mirror of
https://github.com/angular/angular.git
synced 2026-09-14 13:54:52 +08:00
XananasX7
3b82aea861
Interpolating GitHub context values directly into `run:` steps creates
an expression-injection vector. Move the affected values into an `env:`
block and reference them as environment variables in the shell script
instead. This prevents shell metacharacters in context values from
altering step behaviour.
Signed-off-by: El Mehdi Abenhazou <mehdiananas007@gmail.com>
(cherry picked from commit d43acaf80c)