csh/actions-template
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 9 Wiki Activity

🔒 fix(ci): 修复 token 明文插值并加固脚本健壮性

Browse Source 
- 安全: curl 的 Authorization 头改用 shell 变量 ${ACCESS_TOKEN}，
  避免 secret 经 ${{ }} 明文展开进脚本文本（changelog、stats）
- 修复: stats 分支清理 find 显式排除 .git，与注释一致，
  不再依赖 linked worktree 中 .git 为文件的隐含前提
- 健壮性: echo -e 前用 esc() 转义用户 message/body 中的反斜杠，
  防止字面 \n \t 被误展开破坏 Markdown
- 健壮性: 千分位格式化改用不依赖 locale 的 sed 实现，
  替换 printf "%'d"
- 健壮性: git log 的 range 变量补全引号
- 优化: prepare.yml 的 push 触发限定 main/master 分支与 tag，
  避免其它分支空跑
- 文档: route-release 标注 workflow_run.path 为 Gitea 特有字段
This commit is contained in:
csh
2026-07-21 11:13:52 +08:00
parent 045aade5ed
commit 18c4dfa811
3 changed files with 42 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/workflows/changelog_and_release.yml
+24 -11
View File
@@ -129,6 +129,9 @@ env:
jobs:
route-release:
# ⚠️ 依赖 Gitea 特有的 workflow_run.path 字段格式（形如 "<workflow>@refs/tags/<tag>"）
# 该字段非 GitHub Actions 标准，若 Gitea 升级改变其格式，发布会静默不触发。
# 已在 Gitea 1.22 上验证；升级后请复核此判据，必要时增加 fallback。
if: ${{ github.event.workflow_run.conclusion == 'success' && contains(github.event.workflow_run.path, '@refs/tags/') }}
runs-on: standard-ubuntu-22
permissions:
@@ -526,7 +529,7 @@ jobs:
echo "🔍 扫描提交记录..."
TEMP_COMMITS=$(mktemp)
git log $COMMIT_RANGE --no-merges --reverse --format="COMMIT_START%n%H%n%an%n%s%nBODY_START%n%b%nBODY_END" > "$TEMP_COMMITS"
git log "$COMMIT_RANGE" --no-merges --reverse --format="COMMIT_START%n%H%n%an%n%s%nBODY_START%n%b%nBODY_END" > "$TEMP_COMMITS"
declare -a COMMITS_HASH
declare -a COMMITS_AUTHOR
@@ -647,6 +650,10 @@ jobs:
REPO_URL="${{ github.server_url }}/${{ github.repository }}"
# 初始化条目内容
# 转义用户内容中的反斜杠，避免后续 echo -e 误展开 message/body 里的
# 字面 \n \t \\ 等序列（我们自己插入的 \n 分隔符不经过此函数，仍正常换行）
esc() { printf '%s' "$1" | sed 's/\\/\\\\/g'; }
NEW_ENTRY="## :bookmark: ${CHANGELOG_VERSION}\n\n"
NEW_ENTRY="${NEW_ENTRY}${CHANGELOG_SECTION_TITLE}\n\n"
@@ -654,10 +661,10 @@ jobs:
for ((i=0; i<$VALID_COUNT; i++)); do
hash="${COMMITS_HASH[$i]}"
author="${COMMITS_AUTHOR[$i]}"
message="${COMMITS_MESSAGE[$i]}"
message=$(esc "${COMMITS_MESSAGE[$i]}")
body="${COMMITS_BODY[$i]}"
echo " [$((i+1))/$VALID_COUNT] ${hash:0:7}: ${message:0:60}..."
echo " [$((i+1))/$VALID_COUNT] ${hash:0:7}: ${COMMITS_MESSAGE[$i]:0:60}..."
# 构建提交链接 - 使用短 hash 格式
short_hash="${hash:0:7}"
@@ -671,8 +678,9 @@ jobs:
# 处理 body (如果存在)
if [ -n "$body" ]; then
# 移除首尾空行
# 移除首尾空行，并转义反斜杠
cleaned_body=$(echo "$body" | sed -e :a -e '/^\s*$/d;')
cleaned_body=$(esc "$cleaned_body")
if [ -n "$cleaned_body" ]; then
# 有 body: 主题在第一行，body 内容缩进显示，链接和作者放在一起
@@ -709,7 +717,7 @@ jobs:
grep -vxF "${{ env.GIT_USER_NAME }}" | \
sort -u)
else
CONTRIBUTORS=$(git log $COMMIT_RANGE --pretty=format:"%an" --no-merges | \
CONTRIBUTORS=$(git log "$COMMIT_RANGE" --pretty=format:"%an" --no-merges | \
grep -v "github-actions\[bot\]" | \
grep -v "dependabot\[bot\]" | \
grep -v "renovate\[bot\]" | \
@@ -782,7 +790,7 @@ jobs:
# 这是一个新的 commit，添加它
author="${COMMITS_AUTHOR[$i]}"
message="${COMMITS_MESSAGE[$i]}"
message=$(esc "${COMMITS_MESSAGE[$i]}")
body="${COMMITS_BODY[$i]}"
COMMIT_LINK="([${short_hash}](${REPO_URL}/commit/${hash}))"
@@ -795,6 +803,7 @@ jobs:
if [ -n "$body" ]; then
cleaned_body=$(echo "$body" | sed -e :a -e '/^\s*$/d;')
cleaned_body=$(esc "$cleaned_body")
if [ -n "$cleaned_body" ]; then
NEW_COMMIT_ENTRIES="${NEW_COMMIT_ENTRIES}- ${message} \n"
while IFS= read -r line; do
@@ -962,7 +971,7 @@ jobs:
echo "📊 增量范围: $RELEASE_NOTES_RANGE"
TEMP_COMMITS=$(mktemp)
git log $RELEASE_NOTES_RANGE --no-merges --reverse \
git log "$RELEASE_NOTES_RANGE" --no-merges --reverse \
--format="COMMIT_START%n%H%n%an%n%s%nBODY_START%n%b%nBODY_END" > "$TEMP_COMMITS"
declare -a COMMITS_HASH
@@ -1029,11 +1038,14 @@ jobs:
VALID_COUNT=$COMMIT_INDEX
echo "✅ 增量有效提交: $VALID_COUNT"
# 转义用户内容中的反斜杠，避免后续 echo -e 误展开 message/body 里的字面序列
esc() { printf '%s' "$1" | sed 's/\\/\\\\/g'; }
NOTES="${CHANGELOG_SECTION_TITLE}\n\n"
for ((i=0; i<$VALID_COUNT; i++)); do
hash="${COMMITS_HASH[$i]}"
author="${COMMITS_AUTHOR[$i]}"
message="${COMMITS_MESSAGE[$i]}"
message=$(esc "${COMMITS_MESSAGE[$i]}")
body="${COMMITS_BODY[$i]}"
short_hash="${hash:0:7}"
COMMIT_LINK="([${short_hash}](${REPO_URL}/commit/${hash}))"
@@ -1042,6 +1054,7 @@ jobs:
if [ -n "$body" ]; then
cleaned_body=$(echo "$body" | sed -e :a -e '/^\s*$/d;')
cleaned_body=$(esc "$cleaned_body")
else
cleaned_body=""
fi
@@ -1062,7 +1075,7 @@ jobs:
if [ "$RELEASE_NOTES_RANGE" = "HEAD" ]; then
CONTRIBUTORS=$(git log --pretty=format:"%an" --no-merges)
else
CONTRIBUTORS=$(git log $RELEASE_NOTES_RANGE --pretty=format:"%an" --no-merges)
CONTRIBUTORS=$(git log "$RELEASE_NOTES_RANGE" --pretty=format:"%an" --no-merges)
fi
CONTRIBUTORS=$(echo "$CONTRIBUTORS" | \
grep -v "github-actions\[bot\]" | \
@@ -1126,7 +1139,7 @@ jobs:
echo "🌐 发送 API 请求..."
HTTP_CODE=$(curl -s -o /tmp/release_response.json -w "%{http_code}" -X POST \
-H "Authorization: token ${{ env.ACCESS_TOKEN }}" \
-H "Authorization: token ${ACCESS_TOKEN}" \
-H "Content-Type: application/json" \
-d @/tmp/payload.json \
"${{ github.server_url }}/api/v1/repos/${{ github.repository }}/releases")
@@ -1192,7 +1205,7 @@ jobs:
if [ -f "$file" ]; then
echo "📤 [$FILE_INDEX/$TOTAL_FILES] 上传 $(basename $file)..."
HTTP_CODE=$(curl -s -o /tmp/upload_response_${FILE_INDEX}.json -w "%{http_code}" -X POST \
-H "Authorization: token ${{ env.ACCESS_TOKEN }}" \
-H "Authorization: token ${ACCESS_TOKEN}" \
-F "attachment=@${file}" \
"${{ github.server_url }}/api/v1/repos/${{ github.repository }}/releases/$RELEASE_ID/assets?name=$(basename $file)")