ci: fix tarball workflow — real build scripts + parametrized notes

[StevenMend]

The cut-dojo-tarball.yml one-shot referenced scripts/build-all.mjs, which does not exist on main — dispatch run 30116666722 failed on that step. The fork builds with pnpm build + pnpm ui:build; notes are now a dispatch input instead of a hardcoded old fix line.

Created by Claude Code on behalf of @StevenMendez

🤖 Generated with Claude Code

[dojo-code-reviewer]

🔴 Changes Requested

Changes requested — 1 blocker. Confidence: 1.00/5.00.

Walkthrough

⚠️ GOVERNANCE WARNING: This pull request targets the main branch directly. Per standard GitFlow practices, the development flow should go from feature branch → develop branch → main branch. This warning is informative only and does not influence the code quality/security review verdict.

Walkthrough

This PR fixes the cut-dojo-tarball.yml CI workflow by replacing obsolete and non-existent build scripts (scripts/build-all.mjs and scripts/ui.js) with standard, package-manager-configured build scripts (pnpm build and pnpm ui:build). It also introduces a notes parameter to the workflow_dispatch trigger, allowing the user to provide customized, one-line release notes during the workflow invocation instead of using a hardcoded message.

Files/Areas Reviewed

I reviewed the changed file .github/workflows/cut-dojo-tarball.yml and cross-referenced the root package.json to verify the existence and behavior of the build and ui:build scripts.

Safety Rationale

This PR is currently NOT safe to merge due to a severe security risk. Direct shell expansion of untrusted workflow_dispatch inputs (notes and tag) inside the run: block of the publish release step introduces an arbitrary command injection vulnerability.

Changes requested — 1 blocker.

🔴 P1 — Blockers

• .github/workflows/cut-dojo-tarball.yml:45 — 🔴 P1 (blocker) — Arbitrary shell command injection vulnerability detected. Directly expanding GitHub Actions expressions like ${{ inputs.notes }} and ${{ inputs.tag }} inside a run: block allows malicious input values (e.g., carrying quotes, semicolons, or shell metacharacters) to break out of the string context and execute arbitrary shell commands on the runner.

To resolve this safely, map the inputs to step-level environment variables (env:) and reference them inside the script using standard shell variable expansion ($VARIABLE).

Here is the secure implementation of this step:

      - name: Publish release
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ inputs.tag }}
          RELEASE_NOTES: ${{ inputs.notes }}
          TGZ_FILE: ${{ steps.pack.outputs.tgz }}
        run: |
          gh release create "$RELEASE_TAG" "$TGZ_FILE" \
            --title "$RELEASE_TAG" \
            --notes "$RELEASE_NOTES"
          echo "SHA256 for the plugin Dockerfile ARG:"
          sha256sum "$TGZ_FILE"

[pass 1]

---

Total findings: 1 security (1 total)

[dojo-code-reviewer]

🔴 P1 (blocker) — Arbitrary shell command injection vulnerability detected. Directly expanding GitHub Actions expressions like ${{ inputs.notes }} and ${{ inputs.tag }} inside a run: block allows malicious input values (e.g., carrying quotes, semicolons, or shell metacharacters) to break out of the string context and execute arbitrary shell commands on the runner.

To resolve this safely, map the inputs to step-level environment variables (env:) and reference them inside the script using standard shell variable expansion ($VARIABLE).

Here is the secure implementation of this step:

      - name: Publish release
        env:
          GH_TOKEN: ${{ github.token }}
          RELEASE_TAG: ${{ inputs.tag }}
          RELEASE_NOTES: ${{ inputs.notes }}
          TGZ_FILE: ${{ steps.pack.outputs.tgz }}
        run: |
          gh release create "$RELEASE_TAG" "$TGZ_FILE" \
            --title "$RELEASE_TAG" \
            --notes "$RELEASE_NOTES"
          echo "SHA256 for the plugin Dockerfile ARG:"
          sha256sum "$TGZ_FILE"

[pass 1]