From 101be2efd45d9b5887a36d53241f9a549c4bbbf7 Mon Sep 17 00:00:00 2001
From: Jiralite <33201955+Jiralite@users.noreply.github.com>
Date: Sun, 28 Jun 2026 01:54:02 +0100
Subject: [PATCH] ci: safe usage of inputs (#1204)

Co-authored-by: Hampus <hampus@fluxer.app>
---
 .github/workflows/deploy-service.yaml         | 21 +++++++++++++------
 .../repair-static-asset-metadata.yaml         |  4 +++-
 2 files changed, 18 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/deploy-service.yaml b/.github/workflows/deploy-service.yaml
index 812ca92f9..305be7323 100644
--- a/.github/workflows/deploy-service.yaml
+++ b/.github/workflows/deploy-service.yaml
@@ -101,19 +101,26 @@ jobs:
 
       - name: configure kubectl
         shell: bash
+        env:
+          KUBE_CONFIG_B64: ${{ secrets.KUBE_CONFIG }}
         run: |
           mkdir -p "$HOME/.kube"
-          echo "${{ secrets.KUBE_CONFIG }}" | base64 -d > "$HOME/.kube/config"
+          printf '%s' "$KUBE_CONFIG_B64" | base64 -d > "$HOME/.kube/config"
           chmod 600 "$HOME/.kube/config"
 
       - name: resolve helm args
         id: helm
         shell: bash
+        env:
+          INPUT_SERVICE: ${{ inputs.service }}
+          INPUT_CHANNEL: ${{ inputs.channel }}
+          INPUT_IMAGE_TAG: ${{ inputs['image-tag'] }}
+          INPUT_BUILD_VERSION: ${{ inputs['build-version'] }}
         run: |
-          SERVICE="${{ inputs.service }}"
-          CHANNEL="${{ inputs.channel }}"
-          TAG="${{ inputs['image-tag'] }}"
-          BUILD_VERSION="${{ inputs['build-version'] }}"
+          SERVICE="$INPUT_SERVICE"
+          CHANNEL="$INPUT_CHANNEL"
+          TAG="$INPUT_IMAGE_TAG"
+          BUILD_VERSION="$INPUT_BUILD_VERSION"
           GHCR_REGISTRY="${GHCR_REGISTRY:?GHCR_REGISTRY is required}"
           if [[ -z "$BUILD_VERSION" ]]; then
             BUILD_VERSION="$TAG"
@@ -347,9 +354,11 @@ jobs:
       - name: approve api image for admission policy
         if: ${{ inputs.service == 'api' }}
         shell: bash
+        env:
+          INPUT_CHANNEL: ${{ inputs.channel }}
         run: |
           DEPLOYMENT="api"
-          if [[ "${{ inputs.channel }}" == "canary" ]]; then
+          if [[ "$INPUT_CHANNEL" == "canary" ]]; then
             DEPLOYMENT="api-canary"
           fi
           IMAGE_REF="${GHCR_REGISTRY}/${{ steps.helm.outputs.deploy-image }}:${{ steps.helm.outputs.deploy-tag }}"
diff --git a/.github/workflows/repair-static-asset-metadata.yaml b/.github/workflows/repair-static-asset-metadata.yaml
index 3945bad53..e6e38caab 100644
--- a/.github/workflows/repair-static-asset-metadata.yaml
+++ b/.github/workflows/repair-static-asset-metadata.yaml
@@ -31,7 +31,9 @@ jobs:
           toolchain: 1.93.0
 
       - name: Repair app asset metadata
+        env:
+          REPAIR_PREFIX: ${{ inputs.prefix }}
         run: >-
           cargo run --locked --quiet --manifest-path tools/ci/Cargo.toml -- repair-static-asset-metadata
           --bucket "${STATIC_BUCKET}"
-          --prefix "${{ inputs.prefix }}"
+          --prefix "${REPAIR_PREFIX}"