Dylan M. Taylor d04f2a42da security(release): keep app-title and version metadata out of shell source (#47) ...

draft-release and resolve-version interpolated caller-provided metadata directly
into Bash source (CWE-78):

- draft-release embedded app-title into the `title=` assignment in the step that
  has GH_TOKEN available.
- resolve-version embedded input-version into a `v=` assignment before it was
  validated, and app-title into the job-summary `echo`.

Both inputs now travel through the step `env:` and are read with quoted variable
expansions; the version is validated before it is used to produce outputs, and
the summary is written with a fixed `printf` format. No change to outputs or
release behavior.

2026-10-22 11:40:30 -04:00

..

action.yml

security(release): keep app-title and version metadata out of shell source (#47)

2026-10-22 11:40:30 -04:00