Harden the release workflows against injected values

.github/workflows/check-editor-releases.yml

@@ -15,6 +15,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
+        with:
+          # The editor build installs third-party packages; keep the write
+          # token off disk and hand it only to the push step.
+          persist-credentials: false
 
       - name: Get latest exelearning release
         id: check
@@ -28,6 +32,12 @@ jobs:
             echo "found=false" >> $GITHUB_OUTPUT
             exit 0
           fi
+          # The tag comes from another repository and ends up in shell commands,
+          # file names and a git commit: accept only a plain version tag.
+          if ! [[ "$LATEST" =~ ^v[0-9][0-9A-Za-z.-]*$ ]]; then
+            echo "::error::Unexpected editor release tag format"
+            exit 1
+          fi
           echo "Latest editor release: $LATEST"
           echo "tag=$LATEST" >> $GITHUB_OUTPUT
 
@@ -79,21 +89,25 @@ jobs:
       - name: Compute version
         if: steps.check.outputs.found == 'true'
         id: version
+        env:
+          TAG: ${{ steps.check.outputs.tag }}
         run: |
-          TAG="${{ steps.check.outputs.tag }}"
           VERSION="${TAG#v}"
           echo "version=$VERSION" >> $GITHUB_OUTPUT
           echo "tag=$TAG" >> $GITHUB_OUTPUT
 
       - name: Create package
         if: steps.check.outputs.found == 'true'
-        run: |
-          make package VERSION=${{ steps.version.outputs.version }}
+        env:
+          VERSION: ${{ steps.version.outputs.version }}
+        run: make package VERSION="$VERSION"
 
       - name: Update editor version marker
         if: steps.check.outputs.found == 'true'
+        env:
+          TAG: ${{ steps.check.outputs.tag }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          TAG="${{ steps.check.outputs.tag }}"
           echo "$TAG" > .editor-version
           # Keep the playground blueprint's editor URL in sync with .editor-version,
           # otherwise the preview stays pinned to the hardcoded version.
@@ -106,7 +120,7 @@ jobs:
           git config user.email "github-actions[bot]@users.noreply.github.com"
           git add .editor-version blueprint.json
           git commit -m "Update editor version to $TAG"
-          git push
+          git push "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" "HEAD:${GITHUB_REF_NAME}"
 
       - name: Build Playground URL for this release
         if: steps.check.outputs.found == 'true'

.github/workflows/release.yml

@@ -36,6 +36,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
+        with:
+          # Nothing here pushes; keep the write token off disk while the
+          # editor build installs third-party packages.
+          persist-credentials: false
 
       - name: Setup PHP
         uses: shivammathur/setup-php@v2
@@ -51,8 +55,16 @@ jobs:
         uses: oven-sh/setup-bun@v2
 
       - name: Set environment variables
+        # Dispatch inputs are read through env, never expanded into the script,
+        # and validated before they reach GITHUB_ENV (a newline there would
+        # define arbitrary variables for every later step).
+        env:
+          INPUT_RELEASE: ${{ github.event.inputs.release_tag }}
+          INPUT_REPO_URL: ${{ github.event.inputs.editor_repo_url }}
+          INPUT_REF: ${{ github.event.inputs.editor_ref }}
+          INPUT_REF_TYPE: ${{ github.event.inputs.editor_ref_type }}
         run: |
-          if [ "${{ github.event_name }}" = "release" ]; then
+          if [ "$GITHUB_EVENT_NAME" = "release" ]; then
             RAW_TAG="${GITHUB_REF##*/}"
             VERSION_TAG="${RAW_TAG#v}"
             echo "RELEASE_TAG=${VERSION_TAG}" >> $GITHUB_ENV
@@ -62,14 +74,16 @@ jobs:
             echo "EXELEARNING_EDITOR_REF=v${VERSION_TAG}" >> $GITHUB_ENV
             echo "EXELEARNING_EDITOR_REF_TYPE=tag" >> $GITHUB_ENV
           else
-            INPUT_RELEASE="${{ github.event.inputs.release_tag }}"
             if [ -z "$INPUT_RELEASE" ]; then
               INPUT_RELEASE="manual-$(date +%Y%m%d)-${GITHUB_SHA::7}"
             fi
+            [[ "$INPUT_RELEASE" =~ ^[0-9A-Za-z._-]+$ ]] || { echo "::error::Invalid release_tag"; exit 1; }
+            [[ "$INPUT_REPO_URL" =~ ^https://[0-9A-Za-z._/-]+$ ]] || { echo "::error::Invalid editor_repo_url"; exit 1; }
+            [[ "$INPUT_REF" =~ ^[0-9A-Za-z._/-]+$ ]] || { echo "::error::Invalid editor_ref"; exit 1; }
             echo "RELEASE_TAG=${INPUT_RELEASE}" >> $GITHUB_ENV
-            echo "EXELEARNING_EDITOR_REPO_URL=${{ github.event.inputs.editor_repo_url }}" >> $GITHUB_ENV
-            echo "EXELEARNING_EDITOR_REF=${{ github.event.inputs.editor_ref }}" >> $GITHUB_ENV
-            echo "EXELEARNING_EDITOR_REF_TYPE=${{ github.event.inputs.editor_ref_type }}" >> $GITHUB_ENV
+            echo "EXELEARNING_EDITOR_REPO_URL=${INPUT_REPO_URL}" >> $GITHUB_ENV
+            echo "EXELEARNING_EDITOR_REF=${INPUT_REF}" >> $GITHUB_ENV
+            echo "EXELEARNING_EDITOR_REF_TYPE=${INPUT_REF_TYPE}" >> $GITHUB_ENV
           fi
 
       - name: Build static editor