| Commit message (Collapse) | Author | Age |
|---|
| |
|
|
|
|
| |
This avoids false positives from existing uses of `GITHUB_ENV` and
`pull_request_target` that are safe, as well as from cache usage in a
workflow that doesn't produce release artifacts.
|
| |
|
|
|
|
|
| |
Replace all template expansions in code contexts with environment
variable substitutions. Template expansion in code contexts can be a
source of code injection vulnerabilities; for more info, see:
https://docs.zizmor.sh/audits/#template-injection
|
|
|
This deduplicates common operations.
|
