Skip to content

fix: security hardening for .claude/skills/release/skill.sh #108

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
muzahidul-opti merged 2 commits into from
May 4, 2026
Merged

fix: security hardening for .claude/skills/release/skill.sh #108

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
00210cc
Initial plan
Copilot May 4, 2026
0d5afc0
fix: security fixes for .claude/skills/release/skill.sh
Copilot May 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 18 additions & 8 deletions .claude/skills/release/skill.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
#!/bin/bash
set -euo pipefail
set +H # Disable history expansion to prevent '!' in content from being expanded

# Optimizely Flutter SDK - Release (Step 2)
# Publishes to pub.dev and creates GitHub release
Expand Down Expand Up @@ -28,22 +29,28 @@ git diff-index --quiet HEAD -- || error "Working tree has uncommitted changes"
PUBSPEC_VERSION=$(grep '^version:' pubspec.yaml | awk '{print $2}')
[[ "$PUBSPEC_VERSION" != "$VERSION" ]] && error "Version mismatch! pubspec.yaml: $PUBSPEC_VERSION, requested: $VERSION"

# Verify authentication
# Verify authentication (note: gh auth status only checks authentication, not that the
# token has the required 'repo' scope needed to create releases)
gh auth status &>/dev/null || error "GitHub CLI not authenticated. Run: gh auth login"

success "Pre-flight checks passed"

# Create temporary file for dry-run output (prevents symlink attacks)
DRY_RUN_LOG=$(mktemp)
trap "rm -f '$DRY_RUN_LOG'" EXIT
trap "rm -f \"${DRY_RUN_LOG}\"" EXIT

# Dry run
info "Running pub publish dry-run..."
if ! flutter packages pub publish --dry-run 2>&1 | tee "$DRY_RUN_LOG"; then
flutter packages pub publish --dry-run 2>&1 | tee "$DRY_RUN_LOG"
FLUTTER_EXIT="${PIPESTATUS[0]}"
if [[ "$FLUTTER_EXIT" != "0" ]]; then
echo ""
read -p "Dry-run found warnings. Continue? (y/N) " -n 1 -r
if [[ ! -t 0 ]]; then
error "Dry-run found warnings. Cannot prompt in non-interactive mode. Fix warnings or run interactively."
fi
read -p "Dry-run found warnings. Continue? (y/N) " -r -n 1
echo
[[ ! $REPLY =~ ^[Yy]$ ]] && error "Aborted by user"
[[ ! "$REPLY" =~ ^[Yy]$ ]] && error "Aborted by user"
fi

# Publish
Expand All @@ -52,10 +59,13 @@ flutter packages pub publish || error "Publishing failed"
success "Published to pub.dev!"

# Extract CHANGELOG
# Escape VERSION for use in sed regex (prevent regex metacharacter interpretation)
# Escape VERSION for use in sed regex (prevent regex metacharacter interpretation).
# VERSION is already validated against ^[0-9]+\.[0-9]+\.[0-9]+(-[a-z0-9]+)?$ above,
# so it cannot contain '|' (the alternate sed delimiter used below); escaping here
# is an additional safety measure for other metacharacters.
ESCAPED_VERSION=$(printf '%s\n' "$VERSION" | sed 's/[.[\*^$()+?{|]/\\&/g')
CHANGELOG_CONTENT=$(sed -n "/^## ${ESCAPED_VERSION}\$/,/^## [0-9]/p" CHANGELOG.md | sed '1d;$d')
[[ -z "$CHANGELOG_CONTENT" ]] && CHANGELOG_CONTENT="Release $VERSION\n\nSee CHANGELOG.md for details."
CHANGELOG_CONTENT=$(sed -n "\|^## ${ESCAPED_VERSION}\$|,\|^## [0-9]|p" CHANGELOG.md | sed '1d;$d')
[[ -z "$CHANGELOG_CONTENT" ]] && CHANGELOG_CONTENT=$(printf 'Release %s\n\nSee CHANGELOG.md for details.' "$VERSION")

RELEASE_NOTES="## $VERSION

Expand Down
Loading