fix: adversary 跨仓重定位 env 间接化（zizmor high）

[randypanding]

PR#98 引入的 XT_REPO 行内插值触发 zizmor template-injection high（run 块内 ${{ }}）。改 env 间接（XT_REPO_IN），语义零变化。CIW hygiene exit 14 实测暴露。

Summary by CodeRabbit

• 安全性改进
  • 优化跨仓库目标路径的配置读取方式，减少配置注入风险。
  • 保持跨仓库目标统一定位至 external-target/，路径校验行为不变。

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 90385fb2-0e29-405a-a6c1-30c074c975f9

📥 Commits

Reviewing files that changed from the base of the PR and between b480224 and 761fef1.

📒 Files selected for processing (1)

• .github/workflows/adversary.yml

---

📝 Walkthrough

Walkthrough

Changes

跨仓目标路径处理

Layer / File(s)	Summary
基于环境变量的目标解析 .github/workflows/adversary.yml	跨仓目标仓配置通过 XT_REPO_IN 环境变量传入。目标仓存在时，目标路径仍添加 external-target/ 前缀。

Suggested labels: security, bug

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch zizmor-xt-repo

---

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-code-review]

PR Summary by Qodo

Fix zizmor template-injection in adversary workflow via env indirection

🐞 Bug fix ⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Remove inline ${{ }} interpolation from the run block to satisfy zizmor template-injection
 checks
• Introduce XT_REPO_IN env indirection for cross-repo target relocation without behavior change
• Keep ADR-0085 external-target prefix rewrite semantics and existing path validation intact

Diagram

graph TD
  A["Workflow inputs / payload"] --> B["Step env (XT_REPO_IN)"] --> C["Bash: parse target"] --> D["GITHUB_OUTPUT target"]

  subgraph Legend
    direction LR
    _cfg["Workflow config"] ~~~ _proc["Run step"]
  end

Loading

High-Level Assessment

The chosen approach (env indirection) is the lowest-risk fix: it removes ${{ }} from the bash body to satisfy zizmor while keeping ADR-0085 semantics unchanged. Alternatives like moving logic into a checked-in script/action or rewriting control flow purely in YAML would add churn without improving security meaningfully beyond the current mitigation.

Files changed (1) +3 / -2

Bug fix (1) +3 / -2

adversary.ymlMove XT_REPO expression into env to avoid run-block interpolation +3/-2

Move XT_REPO expression into env to avoid run-block interpolation

• Adds 'XT_REPO_IN' in the step environment and switches the cross-repo relocation check to test that env var. Removes the inline '${{ ... }}' assignment from the 'run' script to address zizmor template-injection (high) without changing behavior.

.github/workflows/adversary.yml

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📜 Skill insights (0)

1. Misleading “no interpolation” comment 🐞 Bug ⚙ Maintainability

Description

The new comment claims the run body has “正文零插值”, but the script still contains a ${{
github.event_name }} template expansion in the run block, so the statement is false and can
re-trigger zizmor template-injection under stricter personas (e.g., pedantic). This mismatch
increases future maintenance risk and weakens the intended “no template in run” invariant.

Code

.github/workflows/adversary.yml[R118-119]

+          # zizmor template-injection：表达式一律经 env 间接（XT_REPO_IN），正文零插值
+          if [[ -n "${XT_REPO_IN:-}" ]]; then

Relevance

●● Moderate

Comment is misleading but the ${{ github.event_name }} expansion is a pre-existing unrelated line,
not introduced here.

PR-#92

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The PR adds a comment asserting “正文零插值”, but the same run block still contains a `${{
github.event_name }}` expansion. zizmor’s documentation shows that under the pedantic persona, even
non-attacker-controlled ${{ }} expansions inside run: are flagged as template-injection,
making the comment and intended invariant brittle.

.github/workflows/adversary.yml[111-121]
.github/workflows/adversary.yml[113-116]
🌐 Documents that the pedantic persona flags template-injection for any template expansion inside a run: block, even for ${{ github.event_name }}.

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
A newly added comment states the `run:` body contains no `${{ }}` template expansions, but the script still uses `${{ github.event_name }}` inside the run block. This is misleading and can re-surface `template-injection` findings if zizmor is run in a stricter persona.

### Issue Context
This workflow already follows the pattern “template values via env, not interpolated in shell” elsewhere in the repo, and the comment suggests this step follows the same invariant.

### Fix Focus Areas
- .github/workflows/adversary.yml[108-122]

### Suggested change
1. Add an env var like `EVENT_NAME: ${{ github.event_name }}` in the step’s `env:`.
2. Replace `if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then` with `if [[ "$EVENT_NAME" == "workflow_dispatch" ]]; then`.
3. Either remove or reword the comment to match reality (e.g., “untrusted expressions are env-indirected”).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context sources

✅ Web pages:

  🌐 docs/usage.md

  🌐 crates/zizmor/src/audit/template_injection.rs at main · zizmorcore/zizmor

  🌐 feat: handle default envvars when fixing template injections

  +2 more

Review mode: ⚖️ Balanced: This is a security-sensitive GitHub Actions workflow change addressing template injection; despite the tiny, localized diff, it warrants a complete single-pass review.

Tip of the day

💡 Did you know, you can hide the parts of a finding you never read, like the evidence or the agent prompt

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[qodo-code-review]

1. Misleading “no interpolation” comment 🐞 Bug ⚙ Maintainability

The new comment claims the run body has “正文零插值”, but the script still contains a ${{
github.event_name }} template expansion in the run block, so the statement is false and can
re-trigger zizmor template-injection under stricter personas (e.g., pedantic). This mismatch
increases future maintenance risk and weakens the intended “no template in run” invariant.

Agent Prompt

### Issue description
A newly added comment states the `run:` body contains no `${{ }}` template expansions, but the script still uses `${{ github.event_name }}` inside the run block. This is misleading and can re-surface `template-injection` findings if zizmor is run in a stricter persona.

### Issue Context
This workflow already follows the pattern “template values via env, not interpolated in shell” elsewhere in the repo, and the comment suggests this step follows the same invariant.

### Fix Focus Areas
- .github/workflows/adversary.yml[108-122]

### Suggested change
1. Add an env var like `EVENT_NAME: ${{ github.event_name }}` in the step’s `env:`.
2. Replace `if [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then` with `if [[ "$EVENT_NAME" == "workflow_dispatch" ]]; then`.
3. Either remove or reword the comment to match reality (e.g., “untrusted expressions are env-indirected”).

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools