Develop

[loganathan-sekaran]

No description provided.

Use GitHub’s recommended safe pattern: assign untrusted context values to environment variables in the step, then reference them via shell variables (e.g., "$PR_HEAD_REF"), not ${{ ... }} inside the script body.
For this workflow, the best minimal fix is in .github/workflows/xlsx-to-csv.yml, step “Commit and push changes” (lines 73–80):

1. Add env: entries for:
   • PR_HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
   • PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}
   • ACTION_PAT: ${{ secrets.ACTION_PAT }}
2. Update line 80 to use shell vars:
   • git push "https://x-access-token:${ACTION_PAT}@github.com/${PR_HEAD_REPO}.git" "HEAD:${PR_HEAD_REF}"

This keeps functionality unchanged while removing direct expression interpolation from the shell command and properly quoting the refspec argument.

Add an explicit permissions block in .github/workflows/push-trigger.yml at the workflow root (top-level), so it applies to all jobs unless overridden.
The least-privilege fix for this workflow is:

• permissions:
  • contents: read

This preserves existing behavior (checkout still works) while ensuring the token is not implicitly overprivileged.

Use GitHub Actions’ safe pattern for untrusted input in run steps:

• Put ${{ github.* }} values that may be attacker-controlled into env: entries.
• In the shell script, use "$VAR" (native shell variable expansion), not ${{ env.VAR }} inside run.
• Quote all variable usages in commands.

Best minimal fix in .github/workflows/xlsx-to-csv.yml:

• In the Clone the repository step, add env variables for:
  • PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}
  • PR_HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
• Replace line 36 command to use these env vars:
  • git clone -b "$PR_HEAD_REF" "https://github.com/$PR_HEAD_REPO.git"

This preserves behavior while preventing expression-time injection in shell script text.

Add an explicit permissions block in .github/workflows/xlsx-to-csv.yml at the workflow root (best here since there is one job), setting only the minimum needed for this workflow’s GITHUB_TOKEN usage.

Best minimal, non-functional-change fix:

• Add:
  • contents: read (for repository metadata access)
  • pull-requests: read (for PR files/commits API reads)

This preserves existing behavior because writes are done through ACTION_PAT, not GITHUB_TOKEN.