chore: Fix double quotes for all workflows and actions (#2090)

Workaround potential vulnerabilities in workflows.

.github/actions/build_clio/action.yml

@@ -25,5 +25,5 @@ runs:
         cd build
         cmake \
           --build . \
-          --parallel ${{ steps.number_of_threads.outputs.threads_number }} \
+          --parallel "${{ steps.number_of_threads.outputs.threads_number }}" \
           --target ${{ inputs.targets }}

.github/actions/create_issue/action.yml

@@ -36,6 +36,6 @@ runs:
           --title '${{ inputs.title }}' \
           --body-file ./issue.md \
           > create_issue.log
-        created_issue=$(cat create_issue.log | sed 's|.*/||')
+        created_issue="$(sed 's|.*/||' create_issue.log)"
         echo "created_issue=$created_issue" >> $GITHUB_OUTPUT
         rm create_issue.log issue.md

.github/actions/generate/action.yml

@@ -60,14 +60,14 @@ runs:
           install .. \
           -of . \
           -b $BUILD_OPTION \
-          -s build_type=${{ inputs.build_type }} \
+          -s build_type="${{ inputs.build_type }}" \
           -o clio:static="${STATIC_OPTION}" \
           -o clio:tests=True \
           -o clio:integration_tests="${INTEGRATION_TESTS_OPTION}" \
           -o clio:lint=False \
           -o clio:coverage="${CODE_COVERAGE}" \
           -o clio:time_trace="${TIME_TRACE}" \
-          --profile ${{ inputs.conan_profile }}
+          --profile "${{ inputs.conan_profile }}"
 
     - name: Run cmake
       shell: bash
@@ -83,6 +83,6 @@ runs:
         cmake \
           -DCMAKE_TOOLCHAIN_FILE:FILEPATH=build/generators/conan_toolchain.cmake \
           -DCMAKE_BUILD_TYPE="${BUILD_TYPE}" \
-          ${SANITIZER_OPTION} \
+          "${SANITIZER_OPTION}" \
           .. \
           -G Ninja

.github/actions/get_number_of_threads/action.yml

@@ -30,7 +30,7 @@ runs:
       id: number_of_threads_export
       shell: bash
       run: |
-        num_of_threads=${{ steps.mac_threads.outputs.num || steps.linux_threads.outputs.num }}
+        num_of_threads="${{ steps.mac_threads.outputs.num || steps.linux_threads.outputs.num }}"
-        shift_by=${{ inputs.subtract_threads }}
+        shift_by="${{ inputs.subtract_threads }}"
-        shifted=$((num_of_threads - shift_by))
+        shifted="$((num_of_threads - shift_by))"
         echo "num=$(( shifted > 1 ? shifted : 1 ))" >> $GITHUB_OUTPUT

.github/actions/git_common_ancestor/action.yml

@@ -13,4 +13,4 @@ runs:
       id: find_common_ancestor
       shell: bash
       run: |
-        echo "commit=$(git merge-base --fork-point origin/develop)" >> $GITHUB_OUTPUT
+        echo "commit=\"$(git merge-base --fork-point origin/develop)\"" >> $GITHUB_OUTPUT

.github/actions/prepare_runner/action.yml

@@ -38,7 +38,7 @@ runs:
         FORMULA_EXPECTED_SHA256="c7ec95d86f0657638835441871e77541165e0a2581b53b3dd657cf13ad4228d4"
 
         mkdir -p /tmp/homebrew-formula
-        curl -s -L $FORMULA_URL -o /tmp/homebrew-formula/cmake.rb
+        curl -s -L "$FORMULA_URL" -o /tmp/homebrew-formula/cmake.rb
 
         echo "$FORMULA_EXPECTED_SHA256  /tmp/homebrew-formula/cmake.rb" | shasum -a 256 -c
 
@@ -48,7 +48,7 @@ runs:
     - name: Fix git permissions on Linux
       if: ${{ runner.os == 'Linux' }}
       shell: bash
-      run: git config --global --add safe.directory $PWD
+      run: git config --global --add safe.directory "$PWD"
 
     - name: Set env variables for macOS
       if: ${{ runner.os == 'macOS' }}
@@ -73,5 +73,5 @@ runs:
     - name: Create directories
       shell: bash
       run: |
-        mkdir -p $CCACHE_DIR
+        mkdir -p "$CCACHE_DIR"
-        mkdir -p $CONAN_USER_HOME/.conan
+        mkdir -p "$CONAN_USER_HOME/.conan"

.github/actions/restore_cache/action.yml

@@ -42,9 +42,9 @@ runs:
       shell: bash
       run: |
         conan info . -j info.json -o clio:tests=True
-        packages_info=$(cat info.json | jq '.[] | "\(.display_name): \(.id)"' | grep -v 'clio')
+        packages_info="$(cat info.json | jq '.[] | "\(.display_name): \(.id)"' | grep -v 'clio')"
         echo "$packages_info"
-        hash=$(echo "$packages_info" | shasum -a 256 | cut -d ' ' -f 1)
+        hash="$(echo "$packages_info" | shasum -a 256 | cut -d ' ' -f 1)"
         rm info.json
         echo "hash=$hash" >> $GITHUB_OUTPUT
 

.github/actions/setup_conan/action.yml

@@ -15,17 +15,17 @@ runs:
       env:
         CONAN_PROFILE: ${{ inputs.conan_profile }}
       run: |
-        echo "Creating $CONAN_PROFILE conan profile"
+        echo "Creating \"$CONAN_PROFILE\" conan profile"
-        conan profile new $CONAN_PROFILE --detect --force
+        conan profile new "$CONAN_PROFILE" --detect --force
-        conan profile update settings.compiler.libcxx=libc++ $CONAN_PROFILE
+        conan profile update settings.compiler.libcxx=libc++ "$CONAN_PROFILE"
-        conan profile update settings.compiler.cppstd=20 $CONAN_PROFILE
+        conan profile update settings.compiler.cppstd=20 "$CONAN_PROFILE"
-        conan profile update env.CXXFLAGS=-DBOOST_ASIO_DISABLE_CONCEPTS $CONAN_PROFILE
+        conan profile update env.CXXFLAGS=-DBOOST_ASIO_DISABLE_CONCEPTS "$CONAN_PROFILE"
-        conan profile update "conf.tools.build:cxxflags+=[\"-DBOOST_ASIO_DISABLE_CONCEPTS\"]" $CONAN_PROFILE
+        conan profile update "conf.tools.build:cxxflags+=[\"-DBOOST_ASIO_DISABLE_CONCEPTS\"]" "$CONAN_PROFILE"
 
     - name: Add conan-non-prod artifactory
       shell: bash
       run: |
-        if [[ -z $(conan remote list | grep conan-non-prod) ]]; then
+        if [[ -z "$(conan remote list | grep conan-non-prod)" ]]; then
             echo "Adding conan-non-prod"
             conan remote add --insert 0 conan-non-prod http://18.143.149.228:8081/artifactory/api/conan/conan-non-prod
         else

.github/workflows/build.yml

@@ -80,23 +80,23 @@ jobs:
         shell: bash
         run: |
           repoConfigFile=docs/config-description.md
-          if ! [ -f ${repoConfigFile} ]; then
+          if ! [ -f "${repoConfigFile}" ]; then
             echo "Config Description markdown file is missing in docs folder"
             exit 1
           fi
 
           chmod +x ./clio_server
           configDescriptionFile=config_description_new.md
-          ./clio_server -d ${configDescriptionFile}
+          ./clio_server -d "${configDescriptionFile}"
 
-          configDescriptionHash=$(sha256sum ${configDescriptionFile} | cut -d' ' -f1)
+          configDescriptionHash=$(sha256sum "${configDescriptionFile}" | cut -d' ' -f1)
-          repoConfigHash=$(sha256sum ${repoConfigFile} | cut -d' ' -f1)
+          repoConfigHash=$(sha256sum "${repoConfigFile}" | cut -d' ' -f1)
 
-          if [ ${configDescriptionHash} != ${repoConfigHash} ]; then
+          if [ "${configDescriptionHash}" != "${repoConfigHash}" ]; then
             echo "Markdown file is not up to date"
             diff -u "${repoConfigFile}" "${configDescriptionFile}"
-            rm -f ${configDescriptionFile}
+            rm -f "${configDescriptionFile}"
             exit 1
           fi
-          rm -f ${configDescriptionFile}
+          rm -f "${configDescriptionFile}"
           exit 0

.github/workflows/build_clio_docker_image.yml

@@ -57,7 +57,7 @@ jobs:
         if: ${{ inputs.clio_server_binary_url != null }}
         shell: bash
         run: |
-          wget ${{inputs.clio_server_binary_url}} -P ./docker/clio/artifact/
+          wget "${{inputs.clio_server_binary_url}}" -P ./docker/clio/artifact/
           if [ "$(sha256sum ./docker/clio/clio_server | awk '{print $1}')" != "${{inputs.binary_sha256}}" ]; then
             echo "Binary sha256 sum doesn't match"
             exit 1

.github/workflows/clang-tidy.yml

@@ -68,7 +68,7 @@ jobs:
         shell: bash
         id: run_clang_tidy
         run: |
-          run-clang-tidy-19 -p build -j ${{ steps.number_of_threads.outputs.threads_number }} -fix -quiet 1>output.txt
+          run-clang-tidy-19 -p build -j "${{ steps.number_of_threads.outputs.threads_number }}" -fix -quiet 1>output.txt
 
       - name: Fix local includes
         if: ${{ steps.run_clang_tidy.outcome != 'success' }}

.github/workflows/clang-tidy_on_fix_merged.yml

@@ -18,8 +18,8 @@ jobs:
         id: check
         shell: bash
         run: |
-          passed=$(if [[ $(git log -1 --pretty=format:%s | grep 'style: clang-tidy auto fixes') ]]; then echo 'true' ; else echo 'false' ; fi)
+          passed=$(if [[ "$(git log -1 --pretty=format:%s | grep 'style: clang-tidy auto fixes')" ]]; then echo 'true' ; else echo 'false' ; fi)
-          echo "passed=$passed" >> $GITHUB_OUTPUT
+          echo "passed=\"$passed\"" >> $GITHUB_OUTPUT
 
       - name: Run clang-tidy workflow
         if: ${{ contains(steps.check.outputs.passed, 'true') }}