Merge pull request #18 from amouat/harden-action-env

Pass action inputs via env to prevent script injection

.github/workflows/use-action.yaml

@@ -6,6 +6,8 @@ on:
   push:
     branches: ['main']
 
+permissions: {}
+
 jobs:
   use-action:
     name: Use Action
@@ -17,6 +19,9 @@ jobs:
     defaults:
       run:
         shell: bash
+        
+    permissions:
+      packages: write
 
     steps:
       - uses: actions/setup-go@v5
@@ -28,6 +33,8 @@ jobs:
       - run: |
           crane digest ubuntu
           crane manifest ubuntu | jq
+      - if: github.event_name == 'push'
+        run: |
           crane copy ubuntu ghcr.io/${{ github.repository }}/ubuntu-copy
 
       - name: Install old release

action.yml

@@ -12,6 +12,10 @@ runs:
   using: "composite"
   steps:
   - shell: bash
+    env:
+      VERSION: ${{ inputs.version }}
+      RUNNER_OS: ${{ runner.os }}
+      GITHUB_TOKEN: ${{ github.token }}
     run: |
       set -ex
 
@@ -19,7 +23,7 @@ runs:
       # - if version is "tip", install from tip of main.
       # - if version is "latest-release", use the latest release URL.
       # - otherwise, install the specified version.
-      case ${{ inputs.version }} in
+      case "${VERSION}" in
       tip)
         echo "Installing crane using go get"
         go install github.com/google/go-containerregistry/cmd/crane@main
@@ -28,10 +32,10 @@ runs:
         url="https://github.com/google/go-containerregistry/releases/latest/download"
         ;;
       *)
-        url="https://github.com/google/go-containerregistry/releases/download/${{ inputs.version }}"
+        url="https://github.com/google/go-containerregistry/releases/download/${VERSION}"
       esac
 
-      os=${{ runner.os }}
+      os="${RUNNER_OS}"
       if [[ $os == "macOS" ]]; then
         os="Darwin"
       fi
@@ -59,4 +63,4 @@ runs:
       fi
 
       # NB: username doesn't seem to matter.
-      echo "${{ github.token }}" | crane auth login ghcr.io --username "dummy" --password-stdin
+      echo "${GITHUB_TOKEN}" | crane auth login ghcr.io --username "dummy" --password-stdin