tests: add a snapshot reproducer for #339

Signed-off-by: William Woodruff <william@yossarian.net>

tests/snapshot.rs

@@ -257,6 +257,12 @@ fn template_injection() -> Result<()> {
         .workflow(workflow_under_test("template-injection/static-env.yml"))
         .run()?);
 
+    insta::assert_snapshot!(zizmor()
+        .workflow(workflow_under_test(
+            "template-injection/issue-339-repro.yml"
+        ))
+        .run()?);
+
     Ok(())
 }
 

tests/snapshots/snapshot__template_injection-6.snap

@@ -0,0 +1,18 @@
+---
+source: tests/snapshot.rs
+expression: "zizmor().workflow(workflow_under_test(\"template-injection/issue-339-repro.yml\")).run()?"
+snapshot_kind: text
+---
+info[template-injection]: code injection via template expansion
+  --> @@INPUT@@:27:9
+   |
+27 |         - name: "Record run id"
+   |           --------------------- info: this step
+28 |           id: run-id
+29 | /         run: |
+30 | |           echo "run-id=${{ fromJson(steps.runs.outputs.data).workflow_runs[0].id }}" >> "$GITHUB_OUTPUT"
+   | |_________________________________________________________________________________________________________- info: steps.runs.outputs.data may expand into attacker-controllable code
+   |
+   = note: audit confidence → Low
+
+1 finding: 0 unknown, 1 informational, 0 low, 0 medium, 0 high

tests/test-data/template-injection/issue-339-repro.yml

@@ -0,0 +1,30 @@
+# minimized from https://github.com/woodruffw/zizmor/issues/339
+
+name: "Publish"
+
+on:
+  repository_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  find-run:
+    name: "Find latest kit.yml run"
+    runs-on: "ubuntu-latest"
+    outputs:
+      run-id: ${{ steps.run-id.outputs.run-id }}
+
+    steps:
+      - name: "Find latest kit.yml run"
+        id: runs
+        uses: octokit/request-action@dad4362715b7fb2ddedf9772c8670824af564f0d # v2.4.0
+        with:
+          route: GET /repos/nedbat/coveragepy/actions/workflows/kit.yml/runs
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: "Record run id"
+        id: run-id
+        run: |
+          echo "run-id=${{ fromJson(steps.runs.outputs.data).workflow_runs[0].id }}" >> "$GITHUB_OUTPUT"