Skip to content

Rebuild entrypoint.sh argv as bash array#197

Closed
AdamDev wants to merge 1 commit into
masterfrom
chore-hardening-action
Closed

Rebuild entrypoint.sh argv as bash array#197
AdamDev wants to merge 1 commit into
masterfrom
chore-hardening-action

Conversation

@AdamDev

@AdamDev AdamDev commented Apr 6, 2026

Copy link
Copy Markdown

Rebuild argv construction as a bash array (CKV_ARGS) instead of string concatenation. Each INPUT_* value becomes exactly one argv element, preventing unintended word-splitting.

Changes:

  • entrypoint.sh: Replace string concatenation with bash array (CKV_ARGS)
  • action.yml: Use local Dockerfile, remove args block
  • Dockerfile: New - builds local image with entrypoint
  • Added problem matcher JSON files for local build

Rebuild argv construction as a bash array (CKV_ARGS) instead of
string concatenation. Each INPUT_* value becomes exactly one argv
element, preventing unintended word-splitting.

Changes:
- entrypoint.sh: Replace string concatenation with bash array (CKV_ARGS)
- action.yml: Use local Dockerfile, remove args block
- Dockerfile: New - builds local image with entrypoint
- Added problem matcher JSON files for local build
@AdamDev AdamDev changed the title Security fix F-03: Rebuild entrypoint.sh argv as bash array Rebuild entrypoint.sh argv as bash array Apr 6, 2026
@AdamDev AdamDev closed this Apr 6, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant