From 680e287c8dd6955d65713e789a996a0efff14fa3 Mon Sep 17 00:00:00 2001
From: shuaiplus <2327005759@qq.com>
Date: Thu, 2 Jul 2026 16:11:19 +0800
Subject: [PATCH] fix(ci): validate global domains sync ref

---
 .github/workflows/sync-global-domains.yml | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/sync-global-domains.yml b/.github/workflows/sync-global-domains.yml
index e16309e..12cbb40 100644
--- a/.github/workflows/sync-global-domains.yml
+++ b/.github/workflows/sync-global-domains.yml
@@ -26,7 +26,16 @@ jobs:
           node-version: 22
 
       - name: Sync generated Bitwarden domains
-        run: npm run domains:sync -- --ref "${{ inputs.bitwarden_ref || 'main' }}"
+        env:
+          BITWARDEN_REF: ${{ inputs.bitwarden_ref || 'main' }}
+        run: |
+          case "$BITWARDEN_REF" in
+            "" | *[!A-Za-z0-9._/-]* )
+              echo "Invalid bitwarden_ref"
+              exit 1
+              ;;
+          esac
+          npm run domains:sync -- --ref "$BITWARDEN_REF"
 
       - name: Verify custom domains were not touched
         run: git diff --exit-code -- src/static/global_domains.custom.json