From 8ba03a605138c677b7efe6060a81f02470ba694e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C5=81ukasz=20Pi=C4=85tkowski?= <piontec@gmail.com>
Date: Wed, 24 Jun 2026 10:09:19 +0200
Subject: [PATCH] fix: remove GitHub Actions script injection in debug_info
 step (CWE-94)

The `debug_info` "Print github context JSON" step interpolated
`${{ toJson(github) }}` directly into a `run:` shell heredoc in four
reusable workflows. GitHub Actions substitutes `${{ }}` into the script
before the shell runs, so attacker-controllable event fields (e.g. a
commit message containing an `EOF` line plus shell commands) could break
out of the heredoc and execute arbitrary commands on the runner.

Pass the context through an `env:` variable and print it with
`echo "$GITHUB_CONTEXT"` so it is treated as data, mirroring the existing
safe `COMMIT_MESSAGE` pattern in create-release.yaml.

Also add a report-only zizmor self-scan to validate-workflows.yaml so this
class of issue is surfaced in the Security tab going forward (CodeQL did
not catch it). It is non-blocking (continue-on-error) and does not gate on
the repo's pre-existing findings.

Reported via giantswarm/giantswarm#36940.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/workflows/create-release-pr.yaml      |  7 +++---
 .github/workflows/create-release.yaml         |  7 +++---
 .../workflows/ensure-major-version-tags.yaml  |  7 +++---
 .github/workflows/update-chart.yaml           |  7 +++---
 .github/workflows/validate-workflows.yaml     | 23 +++++++++++++++++++
 CHANGELOG.md                                  | 10 ++++++++
 6 files changed, 45 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/create-release-pr.yaml b/.github/workflows/create-release-pr.yaml
index 194f29f..fe12f2d 100644
--- a/.github/workflows/create-release-pr.yaml
+++ b/.github/workflows/create-release-pr.yaml
@@ -20,10 +20,9 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Print github context JSON
-        run: |
-          cat <<EOF
-          ${{ toJson(github) }}
-          EOF
+        env:
+          GITHUB_CONTEXT: ${{ toJson(github) }}
+        run: echo "$GITHUB_CONTEXT"
   gather_facts:
     name: Gather facts
     runs-on: ubuntu-24.04
diff --git a/.github/workflows/create-release.yaml b/.github/workflows/create-release.yaml
index 5459c3d..b5a1ee1 100644
--- a/.github/workflows/create-release.yaml
+++ b/.github/workflows/create-release.yaml
@@ -23,10 +23,9 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Print github context JSON
-        run: |
-          cat <<EOF
-          ${{ toJson(github) }}
-          EOF
+        env:
+          GITHUB_CONTEXT: ${{ toJson(github) }}
+        run: echo "$GITHUB_CONTEXT"
   gather_facts:
     name: Gather facts
     runs-on: ubuntu-24.04
diff --git a/.github/workflows/ensure-major-version-tags.yaml b/.github/workflows/ensure-major-version-tags.yaml
index 19cf193..5e59cd6 100644
--- a/.github/workflows/ensure-major-version-tags.yaml
+++ b/.github/workflows/ensure-major-version-tags.yaml
@@ -11,10 +11,9 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Print github context JSON
-        run: |
-          cat <<EOF
-          ${{ toJson(github) }}
-          EOF
+        env:
+          GITHUB_CONTEXT: ${{ toJson(github) }}
+        run: echo "$GITHUB_CONTEXT"
   ensure_major_version_tags:
     name: Ensure major version tags
     runs-on: ubuntu-24.04
diff --git a/.github/workflows/update-chart.yaml b/.github/workflows/update-chart.yaml
index 30a5e2e..177ba62 100644
--- a/.github/workflows/update-chart.yaml
+++ b/.github/workflows/update-chart.yaml
@@ -22,10 +22,9 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Print github context JSON
-        run: |
-          cat <<EOF
-          ${{ toJson(github) }}
-          EOF
+        env:
+          GITHUB_CONTEXT: ${{ toJson(github) }}
+        run: echo "$GITHUB_CONTEXT"
   gather_facts:
     name: Gather facts
     runs-on: ubuntu-24.04
diff --git a/.github/workflows/validate-workflows.yaml b/.github/workflows/validate-workflows.yaml
index 4ba9814..012f83a 100644
--- a/.github/workflows/validate-workflows.yaml
+++ b/.github/workflows/validate-workflows.yaml
@@ -54,3 +54,26 @@ jobs:
         with:
           show-ascii-art: false
           path-to-workflows: '.github/workflows/*.yaml'
+
+  analyze-actions:
+    name: Analyze workflows with zizmor (report-only)
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      security-events: write # upload SARIF to the Security tab (code scanning is enabled)
+      actions: read
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      # Report-only: zizmor uploads findings to the Security tab for visibility but never
+      # blocks PRs. The repo carries pre-existing findings that are tracked separately; this
+      # scan is here to surface regressions (e.g. re-introducing `${{ toJson(github) }}` in a
+      # `run:` block) that CodeQL did not catch. See giantswarm/giantswarm#36940.
+      - name: Run zizmor (non-blocking)
+        continue-on-error: true
+        uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7
+        with:
+          persona: regular
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 38105d0..249ad35 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,16 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 however this project does not use Semantic Versioning and there are no releases.
 Instead this file uses a date-based structure.
 
+## 2026-06-24
+
+### Security
+
+- Fixed a GitHub Actions script injection (CWE-94) in the `debug_info` "Print github context JSON" step of `create-release.yaml`, `create-release-pr.yaml`, `update-chart.yaml` and `ensure-major-version-tags.yaml`. The step interpolated `${{ toJson(github) }}` directly into a `run:` shell heredoc, so attacker-controllable event fields (e.g. a commit message containing an `EOF` line plus shell commands) could break out of the heredoc and execute arbitrary commands on the runner. The context is now passed through an `env:` variable (`GITHUB_CONTEXT`) and printed with `echo "$GITHUB_CONTEXT"`, treating it as data rather than script text — the same safe pattern already used for `COMMIT_MESSAGE` in `create-release.yaml`. Reported via giantswarm/giantswarm#36940.
+
+### Added
+
+- `validate-workflows.yaml` now runs a report-only [`zizmor`](https://github.com/zizmorcore/zizmor-action) security scan on this repository's own workflows. It uploads findings to the GitHub Security tab (code scanning) for visibility but does not block PRs (`continue-on-error: true`), so regressions of the script-injection class above are surfaced even though CodeQL did not catch them.
+
 ## 2026-06-03
 
 ### Fixed