From 3f78f172d9f9fe1a9422334c5ae03cd5ac685ebd Mon Sep 17 00:00:00 2001 From: Ogulcan Celik Date: Wed, 16 Sep 2026 18:43:23 +0300 Subject: fix: address release promotion review findings --- scripts/release-workflows.test.ts | 15 +++++++++++++++ 1 file changed, 15 insertions(+) (limited to 'scripts/release-workflows.test.ts') diff --git a/scripts/release-workflows.test.ts b/scripts/release-workflows.test.ts index a169204f..75097710 100644 --- a/scripts/release-workflows.test.ts +++ b/scripts/release-workflows.test.ts @@ -33,6 +33,21 @@ describe("official publishing workflow boundaries", () => { expect(adminGate.run).not.toContain("ogulcancelik"); }); + test("release arguments are not interpolated into executable shell text", () => { + const input = `untrusted'\"$(echo unexpected-command)`; + for (const args of [ + ["preview", input], + ["release-prepare", input, input], + ["release-publish", input, input], + ["release", input, input], + ]) { + const result = spawnSync("just", ["--dry-run", ...args], { encoding: "utf8" }); + expect(result.status).toBe(0); + expect(result.stdout + result.stderr).not.toContain(input); + expect(result.stdout + result.stderr).not.toContain("unexpected-command"); + } + }); + test.skipIf(process.platform === "win32")("admin gate permits admins and fails closed for other roles or API errors", () => { const dir = mkdtempSync("/var/tmp/herdr-admin-gate-"); try { -- cgit v1.2.3