Skip to content

fix: shell quote leak in release-go workflow target passing#969

Merged
pcfreak30 merged 1 commit into
developfrom
fix/release-go-quoted-targets
Jun 9, 2026
Merged

fix: shell quote leak in release-go workflow target passing#969
pcfreak30 merged 1 commit into
developfrom
fix/release-go-quoted-targets

Conversation

@pcfreak30

@pcfreak30 pcfreak30 commented Jun 9, 2026

Copy link
Copy Markdown
Member

The workflow built args via string concatenation with literal single
quotes inside: args="$args --targets '${{ inputs.targets }}'".
Since $args was unquoted on invocation, bash didn't re-process the
quotes — they passed through as literal characters to argparse,
making the target name 'onboarding' (with quotes) instead of
onboarding.

Switch to bash array (ARGS+=) with proper "${ARGS[@]}" expansion
so values pass through cleanly. Also strip quote characters in the
Python filter_targets() as defense-in-depth, and remove duplicate
--force/--no-push checks in the workflow.


Fix shell quote leaking in release-go workflow target passing

The release-go workflow had a shell quoting issue where single quotes around the --targets input value were being passed literally to the Python script instead of being interpreted as shell quoting. This caused target names to include stray quotes (e.g., 'target1,target2'), leading to target matching failures.

Changes:

  • .github/workflows/release-go.yml: Replaced string concatenation (args="$args ...") with proper bash arrays (ARGS+=()) and array expansion ("${ARGS[@]}"), which correctly handles argument boundaries without quote leaking. Also removed duplicate --force and --no-push flag checks that were present in the original code.
  • scripts/release-go.py: Added defensive .strip('\'"') when parsing the targets filter, stripping any leading/trailing single or double quotes from target names as a safety measure against quote leakage from any invocation method.

The workflow built args via string concatenation with literal single
quotes inside: args="$args --targets '${{ inputs.targets }}'".
Since $args was unquoted on invocation, bash didn't re-process the
quotes — they passed through as literal characters to argparse,
making the target name 'onboarding' (with quotes) instead of
onboarding.

Switch to bash array (ARGS+=) with proper "${ARGS[@]}" expansion
so values pass through cleanly. Also strip quote characters in the
Python filter_targets() as defense-in-depth, and remove duplicate
--force/--no-push checks in the workflow.
@kody-ai

kody-ai Bot commented Jun 9, 2026

Copy link
Copy Markdown

Kody Review Complete

Great news! 🎉
No issues were found that match your current review configurations.

Keep up the excellent work! 🚀

Kody Guide: Usage and Configuration
Interacting with Kody
  • Request a Review: Ask Kody to review your PR manually by adding a comment with the @kody start-review command at the root of your PR.

  • Validate Business Logic: Ask Kody to validate your code against business rules by adding a comment with the @kody -v business-logic command.

  • Provide Feedback: Help Kody learn and improve by reacting to its comments with a 👍 for helpful suggestions or a 👎 if improvements are needed.

Current Kody Configuration
Review Options

The following review options are enabled or disabled:

Options Enabled
Bug
Performance
Security
Business Logic

Access your configuration settings here.

@pcfreak30 pcfreak30 merged commit 9b4c141 into develop Jun 9, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant