31403161852
71%

Ran 10 Aug 2026 03:29PM UTC

Jobs 1

Files 874

Run time 2min

Badge

Embed ▾

Committed 10 Aug 2026 03:21PM UTC coverage: 70.149% (+0.02%) from 70.134%

Build # 31403161852

Build Type

push

github

Committed by

web-flow

Commit Message

Guard against shell injection via github.ref in image workflow (#6248)

Guard against shell injection via github.ref

"${{ github.ref }}" and "${{ github.ref_name }}" were interpolated
directly into bash if/elif checks and variable assignments across
image-build-and-publish.yml. Git ref names can contain shell
metacharacters, so a maliciously named branch or tag could inject
commands into these steps when the workflow is reached via
workflow_dispatch or a published release.

Use the runner's default $GITHUB_REF / $GITHUB_REF_NAME environment
variables instead, so ref values are passed as data rather than
expanded into the script text before the shell runs.

Addresses GHSA-g976-wp3r-q8c6.

Coverage Stats

83896 of 119597 relevant lines covered (70.15%)

98.37 hits per line

Coverage Regressions

Lines	Coverage	∆	File
3	79.14	-1.07%	pkg/vmcp/cli/embedding_manager.go
2	88.5	-0.22%	pkg/transport/proxy/transparent/transparent_proxy.go
2	82.27	-0.21%	pkg/vmcp/composer/workflow_engine.go

Jobs

ID	Job ID	Ran	Files	Coverage
1	31403161852.1	10 Aug 2026 03:29PM UTC	874	70.15	GitHub Action Run

stacklok / toolhive / 31403161852
71%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Coverage Regressions

Jobs

Source Files on build 31403161852

stacklok / toolhive / 31403161852 71%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Coverage Regressions

Jobs

Source Files on build 31403161852

stacklok / toolhive / 31403161852
71%

README BADGES
x