment, Open in v0 May 4, 2026 6:18pm
examples-svelte-web Ready Ready Preview, Comment, Open in v0 May 4, 2026 6:18pm
examples-tailwind-web Ready Ready Preview, Comment, Open in v0 May 4, 2026 6:18pm
examples-vite-web Ready Ready Preview, Comment, Open in v0 May 4, 2026 6:18pm
turbo-site Ready Ready Preview, Comment, Open in v0 May 4, 2026 6:18pm

@anthonyshew anthonyshew enabled auto-merge (squash) May 4, 2026 18:32
@anthonyshew anthonyshew merged commit f89f3bd into main May 4, 2026
78 of 80 checks passed
@anthonyshew anthonyshew deleted the shew/more-gha-hardening branch May 4, 2026 18:42
anthonyshew pushed a commit that referenced this pull request May 4, 2026
## Release v2.9.9-canary.4

> [!CAUTION]
> Versioned docs aliasing FAILED. [View
logs](https://github.com/vercel/turborepo/actions/runs/25336754245)

### Changes

- release(turborepo): 2.9.9-canary.3 (#12712) (`6f35176`)
- fix: Harden docs security endpoints (#12713) (`56eefcc`)
- ci: Harden internal GitHub Actions (#12714) (`cbe31ef`)
- ci: Harden release workflow handling (#12715) (`f89f3bd`)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
anthonyshew added a commit that referenced this pull request May 4, 2026
## Release v2.9.9

> [!CAUTION]
> Versioned docs aliasing FAILED. [View
logs](https://github.com/vercel/turborepo/actions/runs/25342206497)

### Changes

- release(turborepo): 2.9.8 (#12700) (`09900b9`)
- fix: Remove Unix parent death watchdogs (#12699) (`22526bb`)
- release(turborepo): 2.9.9-canary.1 (#12705) (`72cc81c`)
- fix: Scope repo index prefixes to Git root (#12706) (`82dee40`)
- release(turborepo): 2.9.9-canary.2 (#12708) (`7dacd56`)
- ci: Harden non-release GitHub Actions (#12707) (`4af1ef1`)
- docs: Add pnpm workspace flag (-w) to Oxc setup docs (#12655)
(`4e8a20f`)
- fix: Harden OG image signatures (#12709) (`76d26f8`)
- fix: Scope release npm publishing credentials (#12710) (`382f305`)
- ci: Harden release workflows (#12711) (`709c9d4`)
- release(turborepo): 2.9.9-canary.3 (#12712) (`6f35176`)
- fix: Harden docs security endpoints (#12713) (`56eefcc`)
- ci: Harden internal GitHub Actions (#12714) (`cbe31ef`)
- ci: Harden release workflow handling (#12715) (`f89f3bd`)
- fix: Preserve lockfiles during dry-run conversion (#12717) (`3192551`)
- ci: Fix LSP workflow container matrix (#12718) (`ac55ec9`)

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Anthony Shew <anthonyshew@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant