Jordan Ritter 385f412fba Fix GitHub Actions template injection (CWE-78) in workflow shell commands ...

Move untrusted PR event data (title, head ref, base ref, SHAs) from
inline ${{ }} interpolation in shell run: blocks to env: blocks,
referencing them as shell variables instead. This prevents arbitrary
code execution via crafted PR titles or branch names.

Affected workflows:
- test_smoke-starter.yml: PR title, user login, head SHA
- publish-release.yml: PR head ref (branch name)
- static_quality.yml: PR base ref, base SHA, head SHA

2026-05-03 13:27:35 -07:00

..

ISSUE_TEMPLATE

refactor: consolidate V1/V2 packages into flat @copilotkit/* structure

2026-03-28 16:45:10 -07:00

workflows

Fix GitHub Actions template injection (CWE-78) in workflow shell commands

2026-05-03 13:27:35 -07:00

CODEOWNERS

chore: update CODEOWNERS default reviewers

2026-04-14 16:35:14 -07:00

PULL_REQUEST_TEMPLATE.md

chore: add maintainer-edits checklist item to PR template

2026-04-28 18:02:37 -07:00