ci(main): fix potential script injection (#890)

bfra-me · Jan 23, 2025 · 56333cc · 56333cc
1 parent b1d6d43
commit 56333cc
Showing 1 changed file with 4 additions and 2 deletions.
diff --git a/.github/workflows/main.yaml b/.github/workflows/main.yaml
@@ -40,6 +40,8 @@ jobs:
   release:
     name: Release
     if: github.repository == 'bfra-me/works'
+    env:
+      PUBLISH_REF: ${{ github.head_ref }}
     needs:
       - ci
     permissions:
@@ -64,14 +66,14 @@ jobs:
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0
-          ref: ${{ github.head_ref }}
+          ref: ${{ env.PUBLISH_REF }}
           token: ${{ steps.get-workflow-access-token.outputs.token }}
 
       - name: Prepare job
         uses: ./.github/actions/pnpm-install
 
       - name: Perform a dry run of `pnpm publish`
-        run: pnpm -r publish --dry-run --publish-branch ${{ github.head_ref}}
+        run: pnpm -r publish --dry-run --publish-branch ${{ env.PUBLISH_REF }}
 
       - name: Create Release Pull Request or Publish to npm
         if: github.ref == 'refs/heads/main'