Fix: GitHub workflow script injection (#1169)

googleapis · Nov 13, 2024 · 65e8d21 · 65e8d21
1 parent e0fbfb7
commit 65e8d21
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/.github/workflows/apidiff.yaml b/.github/workflows/apidiff.yaml
@@ -3,6 +3,9 @@ name: apidiff
 on:
   pull_request:
 
+env:
+  PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}
+
 jobs:
   scan_changes:
     runs-on: ubuntu-latest
@@ -76,7 +79,7 @@ jobs:
       # non-breaking.
       run: |
         cd ${{ matrix.changed }} && apidiff -m -incompatible ${{ steps.baseline.outputs.pkg }} . > diff.txt
-        if [[ ${{ github.event.pull_request.head.ref }} == owl-bot-copy ]]; then
+        if [[ $PR_HEAD_REF == owl-bot-copy ]]; then
           sed -i '/: added/d' ./diff.txt
         fi
         cat diff.txt && ! [ -s diff.txt ]