SEC: fix github workflow vulnerable to script injection

[diogoteles08]

Hi! I'm Diogo from Google's Open Source Security Team(GOSST) and I'm dropping by to suggest this small change that will enhance the security of your repository by preventing script injection attacks through your GitHub workflows.

In the piece of code I changed, you were directly using the value of a variable that comes from a user's input, so a malicious user could exploit that input and use it to run arbitrary code. By using an intermediate environment variable, the value of the expression is stored in memory, used as a variable and doesn't interact with the script generation process. This mitigates the script injection risks and also keeps your workflow running exactly as before.

You can find more information about this on this github documentation or in this gitguardian blogpost.

Cheers!

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 95.12%. Comparing base (3ad9234) to head (bb3b517).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #2787   +/-   ##
=======================================
  Coverage   95.12%   95.12%           
=======================================
  Files          51       51           
  Lines        8557     8557           
  Branches     1707     1707           
=======================================
  Hits         8140     8140           
  Misses        263      263           
  Partials      154      154           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[stefan6419846]

Thanks for the PR. In theory, running this workflow on untrusted data should not happen due to the collaborators having to merge each PR anyway - especially release PRs should only be accepted when created by collaborators. Nevertheless, it seems like a good approach to follow best practices.

While we are at it and to avoid doubts: The run condition in line 22 can already be considered safe against such attacks?

[diogoteles08]

@stefan6419846 Good question. Yeah, in the if block the injections wouldn't work so it's considered safe.