chore(ci): generate release notes without Claude (ST-482) - #1496
Merged
Matus Tomlein (matus-tomlein) merged 1 commit intoJul 30, 2026
Merged
Conversation
Wiz flagged the prepare-release workflow as a publicly exposed workflow
with access to secrets that is vulnerable to script injection (ST-482).
Claude Code should not run in public repos, so replace the two LLM calls
with deterministic shell scripts and remove ANTHROPIC_API_KEY from the job.
The PR body is now generated by scripts; changelogs remain owned by rush.
Commits are classified by:
1. Conventional-commit prefix (feat/fix/perf/refactor; "!" or a
BREAKING CHANGE marker promotes to breaking).
2. A leading imperative verb, for the many commits in this repo that
predate conventional commits (adoption is currently well under 25%,
so a prefix-only classifier would put most changes in one bucket).
3. Anything left over becomes "Enhancements".
Chore commits (ci/docs/test/build/style, release automation) are skipped,
matching the previous prompt behaviour and the existing release notes.
Also move every workflow input out of inline ${{ }} interpolation and into
env: vars referenced as "$VAR". Splicing an input directly into a run:
block is the script-injection sink Wiz reported; these workflows are
workflow_dispatch-only, so the input is not attacker-controlled via pull
requests, but the pattern is fixed regardless.
Verified by regenerating past releases from real history and diffing
against the shipped release notes.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Matus Tomlein (matus-tomlein)
deleted the
chore/prepare-release-without-claude
branch
July 30, 2026 10:13
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Replaces the Claude Code call in the
Prepare release PRworkflow with deterministic shell scripts, and removesANTHROPIC_API_KEYfrom the job.Addresses ST-482, a Wiz finding on this repo: "Publicly exposed CI workflow with access to secrets vulnerable to script injection". Claude Code should not run in publicly exposed repos.
How commits are classified
feat:→ New features,fix:→ Bug fixes,perf:/refactor:→ Improvements. A!before the colon or aBREAKING CHANGEmarker promotes the commit to a Breaking changes section.Fix|Resolve|Handle|…→ Bug fixes,Add|Introduce|Support|…→ New features,Improve|Update|Migrate|…→ Improvements. This fallback exists because conventional-commit adoption in this repo is currently well under 25%; a prefix-only classifier would put the large majority of real changes into a single bucket, including obvious bug fixes.Chore commits (
ci/docs/test/build/style, plus release-automation subjects likePrepare for …) are skipped, matching both the previous prompt instructions and the existing release notes.New scripts in
.github/scripts/:classify-commits.shformat-pr-body.shScript injection hardening
Every workflow input is moved out of inline
${{ }}interpolation intoenv:vars referenced as"$VAR". Splicing an input directly into arun:block is the injection sink Wiz reported.Worth noting for triage: the exploit path in the Wiz description ("attackers can exploit this by submitting crafted pull requests, e.g. with malicious titles") does not apply here. This workflow is
workflow_dispatch-only — there is nopull_requestorissue_commenttrigger, so the only injectable input isrelease_branch, which requires write access to set and is regex-validated against^release/X\.Y\.Z$before use. The pattern is fixed regardless, but the CRITICAL rating rested on a vector this workflow did not have.Verification
Past releases were regenerated from real git history and diffed against the shipped release notes. Remaining differences are cases where a human reworded a commit subject when writing the notes by hand — the scripts faithfully reproduce the commit subject instead.
shellcheckis clean.Follow-up
Once this is merged, the now-unused secret should be deleted:
🤖 Generated with Claude Code