fix: prevent shell injection via workflow_dispatch BASELINE input

[ivanasabi]

Summary

code-deploy.yml interpolated the workflow_dispatch input BASELINE directly into a run: block. A user with dispatch permission could inject shell metacharacters and, given the job holds id-token: write and all Azure deployment secrets, achieve arbitrary command execution on the runner.

 - name: Get input parameters
+  env:
+    BASELINE: ${{ github.event.inputs.BASELINE || 'main' }}
   run: |
-    BASELINE_BRANCH=${{ github.event.inputs.BASELINE || 'main' }}
+    if [[ "$BASELINE" =~ ^[A-Za-z0-9][A-Za-z0-9._/{}-]*$ ]]; then
+      BASELINE_BRANCH="${BASELINE#refs/heads/}"
+      echo "BASELINE_BRANCH=$BASELINE_BRANCH" >> "$GITHUB_ENV"
+    else
+      echo "::error::invalid BASELINE branch: must contain only letters, digits, or one of . _ / { } -" >&2
+      exit 1
+    fi

The input now travels through env: (no shell interpretation), is quoted at use, and is validated against a strict branch-name regex before anything runs.

Evidence

Validation regex checked offline against injection payloads:

PASS: main | refs/heads/main | release/1.2.3 | feature_FIX | v1.0.0
FAIL: a;rm -rf / | a&&echo | a`id` | a$(id) | a|b | cur${IFS} | a b | ;whoami

Pre-commit ran eslint and commitlint green. YAML parses cleanly; the only remaining github.event.inputs.BASELINE occurrence is the safe env: mapping.

Merge Danger

Door: two-way (worst case: revert the commit / re-run dispatch)

Blast Radius: CI-only

Guards dispatch runs only; normal behavior (default main, refs/heads/ prefix stripped) is unchanged. Legitimate branch names with shell metacharacters outside the allowed set would now be rejected at job start, before Azure login.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud