Use env var for PR title to prevent untrusted script injection

defenseunicorns · Apr 4, 2024 · 6bf2d27 · 6bf2d27
1 parent 1173d81
commit 6bf2d27
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/.github/workflows/commitlint.yml b/.github/workflows/commitlint.yml
@@ -24,4 +24,6 @@ jobs:
         run: npm install --save-dev @commitlint/{config-conventional,cli}
 
       - name: Lint PR title
-        run: echo "${{ github.event.pull_request.title }}" | npx commitlint
+        env:
+          PR_TITLE: ${{ github.event.pull_request.title }}
+        run: echo "$PR_TITLE" | npx commitlint