The pnpm security settings added in the previous commit
(strictDepBuilds, minimumReleaseAge, trustPolicy) require pnpm >=10.21,
and engines.pnpm gates installation. Bump pnpm/action-setup to v10 in
all three workflows (ci, release, security).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Fix potential shell injection in the release workflow by using environment variables instead of direct interpolation.
## Changes
- Move `github.event_name` and `inputs.version` to environment variables (`EVENT_NAME` and `INPUT_VERSION`)
- Reference these environment variables in the shell script instead of using `${{ }}` interpolation directly in the `run:` block
## Why
Direct interpolation of `${{ inputs.version }}` in a `run:` step is vulnerable to shell injection attacks. A malicious actor could craft a version input containing shell metacharacters to execute arbitrary commands, potentially stealing secrets or compromising the runner. By passing values through environment variables, the shell treats them as literal strings rather than executable code, eliminating the injection vector.
## Semgrep Finding Details
Using variable interpolation `${{...}}` with `github` context data in a `run:` step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. `github` context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with `env:` to store the data and use the environment variable in the `run:` script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".
@409041 requested Semgrep Assistant generate this pull request to fix [a finding](https://semgrep.dev/orgs/semgrep/findings/698924849) from the detection rule [yaml.github-actions.security.run-shell-injection.run-shell-injection](https://semgrep.dev/r/yaml.github-actions.security.run-shell-injection.run-shell-injection).
- CI workflow: validates and builds on PRs, fails if generated files are out of sync
- Release workflow: creates GitHub releases with skill zips on version tags
- Security workflow: weekly pnpm audit and outdated dependency checks
- Dependabot config: automated weekly dependency updates for npm and actions
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
dependabot[bot]