 John Kennedy
|
0e7fba2d52
|
ci: harden docs workflow inputs (#4970)
## Summary
- Pin `ctriolo/action-create-linear-issue` to the immutable commit SHA
for `v0.7` so the `LINEAR_API_KEY` is no longer exposed to a mutable
third-party action tag.
- Pass GitHub PR base refs/SHAs and workflow output values through
environment variables before shell use.
- Apply the same base-ref hardening to adjacent docs diff-check
workflows to avoid the same pattern recurring.
## Corridor findings
- Fixes
https://app.corridor.dev/projects/86f45f70-3153-46d0-b0f6-5ec9dba1ace1/findings/eb002ea1-903e-4a2b-94a5-5ebc4b60bab2
- Fixes
https://app.corridor.dev/projects/86f45f70-3153-46d0-b0f6-5ec9dba1ace1/findings/1bbe3c85-75f4-4ece-8c96-cd857c5be291
## Validation
- `ruby -e 'require \"yaml\";
Dir[\"/tmp/docs/.github/workflows/*.yml\"].each { |p| YAML.load_file(p)
}; puts \"parsed workflows\"'`
- `git diff --check`
Co-authored-by: langsmith-fleet[bot] <langsmith-fleet[bot]@users.noreply.github.com>
|
2026-07-20 09:44:15 -07:00 |
|