Word splitting divides an unquoted shell variable into separate words or arguments at whitespace or other delimiters. Quoting the variable prevents this behavior when values contain spaces or special characters. section 10.2
In GitHub Actions workflows, unquoted variables can cause:
- Unexpected argument boundaries when values contain spaces or special characters. section 10.2
- Shell-injection vulnerabilities when expanded input contains a malicious command. section 10.2
- Lint warnings from actionlint or ShellCheck when scripts leave variables unquoted. section 10.2
Safely printing an issue title
Pass workflow input through an environment variable and quote it at the shell boundary: env: TITLE: ${{ github.event.issue.title }}; run: echo "$TITLE". An unquoted expansion can split the title or execute injected shell syntax. section 10.2
Listing 10.4 Action linting workflow to prevent known vulnerabilities
on:
pullrequest:
jobs:
run-actionlint:
runs-on: ubuntu-latest
permissions:
# Needed for the checkout action
contents: read
# Needed to annotate the files in a pull request with comments
pull-requests: write
steps:
# Checkout the source code to analyze.
- uses: actions/checkout@v3
# Runs the actionlinter, which will fail on errors
- uses: devops-actions/actionlint@c0ee017f8abef55d843a647cd737b87a1976eb69
Use actionlint in a pull-request workflow to detect unquoted variables and other workflow vulnerabilities before they reach execution. section 10.2
