fix(release ci): fix paths for downloaded artifacts - #609

.github/workflows/ci.yml (1)

273-278: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Static analysis flags potential template injection via unquoted ${{ }} expansion in run:.

zizmor flags this block for expanding ${{ steps.release_info.outputs.tag }} / ${{ steps.release_info.outputs.name }} directly into the shell script rather than via an env: var. These values are derived from git rev-parse --short=8 HEAD, so practical exploitability is low here, but the general pattern is unsafe if the source of these outputs ever changes to include less-trusted input.

🛡️ Suggested hardening: pass values via env instead of inline expansion

             - name: Create Release
               env:
                   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+                  RELEASE_TAG: ${{ steps.release_info.outputs.tag }}
+                  RELEASE_NAME: ${{ steps.release_info.outputs.name }}
               run: |
                   tar -C artifacts/completions -czf artifacts/completions.tar.gz .
                   cd artifacts/
-                  gh release create "${{ steps.release_info.outputs.tag }}" \
+                  gh release create "$RELEASE_TAG" \
                     $(find . -maxdepth 1 -type f) \
                     --repo="${GITHUB_REPOSITORY}" \
-                    --title="${{ steps.release_info.outputs.name }}"
+                    --title="$RELEASE_NAME"

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml around lines 273 - 278, The release creation step
in the CI workflow is expanding `${{ steps.release_info.outputs.tag }}` and `${{
steps.release_info.outputs.name }}` directly inside the `run:` shell script,
which triggers template-injection hardening warnings. Update the release job to
pass these values through `env:` in the same workflow step, then reference the
environment variables in the `gh release create` command instead of inline `${{
}}` expansion; use the release-info step outputs as the source and keep the
existing `gh release create` block intact.

Source: Linters/SAST tools

.github/workflows/ci.yml (1)

300-309: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Pass release tag/name via env instead of inline ${{ }} in the run script.

The asset enumeration logic is correct. Separately, ${{ steps.release_info.outputs.tag }} / .name are interpolated directly into the shell script (flagged by zizmor at Lines 306, 309). The values are SHA-derived so real risk is low here, but binding them to env and referencing shell variables avoids the template-injection class entirely and clears the SAST finding.

🔒 Proposed hardening

             - name: Create Release
               env:
                   GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+                  RELEASE_TAG: ${{ steps.release_info.outputs.tag }}
+                  RELEASE_NAME: ${{ steps.release_info.outputs.name }}
               run: |
                   tar -C artifacts/completions -czf artifacts/completions.tar.gz .
                   cd artifacts/
-                  gh release create "${{ steps.release_info.outputs.tag }}" \
+                  gh release create "$RELEASE_TAG" \
                     $(find . -maxdepth 1 -type f) \
                     --repo="${GITHUB_REPOSITORY}" \
-                    --title="${{ steps.release_info.outputs.name }}"
+                    --title="$RELEASE_NAME"

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci.yml around lines 300 - 309, The Create Release workflow
step is interpolating the release tag and title directly inside the shell
script, so move the release tag/name from steps.release_info.outputs.tag and
steps.release_info.outputs.name into env values on the Create Release step and
reference those shell variables in the gh release create command instead. Keep
the existing tar/find asset logic unchanged, and use the Create Release step
plus gh release create invocation as the place to apply the env-based
substitution.

Source: Linters/SAST tools