fix(*): harden local service boundaries (#2062)

.github/workflows/deploy-cloudflare-workers-preview-deploy.yml

@@ -33,12 +33,25 @@ jobs:
       - name: Parse metadata
         id: meta
         run: |
-          source preview-meta/preview_meta
-          echo "PR_NUM=$PR_NUM" >> "$GITHUB_OUTPUT"
-          echo "REPO_FULL_NAME=$REPO_FULL_NAME" >> "$GITHUB_OUTPUT"
-          echo "HEAD_REF=$HEAD_REF" >> "$GITHUB_OUTPUT"
-          echo "HEAD_SHA=$HEAD_SHA" >> "$GITHUB_OUTPUT"
-          echo "BRANCH_NAME=$HEAD_REF" >> "$GITHUB_ENV"
+          node --input-type=module <<'NODE'
+          import { appendFile, readFile } from 'node:fs/promises'
+
+          const metadata = JSON.parse(await readFile('preview-meta/preview-meta.json', 'utf8'))
+          if (
+            !/^\d+$/.test(metadata.prNumber)
+            || !/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(metadata.repositoryFullName)
+            || !/^[a-f0-9]{40}$/i.test(metadata.headSha)
+          ) {
+            throw new Error('Preview metadata has an invalid shape')
+          }
+
+          await appendFile(process.env.GITHUB_OUTPUT, [
+            `PR_NUM=${metadata.prNumber}`,
+            `REPO_FULL_NAME=${metadata.repositoryFullName}`,
+            `HEAD_SHA=${metadata.headSha}`,
+            '',
+          ].join('\n'))
+          NODE
 
       - name: Find Comment
         if: ${{ always() }}
@@ -103,12 +116,25 @@ jobs:
       - name: Parse metadata
         id: meta
         run: |
-          source preview-meta/preview_meta
-          echo "PR_NUM=$PR_NUM" >> "$GITHUB_OUTPUT"
-          echo "REPO_FULL_NAME=$REPO_FULL_NAME" >> "$GITHUB_OUTPUT"
-          echo "HEAD_REF=$HEAD_REF" >> "$GITHUB_OUTPUT"
-          echo "HEAD_SHA=$HEAD_SHA" >> "$GITHUB_OUTPUT"
-          echo "BRANCH_NAME=$HEAD_REF" >> "$GITHUB_ENV"
+          node --input-type=module <<'NODE'
+          import { appendFile, readFile } from 'node:fs/promises'
+
+          const metadata = JSON.parse(await readFile('preview-meta/preview-meta.json', 'utf8'))
+          if (
+            !/^\d+$/.test(metadata.prNumber)
+            || !/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(metadata.repositoryFullName)
+            || !/^[a-f0-9]{40}$/i.test(metadata.headSha)
+          ) {
+            throw new Error('Preview metadata has an invalid shape')
+          }
+
+          await appendFile(process.env.GITHUB_OUTPUT, [
+            `PR_NUM=${metadata.prNumber}`,
+            `REPO_FULL_NAME=${metadata.repositoryFullName}`,
+            `HEAD_SHA=${metadata.headSha}`,
+            '',
+          ].join('\n'))
+          NODE
 
       - name: Checkout repository
         uses: actions/checkout@v6

.github/workflows/deploy-cloudflare-workers-preview-prepare.yml

@@ -14,17 +14,24 @@ jobs:
 
     steps:
       - name: Persist checkout metadata
+        env:
+          PR_NUM: ${{ github.event.number }}
+          REPO_FULL_NAME: ${{ github.event.pull_request.head.repo.full_name }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
         run: |
-          cat <<EOF > preview_meta
-          PR_NUM=${{ github.event.number }}
-          REPO_FULL_NAME=${{ github.event.pull_request.head.repo.full_name }}
-          HEAD_REF=${{ github.event.pull_request.head.ref }}
-          HEAD_SHA=${{ github.event.pull_request.head.sha }}
-          EOF
+          node --input-type=module <<'NODE'
+          import { writeFile } from 'node:fs/promises'
+
+          await writeFile('preview-meta.json', JSON.stringify({
+            prNumber: process.env.PR_NUM,
+            repositoryFullName: process.env.REPO_FULL_NAME,
+            headSha: process.env.HEAD_SHA,
+          }))
+          NODE
 
       - name: Upload metadata artifact
         uses: actions/upload-artifact@v7
         with:
           name: preview-meta
-          path: ./preview_meta
+          path: ./preview-meta.json
           overwrite: true

.github/workflows/release-docker.yaml

@@ -20,7 +20,7 @@ jobs:
       # failed to build archive at `/home/runner/work/airi/airi/target/x86_64-unknown-linux-gnu/release/deps/libapp_lib.rlib`:
       # No space left on device (os error 28)
       - name: Free Disk Space
-        uses: jlumbroso/free-disk-space@main
+        uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
 
       - uses: actions/checkout@v6
 

.github/workflows/release-tamagotchi.yml

@@ -103,7 +103,7 @@ jobs:
       # No space left on device (os error 28)
       - name: Free Disk Space
         if: matrix.os == 'ubuntu-latest' || matrix.os == 'ubuntu-24.04-arm'
-        uses: jlumbroso/free-disk-space@main
+        uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
 
       - uses: actions/checkout@v6
 

.github/workflows/update-nix-assets-hash.yaml

@@ -25,7 +25,7 @@ jobs:
       # > airi-pnpm-deps> Running phase: fixupPhase
       # > error: writing to file: No space left on device
       - name: Free Disk Space
-        uses: jlumbroso/free-disk-space@main
+        uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
 
       - uses: actions/checkout@v6
         with:

.github/workflows/update-nix-pnpm-deps-hash.yaml

@@ -24,7 +24,7 @@ jobs:
       # > airi-pnpm-deps> Running phase: fixupPhase
       # > error: writing to file: No space left on device
       - name: Free Disk Space
-        uses: jlumbroso/free-disk-space@main
+        uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
 
       - uses: actions/checkout@v6
         with: