ci: harden workflows against script injection (#222)

Pass inputs.bump, the App slug and the PR number to run steps through
env instead of interpolating ${{ }} into the shell script, which
Aikido flags as template injection (critical, cut-release.yml).

Also set persist-credentials explicitly on every checkout: false where
the job never pushes, true in cut-release where release.sh pushes the
release branch and tag.

Author: zfarrell

.github/workflows/check-release.yml

@@ -16,6 +16,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
         with:
+          persist-credentials: false
           fetch-depth: 0
 
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6

.github/workflows/cut-release.yml

@@ -52,6 +52,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
         with:
           token: ${{ steps.app-token.outputs.token }}
+          persist-credentials: true  # release.sh pushes the branch / tag
           fetch-depth: 0
           fetch-tags: true
 
@@ -66,8 +67,9 @@ jobs:
       - name: Configure git identity
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          APP_SLUG: ${{ steps.app-token.outputs.app-slug }}
         run: |
-          slug="${{ steps.app-token.outputs.app-slug }}[bot]"
+          slug="${APP_SLUG}[bot]"
           id="$(gh api "/users/${slug}" --jq .id)"
           git config user.name "$slug"
           git config user.email "${id}+${slug}@users.noreply.github.com"
@@ -81,7 +83,10 @@ jobs:
       - name: Prepare release
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
-        run: ./scripts/release.sh prepare "${{ inputs.bump }}"
+          # Via env, not ${{ }} in the script: the input is free text and
+          # interpolating it into `run` would execute anything shell-shaped.
+          BUMP: ${{ inputs.bump }}
+        run: ./scripts/release.sh prepare "$BUMP"
 
       # Branch protection on main gates the merge on the checks and the
       # approving review, so this only merges once everything is green.
@@ -115,6 +120,7 @@ jobs:
         with:
           ref: main
           token: ${{ steps.app-token.outputs.token }}
+          persist-credentials: true  # release.sh pushes the branch / tag
           fetch-depth: 0
           fetch-tags: true
 
@@ -125,8 +131,9 @@ jobs:
       - name: Configure git identity
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          APP_SLUG: ${{ steps.app-token.outputs.app-slug }}
         run: |
-          slug="${{ steps.app-token.outputs.app-slug }}[bot]"
+          slug="${APP_SLUG}[bot]"
           id="$(gh api "/users/${slug}" --jq .id)"
           git config user.name "$slug"
           git config user.email "${id}+${slug}@users.noreply.github.com"

.github/workflows/integration-tests.yml

@@ -27,6 +27,8 @@ jobs:
           private-key: ${{ secrets.HOTDATA_AUTOMATION_PRIVATE_KEY }}
           owner: hotdata-dev
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: '3.12'
@@ -70,6 +72,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: '3.12'
@@ -87,6 +91,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: '3.12'

.github/workflows/publish.yml

@@ -51,6 +51,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
         with:
           ref: ${{ env.RELEASE_TAG }}
+          persist-credentials: false
 
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:

.github/workflows/regenerate.yml

@@ -27,6 +27,8 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
         with:
           token: ${{ steps.app-token.outputs.token }}
+          # create-pull-request authenticates its own push from `token`.
+          persist-credentials: false
           fetch-depth: 0
           fetch-tags: true
 
@@ -337,7 +339,8 @@ jobs:
         if: steps.cpr.outputs.pull-request-number
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          PR_NUMBER: ${{ steps.cpr.outputs.pull-request-number }}
         run: |
-          gh pr merge "${{ steps.cpr.outputs.pull-request-number }}" \
-            --repo "${{ github.repository }}" \
+          gh pr merge "$PR_NUMBER" \
+            --repo "$GITHUB_REPOSITORY" \
             --squash --auto

.github/workflows/release.yml

@@ -37,6 +37,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6
         with:
           ref: ${{ env.RELEASE_TAG }}
+          persist-credentials: false
           fetch-depth: 0
 
       - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6