Skip to content

ci: harden build-anchor inputs before shell use - #197

Open
SashaMIT wants to merge 1 commit into
Squads-Protocol:mainfrom
SashaMIT:ci/harden-build-anchor-inputs
Open

SashaMIT wants to merge 1 commit into
Squads-Protocol:mainfrom
SashaMIT:ci/harden-build-anchor-inputs

Conversation

@SashaMIT

@SashaMIT SashaMIT commented Aug 5, 2026

Copy link
Copy Markdown

Summary

  • CI hygiene for .github/actions/build-anchor.
  • Bind free-string program under env: (PROGRAM_NAME) before run: script use (quoted $PROGRAM_NAME), matching the existing pattern in deploy-anchor.
  • with: / artifact path: / name: expressions left as-is (not shell script text).
  • Defense-in-depth for Actions composites — not framed as a vulnerability ticket.

Test plan

  • Workflow YAML review
  • Existing staging/test workflows that call build-anchor still pass with the same program / program_id inputs

Bind free-string program input under env before run scripts,
matching deploy-anchor. Defense-in-depth for the composite action.
@vercel

vercel Bot commented Aug 5, 2026

Copy link
Copy Markdown

@SashaMIT is attempting to deploy a commit to the squads Team on Vercel.

A member of the Team first needs to authorize it.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant