Bump pantheon-systems/push-to-pantheon from 0.9.3 to 0.9.5

[dependabot]

Bumps pantheon-systems/push-to-pantheon from 0.9.3 to 0.9.5.

Release notes

Sourced from pantheon-systems/push-to-pantheon's releases.

0.9.5

What's Changed

• ci: sign the commits auto-doc opens its pull request with by @​jazzsequence in pantheon-systems/push-to-pantheon#186
• docs: correct target_env precedence, strategy behaviour, and the release signing comment by @​jazzsequence in pantheon-systems/push-to-pantheon#189
• fix: skip the deployment when no environment applies, rather than failing by @​jazzsequence in pantheon-systems/push-to-pantheon#188
• Release 0.9.5 by @​jazzsequence in pantheon-systems/push-to-pantheon#191

Full Changelog: pantheon-systems/push-to-pantheon@0.9.4...0.9.5

0.9.4

Action Required

This release fixes a command injection issue via the git_commit_message parameter. The passed value was previously being interpolated into a shell string and run through eval, so shell metacharacters in it were executed rather than passed as text. Arbitrary commands could run on the runner, which holds PANTHEON_MACHINE_TOKEN and PANTHEON_SSH_KEY.

Affected versions are 0.9.0 - 0.9.3 when a workflow passes attacker-influenceable text in a PR title, branch name or body into git_commit_message, on a site with an existing live environment and not using skip_build_tools: true. The default generated message contains no caller-controlled text, so default configurations are not affected.

< 0.9.0 versions are also unaffected as they pass the message as a single quoted argument.

It is recommended to upgrade to 0.9.4 as soon as possible or avoid passing untrusted text into git_commit_message if you cannot update immediately.

Reported by @​ndewhurst. (#175)

What's Changed

• ci: sign release version-bump commits via GitHub API by @​jazzsequence in pantheon-systems/push-to-pantheon#165
• docs: document manual signing step for release PRs by @​jazzsequence in pantheon-systems/push-to-pantheon#167
• docs: fix repository typo in README by @​jazzsequence in pantheon-systems/push-to-pantheon#171
• fix: stop BATS leaking a multidev environment on every run by @​jazzsequence in pantheon-systems/push-to-pantheon#177
• fix: support multiline git_commit_message, drop eval from deploy by @​jazzsequence in pantheon-systems/push-to-pantheon#175
• fix: sweep closed-PR multidevs Build Tools misses by @​jazzsequence in pantheon-systems/push-to-pantheon#174
• fix: report the multidev limit when target_env is set explicitly by @​jazzsequence in pantheon-systems/push-to-pantheon#176
• feat: allow a per-site GitHub deployment environment by @​jazzsequence in pantheon-systems/push-to-pantheon#182
• feat: add an opt-in branch-name strategy for Multidev names by @​jazzsequence in pantheon-systems/push-to-pantheon#183
• [auto-doc] Update README.md by @​jazzsequence in pantheon-systems/push-to-pantheon#180
• Release 0.9.4 by @​jazzsequence in pantheon-systems/push-to-pantheon#185

Full Changelog: pantheon-systems/push-to-pantheon@0.9.3...0.9.4

Commits

• 157faa6 docs: Bump version to 0.9.5 (#191)
• 9d10331 fix: skip the deployment when no environment applies, rather than failing (#188)
• 419a2f7 docs: correct target_env precedence, strategy behaviour, and the release sign...
• aa3343d ci: sign the commits auto-doc opens its pull request with (#186)
• cfedff7 Release 0.9.4 (#185)
• e69376a [auto-doc] Update README.md (#180)
• 0d9f31f feat: add an opt-in branch-name strategy for Multidev names (#183)
• c4c2986 feat: allow a per-site GitHub deployment environment (#182)
• 230ec7a fix: report the multidev limit when target_env is set explicitly (#176)
• ee0bd74 fix: sweep closed-PR multidevs Build Tools misses (#174)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)