mirror of
https://github.com/anthropics/claude-code-action.git
synced 2026-01-22 22:44:13 +08:00
a86ef08036
Fixes command injection vulnerabilities in example workflow files by using environment variables instead of direct template expansion in shell commands. This prevents malicious branch names containing command substitution syntax like $(cmd) from being executed by the shell. Files fixed: - examples/ci-failure-auto-fix.yml: github.event.workflow_run.head_branch - examples/test-failure-analysis.yml: github.event.workflow_run.name and head_branch