feat(helm): Make release commits more verbose

[kiblik]

During the investigation, it is quite easy to get lost in many commits with the same comments.
This should make navigation easier.

[dryrunsecurity]

This pull request introduces a GitHub Actions workflow that uses the unsanitized inputs.release_number directly inside a git commit shell command, creating a command-injection risk where a crafted release_number with shell metacharacters could execute arbitrary commands on the workflow runner. The issue appears in .github/workflows/release-x-manual-helm-chart.yml (lines 120–121) and should be mitigated by properly validating or shell-escaping the input (or using safer GitHub Actions/CLI APIs).

Command Injection in Git Commit in .github/workflows/release-x-manual-helm-chart.yml

Vulnerability

Command Injection in Git Commit

Description

The GitHub Actions workflow uses the inputs.release_number variable directly within a git commit command without proper sanitization. GitHub Actions expressions (${{...}}) are evaluated before the shell command is executed, and the resulting string is inserted directly into the shell command. This means that if a malicious actor with write access to the repository provides a crafted release_number input containing shell metacharacters (e.g., ;, &&, , `$()`, ` ``), they can inject and execute arbitrary commands on the workflow runner. This could lead to unauthorized command execution, data exfiltration, or repository corruption.

django-DefectDojo/.github/workflows/release-x-manual-helm-chart.yml

Lines 120 to 121 in cb5e9d2

	git commit -m "Update index.yaml - ${{ inputs.release_number }}"
	git push -u origin helm-charts

---

All finding details can be found in the DryRun Security Dashboard.

[mtesauro]

Approved