Yaron Kaikov 977bdd6260 .github/workflows/trigger-scylla-ci: fix heredoc injection in trigger-scylla-ci workflow ...

Move all ${{ }} expression interpolations into env: blocks so they are
passed as environment variables instead of being expanded directly into
shell scripts. This prevents an attacker from escaping the heredoc in
the Validate Comment Trigger step and executing arbitrary commands on
the runner.

The Verify Org Membership step is hardened in the same way for
defense-in-depth.

Refs: GHSA-9pmq-v59g-8fxp
Fixes: SCYLLADB-954

Closes scylladb/scylladb#28935

2026-03-08 21:34:51 +02:00

..

instructions

.github: add Copilot instructions for AI-generated code

2025-11-30 13:30:05 +02:00

ISSUE_TEMPLATE

.github: update bug_report.yml

2025-04-10 14:26:00 +03:00

scripts

auto-backport.py: modify instruction for making PR ready for review

2025-12-10 14:53:38 +02:00

workflows

.github/workflows/trigger-scylla-ci: fix heredoc injection in trigger-scylla-ci workflow

2026-03-08 21:34:51 +02:00

clang-include-cleaner.json

.github: change severity to error in clang-include-cleaner

2024-06-07 07:28:52 +08:00

clang-matcher.json

.github: rename clang-tidy-matcher.json to clang-matcher.json

2024-06-07 14:23:06 +08:00

CODEOWNERS

Update CODEOWNERS to remove redundant entries

2025-12-11 16:47:08 +02:00

copilot-instructions.md

.github/copilot-instructions.md: add test philosophy

2026-01-13 10:05:13 +02:00

dependabot.yml

docs: enable tooltips

2024-11-06 14:09:28 +02:00

mergify.yml

mergify: add support for branch-6.2

2024-09-18 08:30:41 +03:00

pull_request_template.md

pull_request_template: clearify the template and remove checkbox verification

2024-05-20 18:24:28 +03:00

seastar-bad-include.json

github: improve seastar bad include check

2025-03-30 11:56:18 +03:00