Release version 1.3.1.17

.github/workflows/add-hotfix-metadata.yml

@@ -0,0 +1,57 @@
+name: Add HotFix Metadata
+
+on:
+  pull_request:
+    types: [opened, synchronize]
+    branches:
+      - master
+  workflow_dispatch:
+
+env:
+  GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+jobs:
+  get-version:
+    if: startsWith(github.head_ref, 'hotfix/')
+    uses: ./.github/workflows/step-version.yml
+
+  update-metadata:
+    if: github.event.action == 'opened'
+    needs: [get-version]
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
+        with:
+          ref: ${{ github.head_ref }}
+      - name: Increment Version
+        id: increment_version
+        run: |
+          echo "patch_version=$(($(cat semver.json | jq -r '.patch')+1))" > $GITHUB_OUTPUT
+      - name: Store New Version
+        uses: Afterlife-Guide/SemVer.Action@288a02559813fbd67393b5bd001cd796f1665905
+        with:
+          path: semver.json
+          major-version: ${{ needs.get-version.outputs.major }}
+          minor-version: ${{ needs.get-version.outputs.minor }}
+          patch-version: ${{ steps.increment_version.outputs.patch_version }}
+          build-version: ${{ github.run_number }}
+      - name: Update changelog
+        uses: baynezy/ChangeLogger.Action@f714b7a6bcb0610dedb551cdc16a5adc0a775972
+        with:
+          tag: ${{ needs.get-version.outputs.major }}.${{ needs.get-version.outputs.minor }}.${{ steps.increment_version.outputs.patch_version }}.${{ github.run_number }}
+
+      - name: Update docker image tag version in action.yml
+        run: |
+          sed -i "s/image: 'docker:\/\/ghcr.io\/afterlife-guide\/semver.action:.*/image: 'docker:\/\/ghcr.io\/afterlife-guide\/semver.action:${{ needs.get-version.outputs.major }}.${{ needs.get-version.outputs.minor }}.${{ steps.increment_version.outputs.patch_version }}.${{ github.run_number }}'/" action.yml
+
+      - name: Commit Changes
+        run: |
+          git config --global user.name "GitHub Action Bot"
+          git config --global user.email "no-reply@after-life.co"
+          git add CHANGELOG.md semver.json action.yml
+          git commit --message "Bump Version to ${{ needs.get-version.outputs.major }}.${{ needs.get-version.outputs.minor }}.${{ steps.increment_version.outputs.patch_version }}.${{ github.run_number }}"
+
+      - name: Push Version
+        env:
+          HEAD_REF: ${{ github.head_ref }}
+        run: git push origin "$HEAD_REF"

.github/workflows/branch-feature.yml

@@ -1,10 +1,10 @@
 name: Deploy Feature Branch
 
 on:
-  pull_request:
-    types: [opened, synchronize]
+  push:
     branches:
-      - develop
+      - feature/**
+      - copilot/**
     paths:
       - 'src/**'
       - 'test/**'
@@ -19,7 +19,6 @@ env:
 
 jobs:
   get-version:
-    if: startsWith(github.head_ref, 'feature/') || startsWith(github.head_ref, 'copilot/') || github.head_ref == 'master'
     uses: ./.github/workflows/step-version.yml
 
   build:

.github/workflows/branch-hotfix.yml

@@ -1,18 +1,16 @@
 name: Deploy HotFix Branch
 
 on:
-  pull_request:
-    types: [opened, synchronize]
+  push:
     branches:
-      - master
+      - hotfix/**
   workflow_dispatch:
 
 env:
   GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
 jobs:
   get-version:
-    if: startsWith(github.head_ref, 'hotfix/')
     uses: ./.github/workflows/step-version.yml
 
   build:
@@ -21,45 +19,4 @@ jobs:
     secrets: inherit
     with:
       version: ${{ needs.get-version.outputs.version }}
-      checkout-ref: ${{ github.head_ref }}
-
-  update-metadata:
-    if: github.event.action == 'opened'
-    needs: [get-version]
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
-        with:
-          ref: ${{ github.head_ref }}
-      - name: Increment Version
-        id: increment_version
-        run: |
-          echo "patch_version=$(($(cat semver.json | jq -r '.patch')+1))" > $GITHUB_OUTPUT
-      - name: Store New Version
-        uses: Afterlife-Guide/SemVer.Action@9102e863e95f47d9687e4bdd67efe81f8c0d1baf
-        with:
-          path: semver.json
-          major-version: ${{ needs.get-version.outputs.major }}
-          minor-version: ${{ needs.get-version.outputs.minor }}
-          patch-version: ${{ steps.increment_version.outputs.patch_version }}
-          build-version: ${{ github.run_number }}
-      - name: Update changelog
-        uses: baynezy/ChangeLogger.Action@3f2bcbe4fb234cdd1ba608c7384d6379568f43a0
-        with:
-          tag: ${{ needs.get-version.outputs.major }}.${{ needs.get-version.outputs.minor }}.${{ steps.increment_version.outputs.patch_version }}.${{ github.run_number }}
-
-      - name: Update docker image tag version in action.yml
-        run: |
-          sed -i "s/image: 'docker:\/\/ghcr.io\/afterlife-guide\/semver.action:.*/image: 'docker:\/\/ghcr.io\/afterlife-guide\/semver.action:${{ needs.get-version.outputs.major }}.${{ needs.get-version.outputs.minor }}.${{ steps.increment_version.outputs.patch_version }}.${{ github.run_number }}'/" action.yml
-
-      - name: Commit Changes
-        run: |
-          git config --global user.name "GitHub Action Bot"
-          git config --global user.email "no-reply@after-life.co"
-          git add CHANGELOG.md semver.json action.yml
-          git commit --message "Bump Version to ${{ needs.get-version.outputs.major }}.${{ needs.get-version.outputs.minor }}.${{ steps.increment_version.outputs.patch_version }}.${{ github.run_number }}"
-
-      - name: Push Version
-        env:
-          HEAD_REF: ${{ github.head_ref }}
-        run: git push origin "$HEAD_REF"
+      checkout-ref: ${{ github.head_ref }}

.github/workflows/branch-master.yml

@@ -41,7 +41,7 @@ jobs:
     needs: [push-package]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
       - name: Create Pull Request
         env:
           GH_TOKEN: ${{ secrets.CREATE_PR_TOKEN }}

.github/workflows/branch-release.yml

@@ -1,26 +1,16 @@
 name: Deploy Release Branch
 
 on:
-  pull_request:
-    types: [opened, synchronize]
+  push:
     branches:
-      - master
-      - develop
-    paths:
-      - 'src/**'
-      - 'test/**'
-      - '**.sln'
-      - '**.cake'
-      - '.github/workflows/branch-release.yml'
-      - '.github/workflows/step-*.yml'
+      - release/**
   workflow_dispatch:
 
 env:
   GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
 jobs:
   get-version:
-    if: startsWith(github.head_ref, 'release/')
     uses: ./.github/workflows/step-version.yml
 
   build:

.github/workflows/completed-feature-workflow.yml

@@ -14,16 +14,19 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
       - name: Extract Issue Number
         shell: bash
         env:
           HEAD_REF: ${{ github.head_ref }}
         run: echo "issue=$(echo "$HEAD_REF" | sed 's|[^0-9]||g')" >> $GITHUB_OUTPUT
         id: extract_issue
       - name: Output Issue Number
-        run: echo "Issue Number- ${{ steps.extract_issue.outputs.issue }}"
+        env:
+          ISSUE_NUMBER: ${{ steps.extract_issue.outputs.issue }}
+        run: echo "Issue Number- $ISSUE_NUMBER"
       - name: Update Labels
-        run: gh issue edit ${{ steps.extract_issue.outputs.issue }} --add-label "status:next release" --remove-label "status:in progress"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          ISSUE_NUMBER: ${{ steps.extract_issue.outputs.issue }}
+        run: gh issue edit $ISSUE_NUMBER --add-label "status:next release" --remove-label "status:in progress"

.github/workflows/draft-new-release.yml

@@ -22,12 +22,20 @@ jobs:
     name: "Draft a new release"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
+        with:
+          token: ${{ secrets.CREATE_PR_TOKEN }}
+          fetch-depth: 0
       - name: Create release branch
-        run: git checkout -b release/${{ github.event.inputs.major_version }}.${{ github.event.inputs.minor_version }}.${{ github.event.inputs.patch_version }}.${{ github.run_number }}
+        env:
+          MAJOR_VERSION: ${{ github.event.inputs.major_version }}
+          MINOR_VERSION: ${{ github.event.inputs.minor_version }}
+          PATCH_VERSION: ${{ github.event.inputs.patch_version }}
+          RUN_NUMBER: ${{ github.run_number }}
+        run: git checkout -b release/$MAJOR_VERSION.$MINOR_VERSION.$PATCH_VERSION.$RUN_NUMBER
 
       - name: Update Version Number
-        uses: Afterlife-Guide/SemVer.Action@9102e863e95f47d9687e4bdd67efe81f8c0d1baf
+        uses: Afterlife-Guide/SemVer.Action@288a02559813fbd67393b5bd001cd796f1665905
         with:
           path: semver.json
           major-version: ${{ github.event.inputs.major_version }}
@@ -36,36 +44,59 @@ jobs:
           build-version: ${{ github.run_number }}
 
       - name: Update changelog
-        uses: baynezy/ChangeLogger.Action@3f2bcbe4fb234cdd1ba608c7384d6379568f43a0
+        uses: baynezy/ChangeLogger.Action@f714b7a6bcb0610dedb551cdc16a5adc0a775972
         with:
           tag: ${{ github.event.inputs.major_version }}.${{ github.event.inputs.minor_version }}.${{ github.event.inputs.patch_version }}.${{ github.run_number }}
 
       - name: Update docker image tag version in action.yml
+        env:
+          MAJOR_VERSION: ${{ github.event.inputs.major_version }}
+          MINOR_VERSION: ${{ github.event.inputs.minor_version }}
+          PATCH_VERSION: ${{ github.event.inputs.patch_version }}
+          RUN_NUMBER: ${{ github.run_number }}
         run: |
-          sed -i "s/image: 'docker:\/\/ghcr.io\/afterlife-guide\/semver.action:.*/image: 'docker:\/\/ghcr.io\/afterlife-guide\/semver.action:${{ github.event.inputs.major_version }}.${{ github.event.inputs.minor_version }}.${{ github.event.inputs.patch_version }}.${{ github.run_number }}'/" action.yml
+          sed -i "s/image: 'docker:\/\/ghcr.io\/afterlife-guide\/semver.action:.*/image: 'docker:\/\/ghcr.io\/afterlife-guide\/semver.action:$MAJOR_VERSION.$MINOR_VERSION.$PATCH_VERSION.$RUN_NUMBER'/" action.yml
 
       - name: Commit changelog, manifest and action definition files
         id: make-commit
+        env:
+          MAJOR_VERSION: ${{ github.event.inputs.major_version }}
+          MINOR_VERSION: ${{ github.event.inputs.minor_version }}
+          PATCH_VERSION: ${{ github.event.inputs.patch_version }}
+          RUN_NUMBER: ${{ github.run_number }}
         run: |
           git config --global user.name "GitHub Action Bot"
           git config --global user.email "no-reply@after-life.co"
           git add CHANGELOG.md semver.json action.yml
-          git commit --message "Prepare release ${{ github.event.inputs.major_version }}.${{ github.event.inputs.minor_version }}.${{ github.event.inputs.patch_version }}.${{ github.run_number }}"
+          git commit --message "Prepare release $MAJOR_VERSION.$MINOR_VERSION.$PATCH_VERSION.$RUN_NUMBER"
 
           echo "commit=$(git rev-parse HEAD)" >> $GITHUB_OUTPUT
 
       - name: Push new branch
-        run: git push origin release/${{ github.event.inputs.major_version }}.${{ github.event.inputs.minor_version }}.${{ github.event.inputs.patch_version }}.${{ github.run_number }}
+        env:
+          MAJOR_VERSION: ${{ github.event.inputs.major_version }}
+          MINOR_VERSION: ${{ github.event.inputs.minor_version }}
+          PATCH_VERSION: ${{ github.event.inputs.patch_version }}
+          RUN_NUMBER: ${{ github.run_number }}
+        run: git push origin release/$MAJOR_VERSION.$MINOR_VERSION.$PATCH_VERSION.$RUN_NUMBER
 
       - name: Create pull request
         env:
           GH_TOKEN: ${{ secrets.CREATE_PR_TOKEN }}
+          ACTOR: ${{ github.actor }}
+          REPOSITORY: ${{ github.repository }}
+          RUN_ID: ${{ github.run_id }}
+          COMMIT_SHA: ${{ steps.make-commit.outputs.commit }}
+          MAJOR_VERSION: ${{ github.event.inputs.major_version }}
+          MINOR_VERSION: ${{ github.event.inputs.minor_version }}
+          PATCH_VERSION: ${{ github.event.inputs.patch_version }}
+          RUN_NUMBER: ${{ github.run_number }}
         run: |
-          echo -e "Hi @${{ github.actor }}!\n\nThis PR was created in response to a manual trigger of the release workflow here: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}.\nI've updated the changelog and bumped the versions in the manifest files in this commit: ${{ steps.make-commit.outputs.commit }}.\n\nMerging this PR will create a GitHub release and upload any assets that are created as part of the release build." > msg.txt
+          echo -e "Hi @$ACTOR!\n\nThis PR was created in response to a manual trigger of the release workflow here: https://github.com/$REPOSITORY/actions/runs/$RUN_ID.\nI've updated the changelog and bumped the versions in the manifest files in this commit: $COMMIT_SHA.\n\nMerging this PR will create a GitHub release and upload any assets that are created as part of the release build." > msg.txt
 
           export msg=$(cat msg.txt) ; gh pr create \
-          --head release/${{ github.event.inputs.major_version }}.${{ github.event.inputs.minor_version }}.${{ github.event.inputs.patch_version }}.${{ github.run_number }} \
+          --head release/$MAJOR_VERSION.$MINOR_VERSION.$PATCH_VERSION.$RUN_NUMBER \
           --base master \
-          --title "Release version ${{ github.event.inputs.major_version }}.${{ github.event.inputs.minor_version }}.${{ github.event.inputs.patch_version }}.${{ github.run_number }}" \
-          --reviewer ${{ github.actor }} \
+          --title "Release version $MAJOR_VERSION.$MINOR_VERSION.$PATCH_VERSION.$RUN_NUMBER" \
+          --reviewer $ACTOR \
           --body "$msg"

.github/workflows/in-progress-feature-workflow.yml

@@ -13,14 +13,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
       - name: Extract Issue Number
         shell: bash
         run: echo "issue=$(echo ${GITHUB_REF#refs/heads/} | sed 's|[^0-9]||g')" >> $GITHUB_OUTPUT
         id: extract_issue
       - name: Output Issue Number
-        run: echo "Issue Number- ${{ steps.extract_issue.outputs.issue }}"
+        env:
+          ISSUE_NUMBER: ${{ steps.extract_issue.outputs.issue }}
+        run: echo "Issue Number- $ISSUE_NUMBER"
       - name: Update Labels
-        run: gh issue edit ${{ steps.extract_issue.outputs.issue }} --add-label "in progress" --remove-label "to do"
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          ISSUE_NUMBER: ${{ steps.extract_issue.outputs.issue }}
+        run: gh issue edit $ISSUE_NUMBER --add-label "in progress" --remove-label "to do"

.github/workflows/label-configurer.yml

@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
       - name: Run Labeler
         uses: crazy-max/ghaction-github-labeler@24d110aa46a59976b8a7f35518cb7f14f434c916
         with:

.github/workflows/step-build.yml

@@ -18,11 +18,11 @@ jobs:
       run: |
         echo "Branch: ${{ inputs.checkout-ref }}"
     - name: Checkout
-      uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
       with:
         ref: ${{ inputs.checkout-ref }}
     - name: Setup .NET Core
-      uses: actions/setup-dotnet@d4c94342e560b34958eacfc5d055d21461ed1c5d
+      uses: actions/setup-dotnet@2016bd2012dba4e32de620c46fe006a3ac9f0602
       with:
         dotnet-version: 10.0.x
     - name: Restore

.github/workflows/step-tag-release.yml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
       - name: Create tag
         run: |
           git config --global user.name "GitHub Action Bot"

.github/workflows/step-version.yml

@@ -34,10 +34,10 @@ jobs:
       build: ${{ steps.set-version.outputs.build }}
     steps:
       - name: Get Code
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
       - name: Get Version
         id: get-version
-        uses: Afterlife-Guide/SemVer.Action@9102e863e95f47d9687e4bdd67efe81f8c0d1baf
+        uses: Afterlife-Guide/SemVer.Action@288a02559813fbd67393b5bd001cd796f1665905
         with:
           path: 'semver.json'
       - id: set-version

CHANGELOG.md

@@ -7,6 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.3.1.17] - 2025-12-10
+
+### Fixed
+
+- Bug with deployment (#306)
+
+### Security
+
+- Fixed command injection vulnerabilities in GitHub Actions workflows by moving user-controlled data to environment variables instead of using them directly in run blocks (#300)
+
 ## [1.3.0.15] - 2025-11-18
 
 ### Changed
@@ -85,7 +95,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [0.1.0.1] - 2024-03-22
 
-[unreleased]: https://github.com/Afterlife-Guide/SemVer.Action/compare/1.3.0.15...HEAD
+[unreleased]: https://github.com/Afterlife-Guide/SemVer.Action/compare/1.3.1.17...HEAD
+[1.3.1.17]: https://github.com/Afterlife-Guide/SemVer.Action/compare/1.3.0.15...1.3.1.17
 [1.3.0.15]: https://github.com/Afterlife-Guide/SemVer.Action/compare/1.2.2.14...1.3.0.15
 [1.2.2.14]: https://github.com/Afterlife-Guide/SemVer.Action/compare/1.2.1.19...1.2.2.14
 [1.2.1.19]: https://github.com/Afterlife-Guide/SemVer.Action/compare/1.2.0.13...1.2.1.19