From 78ed48d9558e4f3ab490d8d55145b2b69a393cbc Mon Sep 17 00:00:00 2001 From: YuYu1015 Date: Sun, 11 Oct 2026 23:26:37 +0800 Subject: [PATCH] fix: pass push metadata to protect-station workflows through env The branch name, author name, author email and commit message were expanded with ${{ }} straight into the run script. GitHub substitutes those expressions as text before bash parses the script, so a commit message containing a quote ran as shell inside the step that holds PAT_TOKEN. Hand them over as environment variables instead; the script reads the same values, now as data. --- .github/workflows/protect-station-csv.yml | 16 +++++++++------- .github/workflows/protect-station-json.yml | 16 +++++++++------- 2 files changed, 18 insertions(+), 14 deletions(-) diff --git a/.github/workflows/protect-station-csv.yml b/.github/workflows/protect-station-csv.yml index 9c1bd6b3..f20b090b 100644 --- a/.github/workflows/protect-station-csv.yml +++ b/.github/workflows/protect-station-csv.yml @@ -16,16 +16,18 @@ jobs: fetch-depth: 0 - name: Check if committer is bot and revert if needed + # 一律經由環境變數傳入，不可寫成 "${{ ... }}" 嵌在 script 裡：GitHub 會先把 + # 表達式文字替換進 script 才交給 bash，而分支名稱、作者名稱與提交訊息都由 + # 推送者決定，嵌入就等於讓推送者在持有 PAT_TOKEN 的 step 裡執行任意指令 env: PAT_TOKEN: ${{ secrets.PAT_TOKEN }} + BRANCH: ${{ github.ref_name }} + ACTOR: ${{ github.actor }} + COMMITTER_EMAIL: ${{ github.event.commits[0].author.email }} + COMMITTER_NAME: ${{ github.event.commits[0].author.name }} + COMMIT_MESSAGE: ${{ github.event.commits[0].message }} + COMMIT_SHA: ${{ github.event.commits[0].sha }} run: | - BRANCH="${{ github.ref_name }}" - ACTOR="${{ github.actor }}" - COMMITTER_EMAIL="${{ github.event.commits[0].author.email }}" - COMMITTER_NAME="${{ github.event.commits[0].author.name }}" - COMMIT_MESSAGE="${{ github.event.commits[0].message }}" - COMMIT_SHA="${{ github.event.commits[0].sha }}" - echo "檢查分支: $BRANCH" # 首先檢查是否在 main 分支上 diff --git a/.github/workflows/protect-station-json.yml b/.github/workflows/protect-station-json.yml index e76e8312..73f8859b 100644 --- a/.github/workflows/protect-station-json.yml +++ b/.github/workflows/protect-station-json.yml @@ -16,16 +16,18 @@ jobs: fetch-depth: 0 - name: Check if committer is bot and revert if needed + # 一律經由環境變數傳入，不可寫成 "${{ ... }}" 嵌在 script 裡：GitHub 會先把 + # 表達式文字替換進 script 才交給 bash，而分支名稱、作者名稱與提交訊息都由 + # 推送者決定，嵌入就等於讓推送者在持有 PAT_TOKEN 的 step 裡執行任意指令 env: PAT_TOKEN: ${{ secrets.PAT_TOKEN }} + BRANCH: ${{ github.ref_name }} + ACTOR: ${{ github.actor }} + COMMITTER_EMAIL: ${{ github.event.commits[0].author.email }} + COMMITTER_NAME: ${{ github.event.commits[0].author.name }} + COMMIT_MESSAGE: ${{ github.event.commits[0].message }} + COMMIT_SHA: ${{ github.event.commits[0].sha }} run: | - BRANCH="${{ github.ref_name }}" - ACTOR="${{ github.actor }}" - COMMITTER_EMAIL="${{ github.event.commits[0].author.email }}" - COMMITTER_NAME="${{ github.event.commits[0].author.name }}" - COMMIT_MESSAGE="${{ github.event.commits[0].message }}" - COMMIT_SHA="${{ github.event.commits[0].sha }}" - echo "檢查分支: $BRANCH" # 首先檢查是否在 main 分支上