fix(ci): mitigate code injection in build from repo_organization (#2991)

* fix(ci): mitigate code injection in build from repo_organization

https://docs.github.com/en/actions/concepts/security/script-injections

* make it global

is pretty reusable
This commit is contained in:
renner 2026-10-07 12:06:15 +00:00 committed by GitHub
parent b6aa581283
commit 93a0ae253d
No known key found for this signature in database
GPG key ID: B5690EEEBB952194

View file

@ -31,6 +31,7 @@ on:
env:
IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}
GITHUB_REPOSITORY_OWNER: ${{ github.repository_owner }}
concurrency:
group: ${{ github.workflow }}-${{ github.ref || github.run_id }}-${{ inputs.brand_name}}-${{ inputs.stream_name }}
@ -142,7 +143,7 @@ jobs:
MATRIX_IMAGE_FLAVOR: ${{ matrix.image_flavor }}
run: |
$(command -v just) \
repo_organization="${{ github.repository_owner }}" \
repo_organization="${GITHUB_REPOSITORY_OWNER}" \
build \
--image "${MATRIX_BASE_NAME}" \
--tag "${MATRIX_STREAM_NAME}" \