Walkthrough

The Firefox metadata workflow now documents three- or four-component version formats and validates FIREFOX_METADATA_VERSION before running the update command. Invalid values cause the step to exit with an error, and the version is supplied through the step environment.

Changes

Workflow Version Validation

Estimated code review effort: 1 (Trivial) | ~3 minutes

Suggested reviewers: josstorer

• X
• Mastodon
• Reddit
• LinkedIn

• Pass workflow input via env var and quote it in bash to prevent shell injection.
• Add strict x.y.z semver validation and fail fast on invalid versions.
• Keep existing npm-based Firefox metadata update flow unchanged otherwise.

graph TD
  A["workflow_dispatch input: version"] --> B["Env: FIREFOX_METADATA_VERSION"] --> C{"Semver x.y.z?"} -->|"yes"| D["Run npm update script"] --> E["Update Firefox metadata"]
  C -->|"no"| F["Exit 1 + error"]
  G[("FIREFOX_* secrets")] --> D

  subgraph Legend
    direction LR
    _in["Input"] ~~~ _dec{"Decision"} ~~~ _proc["Process"] ~~~ _sec[("Secrets")]
  end

Loading

The following are alternative approaches to this PR:

1. Validate with a semver tool (node/semver or npx semver)

• ➕ More accurate semver handling (pre-releases/build metadata if desired)
• ➕ Clearer error messages and maintainability vs bash regex
• ➖ Adds dependency/tooling surface area to a workflow step
• ➖ Slightly more moving parts for a minimal security fix

2. Use workflow_dispatch input constraints (choices) when feasible

• ➕ Prevents invalid values before the runner starts
• ➕ No shell parsing involved for validation
• ➖ Not practical for arbitrary version values (needs enumerated list)
• ➖ Still should quote/handle safely in the step

3. Add hardened shell defaults (set -euo pipefail) and explicit shell

• ➕ Improves safety and debuggability across the step
• ➕ Reduces risk from unset variables or silent failures
• ➖ Can be a behavioral change if the script currently relies on unset vars
• ➖ Still requires proper quoting/validation of inputs

Recommendation: The PR’s approach (env indirection + strict quoting + allowlist validation) is the best minimal-change mitigation for command injection in a workflow run step. Consider optionally adding set -euo pipefail for additional robustness, but the core security issue is already addressed effectively.

Bug fix (1) +8 / -1

firefox-metadata.ymlAvoid shell injection from dispatch input and validate version +8/-1

Avoid shell injection from dispatch input and validate version

• Replaces direct interpolation of 'inputs.version' in the 'run' command with an environment variable ('FIREFOX_METADATA_VERSION') used in a quoted context. Adds a strict x.y.z semver regex check to fail fast on invalid input before running the npm metadata update script.

.github/workflows/firefox-metadata.yml

Description

此步驟新增了 bash 專用的 [[ ... =~ ... ]] 正則判斷，但 workflow/step 未明確指定 shell: bash，未來若 workflow 預設 shell
被調整（或重用到非 bash 環境）會導致語法錯誤而使更新步驟失敗。

Code

.github/workflows/firefox-metadata.yml[R30-34]

+        run: |
+          if [[ ! "$FIREFOX_METADATA_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "Firefox version must use x.y.z semver format" >&2
+            exit 1
+          fi

Evidence

在本 PR 新增的 run 腳本中使用了 [[ ... =~ ... ]]；同一個 workflow 檔案中並未看到 step-level shell: 或
defaults.run.shell 設定，因此這段腳本對預設 shell 行為形成隱含依賴。

.github/workflows/firefox-metadata.yml[14-41]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The workflow step relies on bash-specific syntax (`[[ ... =~ ... ]]`) but does not explicitly pin the shell. This creates a portability/maintenance hazard: if the workflow’s default shell changes or the job is later adapted to a different runner/shell, the step may fail with a syntax error.

### Issue Context
The current step uses `[[` and `=~` for regex validation. These are not POSIX `sh` features.

### Fix Focus Areas
- .github/workflows/firefox-metadata.yml[30-36]

### Suggested fix
Add `shell: bash` to the step (or define `defaults: run: shell: bash` for the job/workflow), **or** rewrite the validation in POSIX-compatible `sh` (e.g., using `case`/`grep -E`).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

• .github/workflows/firefox-metadata.yml

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 2f820a0)

Status: No Issues Found | Recommendation: Merge

• .github/workflows/firefox-metadata.yml

• .github/workflows/firefox-metadata.yml