Fix shell injection vulnerability in GitHub Action workflow

[fix-it-felix-sentry]

Summary

This PR fixes a high-severity security finding where direct interpolation of GitHub context data in run: steps could allow code injection attacks.

Changes

Replaced direct variable interpolation with environment variables for:

• Line 41: inputs.venv-dir in python -m venv command
• Lines 46-48: runner.os and inputs.venv-dir in venv activation script
• Line 54: inputs.install-cmd in install command

All vulnerable variables are now passed through env: blocks and properly quoted in the run scripts to prevent shell injection.

Security Impact

Previously, attackers could potentially inject malicious code through user-controlled inputs. This fix ensures that:

• All user inputs are treated as literal values
• Environment variables are properly quoted to prevent command injection
• Shell expansion cannot introduce new shell constructs

Testing

The existing self-tests in .github/workflows/self-test.yml will verify that the action continues to work correctly across all platforms (Ubuntu, macOS, Windows).

References

• Parent ticket: https://linear.app/getsentry/issue/VULN-1617
• Child ticket: https://linear.app/getsentry/issue/DI-1911
• GitHub Actions Security Hardening
• Semgrep Rule

[linear-code]

DI-1911 New Semgrep Finding for getsentry/action-setup-venv

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 965c885. Configure here.}

[cursor]

Quoted command variable prevents shell word splitting

High Severity

Wrapping $INSTALL_CMD in double quotes ("$INSTALL_CMD") causes bash to treat the entire expanded value as a single token (the command name), suppressing word splitting. For typical values like pip install -r requirements.txt, bash will look for a binary literally named pip install -r requirements.txt instead of running pip with arguments install, -r, requirements.txt. This breaks the action for essentially all users who supply an install-cmd.

 

^{Reviewed by Cursor Bugbot for commit 965c885. Configure here.}

[sentry]

Bug: Quoting $INSTALL_CMD in the run step prevents word splitting, causing multi-word install commands to fail with a "No such file or directory" error.
_{Severity: CRITICAL}

Suggested Fix

Remove the double quotes around $INSTALL_CMD in the run step. Change run: "$INSTALL_CMD" to run: $INSTALL_CMD to allow the shell to correctly parse the command and its arguments through word splitting.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.

Location: action.yml#L59

Potential issue: The `install-cmd` input is executed within double quotes as
`"$INSTALL_CMD"`. This prevents the shell from performing word splitting. As a result,
any command with arguments, such as `pip install -r requirements.txt`, will be treated
as a single command name. The shell will attempt to find and execute a file literally
named `pip install -r requirements.txt`, which will fail with a "No such file or
directory" error. This breaks the intended functionality for nearly all common use cases
of the `install-cmd` input.

_{Did we get this right? 👍 / 👎 to inform future reviews.}