Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
39 changes: 39 additions & 0 deletions .github/workflows/release.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,39 @@
name: Archive Dependencies for Release

on:
release:
types: [created]

permissions:
contents: write

jobs:
archive-deps:
runs-on: ubuntu-latest

steps:
- uses: actions/checkout@v4

- name: Read .nvmrc
id: node_version
run: echo "NODE_VERSION=$(cat .nvmrc)" >> "$GITHUB_OUTPUT"

- name: Set Up node
uses: actions/setup-node@v4
with:
node-version: ${{ steps.node_version.outputs.NODE_VERSION }}
cache: 'yarn'

- name: Install dependencies
run: yarn --immutable

- name: Build
run: yarn build

- name: Archive dependency cache
run: tar -czf deps-${{ github.event.release.tag_name }}.tar.gz .yarn/cache

- name: Attach archive to release
env:
GH_TOKEN: ${{ github.token }}
run: gh release upload "${{ github.event.release.tag_name }}" deps-${{ github.event.release.tag_name }}.tar.gz --clobber
Comment on lines +34 to +39
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

cat -n .github/workflows/release.yml

Repository: ardriveapp/ardrive-cli

Length of output: 1290


🌐 Web query:

GitHub release tag naming rules allowed characters valid format

💡 Result:

What characters/formats are valid for GitHub release tags?

GitHub release tags are Git tag refs, so the tag name must be a valid Git ref name (per git check-ref-format) and also meet a couple of GitHub-specific restrictions.

Git (ref) rules (what Git itself allows/forbids)

A tag name must not:

  • contain .. anywhere
  • contain ASCII control chars, space, ~, ^, :, ?, *, [, or \
  • contain the sequence @{, or be exactly @
  • start or end with /, or contain //
  • end with .
  • have any path component (between slashes) that starts with . or ends with .lock
    (These are the core git-check-ref-format rules.) [1]

Note: Git allows many other characters (including many punctuation characters), as long as you don’t violate the rules above. [1]

GitHub-specific restrictions (beyond Git)

GitHub additionally blocks pushing tag/branch names that:

  • look like a Git object ID (40 hex chars, 0-9 and A-F)
  • begin with refs/ [2]

“Safe” recommended character set (practical best practice)

GitHub recommends a conservative set that avoids escaping/URL/shell issues:
A–Z a–z 0–9 . - _ / [2]

Common valid formats (examples)

  • v1.2.3
  • 1.2.3
  • release/2026-02-26
  • v2.0.0-rc.1

Sources: Git ref naming rules (git-check-ref-format). [1] GitHub docs on tag/branch naming and GitHub restrictions. [2]


Sanitize and quote the release tag before using it in shell filenames.

GitHub release tags are Git refs and can contain / as a valid character (e.g., release/1.0.0). At Line 34, the tag is interpolated directly into the filename without quoting. If a tag contains /, the tar command would attempt to write to a non-existent subdirectory and fail. Line 39 has the same issue with the unquoted filename. While not exploitable in a dangerous way, this prevents releases with tags containing / from completing successfully.

Proposed hardening
       - name: Archive dependency cache
-        run: tar -czf deps-${{ github.event.release.tag_name }}.tar.gz .yarn/cache
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          SAFE_TAG="${RELEASE_TAG//\//-}"
+          tar -czf "deps-${SAFE_TAG}.tar.gz" .yarn/cache

       - name: Attach archive to release
         env:
           GH_TOKEN: ${{ github.token }}
-        run: gh release upload "${{ github.event.release.tag_name }}" deps-${{ github.event.release.tag_name }}.tar.gz --clobber
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+        run: |
+          SAFE_TAG="${RELEASE_TAG//\//-}"
+          gh release upload "$RELEASE_TAG" "deps-${SAFE_TAG}.tar.gz" --clobber
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
run: tar -czf deps-${{ github.event.release.tag_name }}.tar.gz .yarn/cache
- name: Attach archive to release
env:
GH_TOKEN: ${{ github.token }}
run: gh release upload "${{ github.event.release.tag_name }}" deps-${{ github.event.release.tag_name }}.tar.gz --clobber
env:
RELEASE_TAG: ${{ github.event.release.tag_name }}
run: |
SAFE_TAG="${RELEASE_TAG//\//-}"
tar -czf "deps-${SAFE_TAG}.tar.gz" .yarn/cache
- name: Attach archive to release
env:
GH_TOKEN: ${{ github.token }}
RELEASE_TAG: ${{ github.event.release.tag_name }}
run: |
SAFE_TAG="${RELEASE_TAG//\//-}"
gh release upload "$RELEASE_TAG" "deps-${SAFE_TAG}.tar.gz" --clobber
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/release.yml around lines 34 - 39, The release tag is
interpolated directly into shell filenames in the tar and gh upload steps (tar
-czf deps-${{ github.event.release.tag_name }}.tar.gz and gh release upload ...
deps-${{ github.event.release.tag_name }}.tar.gz), which breaks when tags
contain “/”; fix by computing a sanitized, quoted tag (e.g., replace slashes
with hyphens or otherwise escape unsafe chars into a new variable like safe_tag)
in the run step or env, then use the quoted "$safe_tag" when building the tar
filename and when calling gh release upload so filenames are safe and atomic.

4 changes: 2 additions & 2 deletions .github/workflows/test_and_build.yml
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ jobs:

- name: Read .nvmrc
id: node_version
run: echo ::set-output name=NODE_VERSION::$(cat .nvmrc)
run: echo "NODE_VERSION=$(cat .nvmrc)" >> "$GITHUB_OUTPUT"

- name: Set Up node
uses: actions/setup-node@v4
Expand All @@ -20,7 +20,7 @@ jobs:
cache: 'yarn'

- name: Install dependencies
run: yarn --immutable --immutable-cache
run: yarn --immutable

- name: Test and Build Codebase
run: yarn ci
Expand Down
3 changes: 2 additions & 1 deletion .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,8 @@ Sync
#zero installs
package-lock.json
.yarn/*
!.yarn/cache
# .yarn/cache is no longer committed; deps are archived at release time
# !.yarn/cache
!.yarn/patches
!.yarn/plugins
!.yarn/releases
Expand Down
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file removed .yarn/cache/arg-npm-4.1.3-1748b966a8-544af8dd3f.zip
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file removed .yarn/cache/asn1-npm-0.2.4-219dd49411-aa5d6f77b1.zip
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file removed .yarn/cache/bl-npm-4.1.0-7f94cdcf3f-9e8521fa7e.zip
Binary file not shown.
Binary file removed .yarn/cache/bl-npm-5.0.0-cd18f87fd8-5dbbcf9cbc.zip
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file removed .yarn/cache/bs58-npm-4.0.1-8d2a7822b1-b3c5365bb9.zip
Binary file not shown.
Binary file removed .yarn/cache/bs58-npm-5.0.0-da02537b92-2475cb0684.zip
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
Loading