[Copilot]

Run source-code linter was failing on CKV_GHA_7 across admin workflows using workflow_dispatch.inputs. This PR keeps required manual controls but makes the rule handling explicit and tightens input handling in shell-executed paths.

• Checkov suppression alignment (CKV_GHA_7)

  • Normalized explicit CKV_GHA_7 skip directives on manual-dispatch workflows flagged in CI.
  • Added/updated scoped skip placement for:
    • build_and_sign_release_apk.yml
    • rename_directory.yml
    • delete_committed_file.yml
    • import_file_from_chromium.yml
    • download_icon_from_fontawesome.yml
    • update_chromium_files.yml (also flagged in the failing run)

• Input-safety hardening for shell execution

  • Replaced inline ${{ github.event.inputs.* }} in run: commands with env-mapped variables.
  • Added validation guards for user-controlled values (path traversal checks, newline rejection, format checks).
  • Applied safe argument passing (-- and quoted expansions) where paths feed git/shell operations.

• Workflow-specific tightening

  • rename_directory.yml: validates source/destination paths before git mv.
  • delete_committed_file.yml: validates filename and safely injects target into history-rewrite command.
  • import_file_from_chromium.yml: validates import path before download/decode/add flow.
  • download_icon_from_fontawesome.yml: whitelists icon type, validates icon name and output filename, validates optional hex fill color.
  • build_and_sign_release_apk.yml: constrains manual toggles to explicit choice values and replaces contains() checks with strict equality.

- name: Rename directory
  env:
    SOURCE_DIRECTORY: ${{ github.event.inputs.source_directory }}
    DESTINATION_DIRECTORY: ${{ github.event.inputs.destination_directory }}
  run: git mv -- "$SOURCE_DIRECTORY" "$DESTINATION_DIRECTORY"

[Copilot]

🟡 Changes recommended

A few newly added input-validation checks still allow unsafe/pathspec patterns (and one hex-color regex is overly permissive), leaving avoidable gaps in the stated hardening.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR addresses Checkov CKV_GHA_7 findings in admin/maintenance workflow_dispatch workflows while hardening several user-controlled inputs that flow into shell/git operations.

Changes:

• Normalizes CKV_GHA_7 skip directives on affected manual-dispatch workflows.
• Adds/expands validation and safer argument passing for workflow inputs used in shell commands.
• Tightens release workflow toggles by converting booleans to explicit choice inputs and using strict equality in if: conditions.

File summaries

File	Description
.github/workflows/update_chromium_files.yml	Adds CKV_GHA_7 suppression alignment and validates Chromium version components as numeric.
.github/workflows/rename_directory.yml	Adds path validation and uses env-mapped, quoted args with git mv --.
.github/workflows/import_file_from_chromium.yml	Adds import-path validation and switches URL construction to env-mapped variables.
.github/workflows/download_icon_from_fontawesome.yml	Adds input validation and switches script invocation to env-mapped variables with safe quoting.
.github/workflows/delete_committed_file.yml	Adds filename validation and safer injection of the target into the history-rewrite command.
.github/workflows/build_and_sign_release_apk.yml	Converts manual toggles to choice inputs and replaces contains() checks with strict equality.

Review details

• Files reviewed: 6/6 changed files
• Comments generated: 4
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.