Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

CI and script hygiene: pass head_ref via env, remove Invoke-Expression from utils.ps1

Open Beginner friendly
#3,118 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
75/100
Issue type
Refactor
Clarity
Clearly specified
Activity status
Active
Tech stack
github-actions, powershell
Domain
ci-cd, security

Research direction

The issue points to specific lines in .github/workflows/build.yml, tests.yml, codeql.yml and scripts/utils.ps1. First, read the linked lines to understand the current code. For the workflows, change the syntax to pass github.head_ref via an environment variable. In utils.ps1, replace Invoke-Expression calls with direct invocation (e.g., & 7z ...). Also consider adding a name validation regex in build.ps1. Test by running the scripts locally or checking CI runs after changes.

Written by the indexing model from the issue text.

Description

Summary

Two small hygiene fixes in the CI workflows and build scripts. Neither is exploitable today, but both are easy to get wrong later.

1. Pass github.head_ref through env: in workflows

build.yml, tests.yml and codeql.yml paste the PR branch name straight into a PowerShell double-quoted string:

$headRef = "${{ github.head_ref }}"

Git branch names may contain $(...), which PowerShell evaluates inside double quotes. These workflows run on pull_request, so fork PRs get a read-only token and already run their own scripts, so nothing is gained today. It would become a real injection if any of them moved to pull_request_target or gained secrets. GitHub's recommended pattern:

env:
  HEAD_REF: ${{ github.head_ref }}
run: |
  $headRef = $env:HEAD_REF

2. Replace Invoke-Expression in scripts/utils.ps1

Extract-Archive, Create-Archive, Digest-Hash and Get-VersionStr build command strings and run them with Invoke-Expression (utils.ps1#L73, #L84, #L108, #L149-L152). The name values from sources.json (or a custom -SourcesPath) end up in those strings, so a name containing $(...) would run as code. The same names are also passed to Remove-Item -Recurse -Force, so a name like ..\.. would delete outside vendor/.

Suggested changes:

  • Call the tools directly, e.g. & 7z x -y "-o$target" $source.
  • Validate name against something like ^[A-Za-z0-9._-]+$ in build.ps1.
Dominant language
PowerShell
Stars
27k
Forks
2.1k
PR merge metrics
No merged PRs in 30d

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from cmderdev/cmder

All issues in cmderdev/cmder

Similar issues

More DevOps issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.