MHSanaei 659f0f404c fix(ci): stop executing tag-checkout code in the release smoke test ...

CodeQL alert 99 (actions/cache-poisoning/poisonable-step): the workflow_run
job runs in the default branch's cache scope, so checking out
workflow_run.head_sha and executing a script from it is a cache-poisoning
surface. The if-guard (event == 'push') already kept fork PRs out, but the
checkout pin was never the load-bearing part of the release verification —
the version argument is, since install.sh downloads that exact release
binary. Run the smoke script from the default branch instead, which also
matches what real users execute.

2026-07-07 01:23:10 +02:00

2.3 KiB

Raw Blame History

View Raw