TryGhostOSS
    Ghost
    Fixed shell injection surface and unrestricted refs in CI dispatch lane ref https://github.com/TryGhost/Ghost/pull/29180#discussion_r3545449152 - the job_setup debug step interpolated toJson(github.event) directly into a shell script; with the new workflow_dispatch inputs the event payload became user-controlled text, so it's now passed via env where the shell can't evaluate it (flagged by CodeQL) - the dispatch publish lane accepted any ref, letting anyone with workflow-run permission publish an unreviewed branch with an OIDC token; it now only runs from main or a v* tag and skips on other refs
    nx run ghost:test:integration
Succeeded
CI Pipeline Execution

nx run ghost:test:integration

Click to copy
Linux
4 CPU cores
read-write access token used
8c42aed929180
92%

Cache hits

11 of 12 tasks used cache.

Get faster results

Learn how to enable distribution.

Atomizer enabled

12 groups of tasks optimized.

© 2026 - Nx Cloud

Terms of ServicePrivacy PolicyChangelogStatusDocsContact Nx CloudPricingCompany@NxDevTools