mirror of
https://github.com/community-scripts/ProxmoxVED.git
synced 2026-03-31 06:24:18 -04:00
fix: avoid shell injection when issue body contains single quotes in move-to-main-repo workflow
Agent-Logs-Url: https://github.com/community-scripts/ProxmoxVED/sessions/218a4dbe-5133-4ddf-a076-4b2a9db9dd45 Co-authored-by: MickLesk <47820557+MickLesk@users.noreply.github.com>
This commit is contained in:
committed by
GitHub
parent
0d29d6911e
commit
6bcbdc8b4c
3
.github/workflows/move-to-main-repo.yaml
generated
vendored
3
.github/workflows/move-to-main-repo.yaml
generated
vendored
@@ -38,12 +38,13 @@ jobs:
|
||||
id: list_issues
|
||||
env:
|
||||
GH_TOKEN: ${{ github.token }}
|
||||
ISSUE_JSON: ${{ toJson(github.event.issue) }}
|
||||
run: |
|
||||
echo "Resolving issue with label Migration To ProxmoxVE"
|
||||
|
||||
if [[ "${{ github.event_name }}" == "issues" ]]; then
|
||||
# For labeled issue events, use the exact issue from event payload.
|
||||
filtered_issue='${{ toJson(github.event.issue) }}'
|
||||
filtered_issue="$ISSUE_JSON"
|
||||
else
|
||||
# Fallback for workflow_dispatch: query explicitly by label and raise limit.
|
||||
raw_output=$(gh issue list \
|
||||
|
||||
Reference in New Issue
Block a user