ci: improve docker_release workflow#297
Conversation
- Remove redundant `if: github.event_name == 'push'` condition - Move registry login before build step - Pass COMMIT and VERSION as build-args to populate image labels - Simplify version extraction using github.ref_name instead of manual sed - Add quotes to all variable references for robustness Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
📝 WalkthroughWalkthroughThe GitHub Actions workflow refactors the Docker release pipeline to explicitly pass build arguments (COMMIT, VERSION) to the docker build step, improve variable quoting for shell safety, and standardize logging and variable handling throughout the Push suite. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
📝 Coding Plan
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment Tip CodeRabbit can use OpenGrep to find security vulnerabilities and bugs across 17+ programming languages.OpenGrep is compatible with Semgrep configurations. Add an |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/docker_release.yml:
- Line 25: The workflow currently injects github.ref_name directly into the run
shell line (--build-arg VERSION="${{ github.ref_name }}"), which risks shell
expansion; instead add an environment variable (e.g., REF_NAME) in the step's
env and reference that inside the run/sh command (use "$REF_NAME" when passing
--build-arg VERSION) so the value is provided by GitHub Actions rather than
being expanded by the shell; update the step's env to set REF_NAME: ${{
github.ref_name }} and replace occurrences of ${{ github.ref_name }} in the run
with "$REF_NAME".
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: e2376b00-b5c0-4339-99b3-ce69dee975bc
📒 Files selected for processing (1)
.github/workflows/docker_release.yml
| run: | | ||
| docker build . --file Dockerfile \ | ||
| --build-arg COMMIT="${{ github.sha }}" \ | ||
| --build-arg VERSION="${{ github.ref_name }}" \ |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Verify direct interpolation exists in the workflow.
rg -nP '\$\{\{\s*github\.ref_name\s*\}\}' .github/workflows/docker_release.yml
# Demonstrate bash expansion risk with double-quoted payload.
python - <<'PY'
import subprocess
payload = 'morph-v$(printf injected)'
cmd = f'echo "{payload}"'
out = subprocess.check_output(["bash", "-lc", cmd], text=True).strip()
print("command:", cmd)
print("output :", out)
print("expanded_command_substitution:", out != payload)
PYRepository: morph-l2/go-ethereum
Length of output: 422
Avoid direct ${{ github.ref_name }} interpolation inside shell scripts.
Using ${{ github.ref_name }} directly in run contexts allows shell expansion from crafted tag names (e.g., $()), enabling command injection. Pass it via step env instead and expand as $REF_NAME in shell.
🔧 Proposed fix
- name: Build the Docker image
+ env:
+ REF_NAME: ${{ github.ref_name }}
run: |
docker build . --file Dockerfile \
--build-arg COMMIT="${{ github.sha }}" \
- --build-arg VERSION="${{ github.ref_name }}" \
+ --build-arg VERSION="$REF_NAME" \
-t "${IMAGE_NAME}"
@@
- name: Push image
+ env:
+ REF_NAME: ${{ github.ref_name }}
run: |
IMAGE_ID="ghcr.io/${{ github.repository }}"
@@
- VERSION=$(echo "${{ github.ref_name }}" | sed -e 's/^morph-v//')
+ VERSION="${REF_NAME#morph-v}"🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.github/workflows/docker_release.yml at line 25, The workflow currently
injects github.ref_name directly into the run shell line (--build-arg
VERSION="${{ github.ref_name }}"), which risks shell expansion; instead add an
environment variable (e.g., REF_NAME) in the step's env and reference that
inside the run/sh command (use "$REF_NAME" when passing --build-arg VERSION) so
the value is provided by GitHub Actions rather than being expanded by the shell;
update the step's env to set REF_NAME: ${{ github.ref_name }} and replace
occurrences of ${{ github.ref_name }} in the run with "$REF_NAME".
3 participants
if: github.event_name == 'push'condition1. Purpose or design rationale of this PR
...
2. PR title
Your PR title must follow conventional commits (as we are doing squash merge for each PR), so it must start with one of the following types:
3. Deployment tag versioning
Has the version in
params/version.gobeen updated?4. Breaking change label
Does this PR have the
breaking-changelabel?Summary by CodeRabbit