repo_tag: ignore unintended Git options when creating tags

.github/workflows/go.yml

@@ -27,7 +27,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
       - name: Install Go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@v5
         with:
           go-version: 1.23.x
       - name: Check Go module tidiness
@@ -51,7 +51,7 @@ jobs:
     name: Test
     strategy:
       matrix:
-        go-version: [ 1.22.x, 1.23.x ]
+        go-version: [ 1.23.x ]
         platform: [ ubuntu-latest, macos-latest, windows-latest ]
     runs-on: ${{ matrix.platform }}
     steps:

CODEOWNERS

@@ -0,0 +1,2 @@
+# Default
+* @gogs/core

repo_tag.go

@@ -248,6 +248,8 @@ func (r *Repository) CreateTag(name, rev string, opts ...CreateTagOptions) error
 			cmd.AddCommitter(opt.Author)
 		}
 	} else {
+		// 🚨 SECURITY: Prevent including unintended options in the path to the Git command.
+		cmd.AddArgs("--end-of-options")
 		cmd.AddArgs(name)
 	}