TryGhostOSS
    Ghost
    Fixed shell injection surface and unrestricted refs in CI dispatch lane ref https://github.com/TryGhost/Ghost/pull/29180#discussion_r3545449152 - the job_setup debug step interpolated toJson(github.event) directly into a shell script; with the new workflow_dispatch inputs the event payload became user-controlled text, so it's now passed via env where the shell can't evaluate it (flagged by CodeQL) - the dispatch publish lane accepted any ref, letting anyone with workflow-run permission publish an unreviewed branch with an OIDC token; it now only runs from main or a v* tag and skips on other refs
    nx run @tryghost/koenig-lexical:test:acceptance
Succeeded
CI Pipeline Execution

nx run @tryghost/koenig-lexical:test:acceptance

Click to copy
Linux
4 CPU cores
read-write access token used
8c42aed929180
88%

Cache hits

7 of 8 tasks used cache.

Get faster results

Learn how to enable distribution.

Atomizer enabled

8 groups of tasks optimized.

© 2026 - Nx Cloud

Terms of ServicePrivacy PolicyChangelogStatusDocsContact Nx CloudPricingCompany@NxDevTools