Make Forgejo release deletion argv-safe #663

New issue

Closed

opened 2026-05-09 00:46:44 +00:00 by barrettruth · 0 comments

barrettruth commented

2026-05-09 00:46:44 +00:00

Owner

Problem

Forgejo release deletion builds a shell command by concatenating the release tag into sh -c:

lua/forge/backends/forgejo.lua:1266

Release tags are accepted as unconstrained release subjects, so tags containing spaces or shell metacharacters can fail or be interpreted as shell syntax. GitHub and GitLab release deletion use argv-safe command tables.

Expected

Build the Forgejo delete command without shell string concatenation, or quote every dynamic component with a shared safe shell-argument helper if tea requires sh -c.

Non-goals

Do not change release picker behavior or release-delete confirmation semantics.

Context

Found during release-preview readiness audit. Remote Forgejo CI cannot currently be awaited because the Spark runner is down; use local verification for the fix.

## Problem Forgejo release deletion builds a shell command by concatenating the release tag into `sh -c`: - `lua/forge/backends/forgejo.lua:1266` Release tags are accepted as unconstrained release subjects, so tags containing spaces or shell metacharacters can fail or be interpreted as shell syntax. GitHub and GitLab release deletion use argv-safe command tables. ## Expected Build the Forgejo delete command without shell string concatenation, or quote every dynamic component with a shared safe shell-argument helper if `tea` requires `sh -c`. ## Non-goals Do not change release picker behavior or release-delete confirmation semantics. ## Context Found during release-preview readiness audit. Remote Forgejo CI cannot currently be awaited because the Spark runner is down; use local verification for the fix.

barrettruth added the

bug

label

2026-05-09 00:46:44 +00:00

barrettruth referenced this issue

2026-05-09 00:47:16 +00:00

Tracker: release-preview readiness follow-up #667

barrettruth referenced this issue from a pull request that will close it,

2026-05-09 00:54:13 +00:00

fix: make Forgejo release deletion argv-safe #668

barrettruth closed this issue

2026-05-09 02:38:59 +00:00