fix(ci): mitigate code injection in build from repo_organization (#2991)
* fix(ci): mitigate code injection in build from repo_organization https://docs.github.com/en/actions/concepts/security/script-injections * make it global is pretty reusable
This commit is contained in:
parent
b6aa581283
commit
93a0ae253d
1 changed files with 2 additions and 1 deletions
3
.github/workflows/reusable-build.yml
vendored
3
.github/workflows/reusable-build.yml
vendored
|
|
@ -31,6 +31,7 @@ on:
|
|||
|
||||
env:
|
||||
IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}
|
||||
GITHUB_REPOSITORY_OWNER: ${{ github.repository_owner }}
|
||||
|
||||
concurrency:
|
||||
group: ${{ github.workflow }}-${{ github.ref || github.run_id }}-${{ inputs.brand_name}}-${{ inputs.stream_name }}
|
||||
|
|
@ -142,7 +143,7 @@ jobs:
|
|||
MATRIX_IMAGE_FLAVOR: ${{ matrix.image_flavor }}
|
||||
run: |
|
||||
$(command -v just) \
|
||||
repo_organization="${{ github.repository_owner }}" \
|
||||
repo_organization="${GITHUB_REPOSITORY_OWNER}" \
|
||||
build \
|
||||
--image "${MATRIX_BASE_NAME}" \
|
||||
--tag "${MATRIX_STREAM_NAME}" \
|
||||
|
|
|
|||
Loading…
Reference in a new issue