Consolidate shell escaping utilities into shell.go (#12074)

Author: Copilot

.changeset/patch-consolidate-shell-utils.md

@@ -630,20 +630,20 @@ func (c *Compiler) generateMCPSetup(yaml *strings.Builder, tools map[string]any,
 
 		// Add entrypoint override if specified
 		if gatewayConfig.Entrypoint != "" {
-			containerCmd += " --entrypoint " + shellQuote(gatewayConfig.Entrypoint)
+			containerCmd += " --entrypoint " + shellEscapeArg(gatewayConfig.Entrypoint)
 		}
 
 		containerCmd += " " + containerImage
 
 		if len(gatewayConfig.EntrypointArgs) > 0 {
 			for _, arg := range gatewayConfig.EntrypointArgs {
-				containerCmd += " " + shellQuote(arg)
+				containerCmd += " " + shellEscapeArg(arg)
 			}
 		}
 
 		if len(gatewayConfig.Args) > 0 {
 			for _, arg := range gatewayConfig.Args {
-				containerCmd += " " + shellQuote(arg)
+				containerCmd += " " + shellEscapeArg(arg)
 			}
 		}
 

.github/workflows/security-guard.lock.yml

@@ -69,3 +69,35 @@ func shellEscapeCommandString(cmd string) string {
 	// Wrap in double quotes
 	return "\"" + escaped + "\""
 }
+
+// buildDockerCommandWithExpandableVars builds a properly quoted docker command
+// that allows ${GITHUB_WORKSPACE} and $GITHUB_WORKSPACE to be expanded at runtime
+func buildDockerCommandWithExpandableVars(cmd string) string {
+	shellLog.Printf("Building docker command with expandable vars (length: %d)", len(cmd))
+	// Replace ${GITHUB_WORKSPACE} with a placeholder that we'll handle specially
+	// We want: 'docker run ... -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ...'
+	// This closes the single quote, adds the variable in double quotes, then reopens single quote
+
+	// Split on ${GITHUB_WORKSPACE} to handle it specially
+	if strings.Contains(cmd, "${GITHUB_WORKSPACE}") {
+		parts := strings.Split(cmd, "${GITHUB_WORKSPACE}")
+		var result strings.Builder
+		result.WriteString("'")
+		for i, part := range parts {
+			if i > 0 {
+				// Add the variable expansion outside of single quotes
+				result.WriteString("'\"${GITHUB_WORKSPACE}\"'")
+			}
+			// Escape single quotes in the part
+			escapedPart := strings.ReplaceAll(part, "'", "'\\''")
+			result.WriteString(escapedPart)
+		}
+		result.WriteString("'")
+		shellLog.Print("Docker command built with expandable GITHUB_WORKSPACE variables")
+		return result.String()
+	}
+
+	// No GITHUB_WORKSPACE variable, use normal quoting
+	shellLog.Print("No GITHUB_WORKSPACE variable found, using normal escaping")
+	return shellEscapeArg(cmd)
+}