Skip to content

Fix build workflow failures, add workflow_dispatch trigger, and resolve merge conflicts #44

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mapitman merged 6 commits into from
Dec 15, 2025
Merged

Fix build workflow failures, add workflow_dispatch trigger, and resolve merge conflicts #44

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
c1fd679
Initial plan
Copilot Dec 15, 2025
0f6b0b5
fix(ci): add workflow_dispatch trigger with version input to build wo…
Copilot Dec 15, 2025
41fbafb
fix: correct tar transform syntax to use proper sed-style delimiters
Copilot Dec 15, 2025
fa0745e
fix(ci): sanitize VERSION to replace slashes with dashes
Copilot Dec 15, 2025
6a443e4
Merge branch 'fedora-package' into copilot/sub-pr-43
Copilot Dec 15, 2025
e352cda
refactor(ci): remove redundant VERSION sanitization from workflow
Copilot Dec 15, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions .github/workflows/build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,12 @@ name: Build

on:
push:
workflow_dispatch:
inputs:
version:
description: 'Version to build (e.g., 1.0.0)'
required: false
type: string

jobs:
build-linux:
Expand Down
12 changes: 6 additions & 6 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,17 +42,17 @@ snap:
bin/linux-amd64/mdview: manpage
env GOOS=linux GOARCH=amd64 go build -buildvcs=false -ldflags "-X main.appVersion=$(VERSION)" -o ./bin/linux-amd64/mdview
cp mdview.1 bin/linux-amd64/
tar czvf mdview-$(VERSION_SAFE)-linux-amd64.tar.gz --transform s/linux-amd64/mdview-$(VERSION_SAFE)/ -C bin linux-amd64
tar czvf mdview-$(VERSION_SAFE)-linux-amd64.tar.gz --transform 's,^linux-amd64,mdview-$(VERSION_SAFE),' -C bin linux-amd64

bin/linux-i386/mdview:
env GOOS=linux GOARCH=386 go build -buildvcs=false -ldflags "-X main.appVersion=$(VERSION)" -o ./bin/linux-i386/mdview
cp mdview.1 bin/linux-i386/
tar czvf mdview-$(VERSION_SAFE)-linux-i386.tar.gz --transform s/linux-i386/mdview-$(VERSION_SAFE)/ -C bin linux-i386
tar czvf mdview-$(VERSION_SAFE)-linux-i386.tar.gz --transform 's,^linux-i386,mdview-$(VERSION_SAFE),' -C bin linux-i386

bin/linux-arm64/mdview:
env GOOS=linux GOARCH=arm64 go build -buildvcs=false -ldflags "-X main.appVersion=$(VERSION)" -o ./bin/linux-arm64/mdview
cp mdview.1 bin/linux-arm64/
tar czvf mdview-$(VERSION_SAFE)-linux-arm64.tar.gz --transform s/linux-arm64/mdview-$(VERSION_SAFE)/ -C bin linux-arm64
tar czvf mdview-$(VERSION_SAFE)-linux-arm64.tar.gz --transform 's,^linux-arm64,mdview-$(VERSION_SAFE),' -C bin linux-arm64
Comment on lines +45 to +55
Copy link

Copilot AI Dec 15, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The use of $(VERSION_SAFE) unquoted in these tar commands makes the build vulnerable to shell command injection if VERSION can be influenced (for example via a workflow version input or a branch name). VERSION_SAFE only replaces /, so characters like ;, &, backticks or ' can break the command line or the quoted --transform argument and execute arbitrary commands in the build environment. To mitigate this, constrain VERSION/VERSION_SAFE to a strict safe character set before using it in shell commands (or avoid shell interpretation entirely) and apply the same hardening to all similar packaging commands.

Copilot uses AI. Check for mistakes.

bin/windows-amd64/mdview.exe:
env GOOS=windows GOARCH=amd64 go build -buildvcs=false -ldflags "-X main.appVersion=$(VERSION)" -o ./bin/windows-amd64/mdview.exe
Expand All @@ -61,17 +61,17 @@ bin/windows-amd64/mdview.exe:
bin/darwin-amd64/mdview:
env GOOS=darwin GOARCH=amd64 go build -buildvcs=false -ldflags "-X main.appVersion=$(VERSION)" -o ./bin/darwin-amd64/mdview
cp mdview.1 bin/darwin-amd64/
tar czvf mdview-$(VERSION_SAFE)-darwin-amd64.tar.gz --transform s/darwin-amd64/mdview-$(VERSION_SAFE)/ -C bin darwin-amd64
tar czvf mdview-$(VERSION_SAFE)-darwin-amd64.tar.gz --transform 's,^darwin-amd64,mdview-$(VERSION_SAFE),' -C bin darwin-amd64

bin/darwin-arm64/mdview:
env GOOS=darwin GOARCH=arm64 go build -buildvcs=false -ldflags "-X main.appVersion=$(VERSION)" -o ./bin/darwin-arm64/mdview
cp mdview.1 bin/darwin-arm64/
tar czvf mdview-$(VERSION_SAFE)-darwin-arm64.tar.gz --transform s/darwin-arm64/mdview-$(VERSION_SAFE)/ -C bin darwin-arm64
tar czvf mdview-$(VERSION_SAFE)-darwin-arm64.tar.gz --transform 's,^darwin-arm64,mdview-$(VERSION_SAFE),' -C bin darwin-arm64

bin/freebsd-amd64/mdview:
env GOOS=freebsd GOARCH=amd64 go build -buildvcs=false -ldflags "-X main.appVersion=$(VERSION)" -o ./bin/freebsd-amd64/mdview
cp mdview.1 bin/freebsd-amd64/mdview
tar czvf mdview-$(VERSION_SAFE)-freebsd-amd64.tar.gz --transform s/freebsd-amd64/mdview-$(VERSION_SAFE)/ -C bin freebsd-amd64
tar czvf mdview-$(VERSION_SAFE)-freebsd-amd64.tar.gz --transform 's,^freebsd-amd64,mdview-$(VERSION_SAFE),' -C bin freebsd-amd64
Comment on lines +64 to +74
Copy link

Copilot AI Dec 15, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As above, $(VERSION_SAFE) is interpolated directly into these tar invocations without strong sanitization or quoting, so an attacker who can control VERSION (e.g. via workflow inputs or crafted ref names) can inject shell metacharacters and gain code execution during the build. Because VERSION_SAFE only removes /, values containing ;, &, backticks, spaces or ' can break the command line and --transform expression and run arbitrary commands. This should be fixed by restricting VERSION/VERSION_SAFE to a safe regex (e.g. alphanumerics plus a small set of delimiters) before using it in shell commands, and by reviewing other archive/packaging commands in this Makefile for the same pattern.

Copilot uses AI. Check for mistakes.

clean:
rm -rf bin
Expand Down