ceos/fastmcp
1
0
Fork 0
mirror of https://github.com/PrefectHQ/fastmcp.git synced 2026-08-09 07:09:11 +02:00
Code Issues Projects Releases Packages Wiki Activity

Security: Fix 3 findings in GitHub Actions workflows (#4183)

Browse source 
Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com>
This commit is contained in:
Jordan Ritter 2026-05-20 09:37:31 -07:00 • committed by GitHub
commit 1222e8e47a
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 14 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

7
.github/workflows/martian-triage-issue.yml vendored
View file

@ -46,6 +46,9 @@ jobs:
- name: Run Claude for Triage
uses: ./.github/actions/run-claude
env:
ISSUE_BODY: ${{ github.event.issue.body }}
ISSUE_TITLE: ${{ github.event.issue.title }}
with:
claude-oauth-token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
github-token: ${{ steps.marvin-token.outputs.token }}
@ -54,12 +57,12 @@ jobs:
<context>
Repository: ${{ github.repository }}
Issue Number: #${{ github.event.issue.number }}
Issue Title: ${{ github.event.issue.title }}
Issue Title: ${{ env.ISSUE_TITLE }}
Issue Author: ${{ github.event.issue.user.login }}
</context>
<issue_body>
${{ github.event.issue.body }}
${{ env.ISSUE_BODY }}
</issue_body>
<task>

7
.github/workflows/marvin-comment-on-issue.yml vendored
View file

@ -51,6 +51,9 @@ jobs:
- name: Run Claude for Issue Comment
uses: ./.github/actions/run-claude
env:
COMMENT_BODY: ${{ github.event.comment.body }}
ISSUE_TITLE: ${{ github.event.issue.title }}
with:
claude-oauth-token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
github-token: ${{ steps.marvin-token.outputs.token }}
@ -61,13 +64,13 @@ jobs:
<context>
Repository: ${{ github.repository }}
Issue Number: #${{ github.event.issue.number }}
Issue Title: ${{ github.event.issue.title }}
Issue Title: ${{ env.ISSUE_TITLE }}
Issue Author: ${{ github.event.issue.user.login }}
Comment Author: ${{ github.event.comment.user.login }}
</context>
<user_request>
${{ github.event.comment.body }}
${{ env.COMMENT_BODY }}
</user_request>
<task>

6
.github/workflows/marvin-comment-on-pr.yml vendored
View file

@ -72,6 +72,8 @@ jobs:
PR_REVIEW_HEAD_SHA: ${{ steps.pr-info.outputs.head_sha }}
PR_REVIEW_COMMENTS_DIR: /tmp/pr-review-comments
PR_REVIEW_HELPERS_DIR: ${{ github.workspace }}/.github/scripts/pr-review
COMMENT_BODY: ${{ github.event.comment.body }}
PR_TITLE: ${{ github.event.issue.title }}
with:
claude-oauth-token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
github-token: ${{ steps.marvin-token.outputs.token }}
@ -82,7 +84,7 @@ jobs:
<context>
Repository: ${{ github.repository }}
PR Number: #${{ steps.pr-info.outputs.pr_number }}
PR Title: ${{ github.event.issue.title }}
PR Title: ${{ env.PR_TITLE }}
PR Author: ${{ github.event.issue.user.login }}
Comment Author: ${{ github.event.comment.user.login }}
@ -90,7 +92,7 @@ jobs:
</context>
<user_request>
${{ github.event.comment.body }}
${{ env.COMMENT_BODY }}
</user_request>
<task>