From fc1c9a7bb2c71c60c0c337f34d5f412eb5f278c1 Mon Sep 17 00:00:00 2001
From: Pierre Jeanjacquot <26487010+PierreJeanjacquot@users.noreply.github.com>
Date: Mon, 5 Oct 2026 12:02:10 +0000
Subject: [PATCH] fix(publish-npm)!: pass command inputs through env to prevent
 template injection

The *-command inputs were expanded directly into run scripts, letting any value inject arbitrary shell. They are now passed through environment variables and expanded as `${VAR}`, so bash no longer parses them as a script.

BREAKING CHANGE: install-command, build-command, test-command, lint-command, type-check-command and format-check-command now only accept a single command with its arguments. Multi-line scripts, `&&`, `;`, pipes, redirections, quotes and inline env assignments (`FOO=bar cmd`) are no longer supported; move such logic into an npm script and call it with `npm run <script>`.
---
 .github/workflows/publish-npm.yml | 36 ++++++++++++++++++++-----------
 publish-npm/README.md             | 12 +++++------
 publish-npm/workflow-sha256       |  2 +-
 3 files changed, 31 insertions(+), 19 deletions(-)

diff --git a/.github/workflows/publish-npm.yml b/.github/workflows/publish-npm.yml
index ad991b6..a1e8186 100644
--- a/.github/workflows/publish-npm.yml
+++ b/.github/workflows/publish-npm.yml
@@ -24,11 +24,11 @@ on:
         default: true
         type: boolean
       install-command:
-        description: "Install dependencies command"
+        description: "Install dependencies command (single command, no shell operators or multi-line scripts)"
         default: "npm ci"
         type: string
       build-command:
-        description: "Build package command"
+        description: "Build package command (single command, no shell operators or multi-line scripts)"
         default: "npm run build"
         type: string
       run-tests:
@@ -36,19 +36,19 @@ on:
         default: false
         type: boolean
       test-command:
-        description: "Run unit tests command"
+        description: "Run unit tests command (single command, no shell operators or multi-line scripts)"
         default: "npm test --if-present"
         type: string
       lint-command:
-        description: "Run linting command"
+        description: "Run linting command (single command, no shell operators or multi-line scripts)"
         default: "npm run lint --if-present"
         type: string
       type-check-command:
-        description: "Run type-checking command"
+        description: "Run type-checking command (single command, no shell operators or multi-line scripts)"
         default: "npm run check-types --if-present"
         type: string
       format-check-command:
-        description: "Run format-checking command"
+        description: "Run format-checking command (single command, no shell operators or multi-line scripts)"
         default: "npm run check-format --if-present"
         type: string
       environment:
@@ -130,7 +130,9 @@ jobs:
 
       - name: Install dependencies
         working-directory: ${{ inputs.working-directory }}
-        run: ${{ inputs.install-command }}
+        run: ${INPUTS_INSTALL_COMMAND}
+        env:
+          INPUTS_INSTALL_COMMAND: ${{ inputs.install-command }}
 
       - name: Override version
         if: ${{ inputs.version != '' }}
@@ -142,24 +144,34 @@ jobs:
 
       - name: Run build
         working-directory: ${{ inputs.working-directory }}
-        run: ${{ inputs.build-command }}
+        run: ${INPUTS_BUILD_COMMAND}
+        env:
+          INPUTS_BUILD_COMMAND: ${{ inputs.build-command }}
 
       - name: Run type checks
         working-directory: ${{ inputs.working-directory }}
-        run: ${{ inputs.type-check-command }}
+        run: ${INPUTS_TYPE_CHECK_COMMAND}
+        env:
+          INPUTS_TYPE_CHECK_COMMAND: ${{ inputs.type-check-command }}
 
       - name: check format
         working-directory: ${{ inputs.working-directory }}
-        run: ${{ inputs.format-check-command }}
+        run: ${INPUTS_FORMAT_CHECK_COMMAND}
+        env:
+          INPUTS_FORMAT_CHECK_COMMAND: ${{ inputs.format-check-command }}
 
       - name: Run linting
         working-directory: ${{ inputs.working-directory }}
-        run: ${{ inputs.lint-command }}
+        run: ${INPUTS_LINT_COMMAND}
+        env:
+          INPUTS_LINT_COMMAND: ${{ inputs.lint-command }}
 
       - name: Run unit tests
         if: ${{ inputs.run-tests }}
         working-directory: ${{ inputs.working-directory }}
-        run: ${{ inputs.test-command }}
+        run: ${INPUTS_TEST_COMMAND}
+        env:
+          INPUTS_TEST_COMMAND: ${{ inputs.test-command }}
 
       - name: Publish package
         working-directory: ${{ inputs.working-directory }}
diff --git a/publish-npm/README.md b/publish-npm/README.md
index 8f4b12f..07c5c52 100644
--- a/publish-npm/README.md
+++ b/publish-npm/README.md
@@ -25,13 +25,13 @@ This reusable GitHub Actions workflow automates the process of publishing an NPM
 | **registry** | NPM registry URL. | No | `https://registry.npmjs.org` |
 | **access** | Package access (public or restricted). | No | `public` |
 | **provenance** | Enable npm provenance. | No | `true` |
-| **install-command** | Install dependencies command. | No | `npm ci` |
-| **build-command** | Build package command. | No | `npm run build` |
+| **install-command** | Install dependencies command (single command, no shell operators or multi-line scripts). | No | `npm ci` |
+| **build-command** | Build package command (single command, no shell operators or multi-line scripts). | No | `npm run build` |
 | **run-tests** | Execute unit tests step. | No | `false` |
-| **test-command** | Run unit tests command. | No | `npm test --if-present` |
-| **lint-command** | Run linting command. | No | `npm run lint --if-present` |
-| **type-check-command** | Run type-checking command. | No | `npm run check-types --if-present` |
-| **format-check-command** | Run format-checking command. | No | `npm run check-format --if-present` |
+| **test-command** | Run unit tests command (single command, no shell operators or multi-line scripts). | No | `npm test --if-present` |
+| **lint-command** | Run linting command (single command, no shell operators or multi-line scripts). | No | `npm run lint --if-present` |
+| **type-check-command** | Run type-checking command (single command, no shell operators or multi-line scripts). | No | `npm run check-types --if-present` |
+| **format-check-command** | Run format-checking command (single command, no shell operators or multi-line scripts). | No | `npm run check-format --if-present` |
 | **environment** | GitHub environment. | No | `production` |
 | **tag** | npm publish tag (e.g., latest, nightly). | No | `''` (empty string) |
 | **working-directory** | Directory containing package.json. | No | `''` (empty string) |
diff --git a/publish-npm/workflow-sha256 b/publish-npm/workflow-sha256
index 2a1ca59..c9941ca 100644
--- a/publish-npm/workflow-sha256
+++ b/publish-npm/workflow-sha256
@@ -1 +1 @@
-57406f36c10a4c1def8a5efb291aa13e157f314410abab918104873d4ee452f7
+a936ca8dedd03c393e20d2716282cf3bc72bdc3bcfceae0d083686f938e6e513