Pass ref and tag names to the shell through the environment

.github/workflows/code-check.yml

@@ -71,16 +71,18 @@ jobs:
           HEAD_REF: ${{ github.head_ref }}
           HEAD_REPO: ${{ github.event.pull_request.head.repo.full_name }}
           REPO: ${{ github.repository }}
+          BASE_REF: ${{ github.event.pull_request.base.ref }}
+          REF_NAME: ${{ github.ref_name }}
         run: |
           # Define directories to monitor (space-separated)
           MONITORED_DIRS="singlestoredb/management singlestoredb/fusion"
 
           # Determine the base commit to compare against
-          if [ "${{ github.event_name }}" == "pull_request" ]; then
+          if [ "$EVENT_NAME" == "pull_request" ]; then
             # For PRs, compare against the target branch (usually master/main)
-            BASE_COMMIT="origin/${{ github.event.pull_request.base.ref }}"
+            BASE_COMMIT="origin/$BASE_REF"
             echo "Pull Request: Comparing against $BASE_COMMIT"
-          elif [ "${{ github.ref_name }}" == "main" ] || [ "${{ github.ref_name }}" == "master" ]; then
+          elif [ "$REF_NAME" == "main" ] || [ "$REF_NAME" == "master" ]; then
             # For pushes to main/master, compare against the push's own lower
             # bound. The ruleset only allows squash merges, so that is normally
             # HEAD~1 anyway; this keeps a multi-commit push checked whole if

.github/workflows/fusion-docs.yml

@@ -35,8 +35,11 @@ jobs:
           python resources/gen_fusion_handlers_doc.py --dir fusion-docs
           zip -r fusion-docs.zip fusion-docs
 
+      # The tag goes through the environment, not into the script, so the
+      # shell never runs characters in it; see publish.yml.
       - name: Upload release asset
         run: |
-          gh release upload ${{ github.event.release.tag_name }} fusion-docs.zip
+          gh release upload "$TAG" fusion-docs.zip
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ github.event.release.tag_name }}

.github/workflows/publish.yml

@@ -78,10 +78,16 @@ jobs:
         # to it, so the script resets it to CLUSTER_PASSWORD over SQL once the
         # cluster is up. A generated password could not reach the other jobs
         # anyway: the runner refuses to write a masked value as a job output.
+        #
+        # The secrets reach the script through the environment rather than
+        # being interpolated into the command, so the shell never sees their
+        # characters.
         run: |
-          python resources/create_test_cluster.py --password="${{ secrets.CLUSTER_PASSWORD }}" --token="${{ secrets.CLUSTER_API_KEY }}" --project="Standard Project" --init-sql singlestoredb/tests/test.sql --output=github --expires=2h "python - $GITHUB_WORKFLOW - $GITHUB_RUN_NUMBER"
+          python resources/create_test_cluster.py --password="$CLUSTER_PASSWORD" --token="$CLUSTER_API_KEY" --project="Standard Project" --init-sql singlestoredb/tests/test.sql --output=github --expires=2h "python - $GITHUB_WORKFLOW - $GITHUB_RUN_NUMBER"
         env:
           PYTHONPATH: ${{ github.workspace }}
+          CLUSTER_PASSWORD: ${{ secrets.CLUSTER_PASSWORD }}
+          CLUSTER_API_KEY: ${{ secrets.CLUSTER_API_KEY }}
 
     outputs:
       cluster-id: ${{ steps.initialize-database.outputs.cluster-id }}
@@ -257,19 +263,24 @@ jobs:
         with:
           subject-path: dist/*
 
+      # The tag reaches the shell through the environment rather than being
+      # interpolated into the script: tag names may contain $(), backticks
+      # and ';', which the shell would otherwise run.
       - name: Create GitHub Release
         if: ${{ github.event_name == 'push' }}
         run: |
-          gh release create ${{ github.ref_name }} dist/* --prerelease --title "${{ github.ref_name }}"
+          gh release create "$TAG" dist/* --prerelease --title "$TAG"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ github.ref_name }}
 
       - name: Upload release assets
         if: ${{ github.event_name == 'release' }}
         run: |
-          gh release upload ${{ github.event.release.tag_name }} dist/* --clobber
+          gh release upload "$TAG" dist/* --clobber
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ github.event.release.tag_name }}
 
       - name: Publish to PyPI
         if: ${{ github.event_name == 'release' || github.event.inputs.publish_pypi == 'true' }}
@@ -325,6 +336,7 @@ jobs:
             echo "::error::No cluster ID from setup-database; the cluster (if any) must be terminated by hand"
             exit 1
           fi
-          curl --fail-with-body -H "Accept: application/json" -H "Authorization: Bearer ${{ secrets.CLUSTER_API_KEY }}" -X DELETE "https://api.singlestore.com/v2/clusters/$CLUSTER_ID?force=true"
+          curl --fail-with-body -H "Accept: application/json" -H "Authorization: Bearer $CLUSTER_API_KEY" -X DELETE "https://api.singlestore.com/v2/clusters/$CLUSTER_ID?force=true"
         env:
           CLUSTER_ID: ${{ needs.setup-database.outputs.cluster-id }}
+          CLUSTER_API_KEY: ${{ secrets.CLUSTER_API_KEY }}

.github/workflows/smoke-test.yml

@@ -60,10 +60,16 @@ jobs:
         # to it, so the script resets it to CLUSTER_PASSWORD over SQL once the
         # cluster is up. A generated password could not reach the other jobs
         # anyway: the runner refuses to write a masked value as a job output.
+        #
+        # The secrets reach the script through the environment rather than
+        # being interpolated into the command, so the shell never sees their
+        # characters.
         run: |
-          python resources/create_test_cluster.py --password="${{ secrets.CLUSTER_PASSWORD }}" --token="${{ secrets.CLUSTER_API_KEY }}" --project="Standard Project" --init-sql singlestoredb/tests/test.sql --output=github --expires=2h "python - $GITHUB_WORKFLOW - $GITHUB_RUN_NUMBER"
+          python resources/create_test_cluster.py --password="$CLUSTER_PASSWORD" --token="$CLUSTER_API_KEY" --project="Standard Project" --init-sql singlestoredb/tests/test.sql --output=github --expires=2h "python - $GITHUB_WORKFLOW - $GITHUB_RUN_NUMBER"
         env:
           PYTHONPATH: ${{ github.workspace }}
+          CLUSTER_PASSWORD: ${{ secrets.CLUSTER_PASSWORD }}
+          CLUSTER_API_KEY: ${{ secrets.CLUSTER_API_KEY }}
 
     outputs:
       cluster-id: ${{ steps.initialize-database.outputs.cluster-id }}