ci: harden preview/deploy workflows (script injection, curl|sh, secret scoping)

[ital0]

Fixes 10 open code-scanning alerts on the preview/deploy CI surface: #90, #60, #77, #40, #86, #81, #76, #78, #79, #80, plus follow-up alert #102 raised on this PR.

Changes

Script injection (alerts 60, 40) — ${{ inputs.stack_name }} in stack-deploy.yml's destroy job and ${{ github.base_ref }} in pr-metrics.yml were interpolated directly into run: scripts. Both now go through quoted env: variables, matching the INPUT_* pattern already used everywhere else in these files.

curl | sh removal (alerts 90, 77) — the destroy path of stack-deploy.yml and preview-cleanup.yml installed Pulumi via curl -fsSL https://get.pulumi.com | sh. The Pulumi CLI is preinstalled on ubuntu-latest runners — the deploy job of stack-deploy.yml already relies on that (it runs pulumi stack select with no install step). The installs were redundant and are removed.

PULUMI_ACCESS_TOKEN scoping (alerts 86, 81, 76) — moved from workflow-level env: to step-level env: on exactly the steps that run Pulumi, in stack-deploy.yml, previews-shared-deploy.yml and preview-cleanup.yml.

secrets: inherit → explicit maps (alerts 78, 79, 80) — stack-deploy.yml now declares 11 secrets in on.workflow_call.secrets (all required: false, preserving the current "missing secret = empty string" semantics). Callers pass exactly what each path needs: preview-deploy passes 10; preview-destroy and preview-cleanup pass only PULUMI_ACCESS_TOKEN + AWS_DEPLOY_ROLE_ARN; EXA_API_KEY remains environment-resolved.

Static environment-secret access (alert 102) — EXA_API_KEY is declared in the reusable workflow contract and referenced as secrets.EXA_API_KEY, avoiding a dynamic lookup that could make every available job secret visible to the runner.

Note for reviewers: EXA_API_KEY

EXA_API_KEY is scoped to the preview environment and resolves via the deploy job's environment: preview. Callers intentionally do not pass it. The optional workflow_call.secrets declaration makes the static dotted reference valid to actionlint; GitHub uses the environment secret in preference to a same-named secret passed by a caller.

Validation

• actionlint on all six files: zero new findings vs main (only pre-existing shellcheck info-level warnings remain; one warning was removed along with the deleted installer step).
• bun run check passes on the updated branch.
• The preview deploy path is self-validating: this PR's own preview deploy exercises the changed stack-deploy.yml deploy job, and closing the PR exercises the destroy path.

[github-actions]

Semgrep Security Scan

No security issues found.

[github-actions]

Preview environment destroyed 🧹

Stack preview-pr-1195 and its Cloudflare subdomain have been cleaned up.

[github-actions]

PR Metrics

Metric	Value
Lines changed (prod code)	+80 / -26
JS bundle size (gzipped)	🟢 591.4 KB → 591.2 KB (-187 B, -0.0%)
Test coverage	🟢 81.38% → 81.36% (+-0.0%)
Performance (preview)	Preview not ready — Render deploy may have timed out
Accessibility	—
Best Practices	—
SEO	—

Updated Mon, 10 Aug 2026 19:44:11 GMT · run #2647

[ital0]

@thunderbolt-automation-agent review this PR

[thunderbolt-automation-agent]

Most of the hardening verifies. The script-injection fixes in stack-deploy.yml and pr-metrics.yml route the interpolated values through quoted env: variables correctly, the curl | sh removals in stack-deploy.yml and preview-cleanup.yml are safe because the deploy job already relied on the runner-preinstalled Pulumi CLI, the explicit secret maps match actual usage in all three callers, and the Pulumi-running steps in all four workflows carry a step-level PULUMI_ACCESS_TOKEN. Two findings remain, both in .github/workflows/stack-deploy.yml.

1. Medium: the EXA_API_KEY handling at .github/workflows/stack-deploy.yml:192 contradicts the PR body's alert-102 section. The line reads INPUT_EXA_API_KEY: ${{ secrets[format('{0}', 'EXA_API_KEY')] }}, and EXA_API_KEY is absent from the on.workflow_call.secrets contract at lines 53-84 (line 84 is only a comment). The body claims the opposite: that the secret "is declared in the reusable workflow contract and referenced as secrets.EXA_API_KEY, avoiding a dynamic lookup". It also counts 11 declared secrets; only 10 exist. The inline comment at lines 128-131 states the format() indirection exists to stop actionlint from checking the reference. That hides this secret's usage from the same code-scanning tooling the PR is meant to satisfy: the Configure Pulumi step stays modeled as able to read any available job or environment secret, and a typo in the format-string key would no longer be caught. Pick one mechanism and make code and body agree. Declaring EXA_API_KEY as required: false in the contract and using the static secrets.EXA_API_KEY reference, the approach the body already describes, satisfies actionlint once declared, and the deploy job's environment: preview still supplies the environment-scoped value. If you keep the dynamic lookup instead, correct the PR body so reviewers are not approving a mechanism different from what ships.

2. Low, latent: the rewritten existence check at .github/workflows/stack-deploy.yml:292 runs if pulumi stack select "$INPUT_STACK_NAME" --non-interactive 2>/dev/null, so any failure (empty or invalid PULUMI_ACCESS_TOKEN, a Pulumi Cloud outage, a network error) discards stderr and takes the not-found branch. That skips both the Destroy step and remove: true, and the workflow reports success while the stack keeps running and billing. The secret-scoping change makes this more reachable: PULUMI_ACCESS_TOKEN is now required: false in the contract and supplied per caller, so a caller that omits it fails silently instead of loudly. All three current callers pass the token, so this is latent, not live. You can capture the command output and match the "no stack named" / "stack not found" condition explicitly, or drop the 2>/dev/null so auth and transport errors fail the job. The same pattern exists at preview-cleanup.yml:71, where pulumi stack ls --json 2>/dev/null with an empty token reads as no preview stacks and cleanup silently no-ops; that line is unchanged in this PR and is noted as context only.

This is comment-only feedback. It does not approve or merge this pull request.

[github-actions]

🔭 thunder-deep-review (advisory)

Reviewed the diff — no issues to report. ✅ Never approves, never requests changes, never gates merge.
_{head: b5e547b0c1b2 · mode: single · deferred 0 item(s) already reported by other bots (best-effort dedup)}