Correct PR description: YAML context not shell injection in code scanning alert #538

[Copilot]

The original PR description incorrectly characterized CodeQL alert #538 as a shell injection vulnerability. The code was generating YAML environment variables, not executing shell commands.

Context Correction

The flagged code in update_project_job.go (lines 42-52):

• Used %q formatting to embed JSON in YAML environment variable declarations
• Was suppressed with lgtm[go/unsafe-quoting] explaining it generates YAML, not shell commands
• CodeQL flagged it because Go's %q escaping doesn't match YAML quoting rules, potentially breaking YAML parsing

Fix Remains Valid

The GH_AW_PROJECT_VIEWS environment variable was never consumed anywhere:

• No references in JavaScript code (pkg/workflow/js/*.cjs)
• Views configuration already passed via GH_AW_SAFE_OUTPUTS_PROJECT_HANDLER_CONFIG (compiler_safe_outputs_config.go:602-608)
• Removing dead code eliminates the alert without affecting functionality

The code change (removing unused env var generation + encoding/json import) is correct. Only the PR description's threat model characterization needed correction.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.