From 13e535a0ec2d980da90381cd6a3d604e77f19c5a Mon Sep 17 00:00:00 2001
From: Andrew Peabody <andrewpeabody@google.com>
Date: Fri, 31 Jul 2026 23:33:27 +0000
Subject: [PATCH] fix(workflows): avoid code injection via template expansion

Replace GitHub Actions template expressions (${{ ... }}) with environment
variable references in run steps across go-tflint-plugin.yml,
release-tflint-plugin.yml, and update-tooling.yml to prevent potential
command injection.
---
 .github/workflows/go-tflint-plugin.yml      | 2 +-
 .github/workflows/release-tflint-plugin.yml | 4 ++--
 .github/workflows/update-tooling.yml        | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/go-tflint-plugin.yml b/.github/workflows/go-tflint-plugin.yml
index de7fc17663f..4870cdb7ada 100644
--- a/.github/workflows/go-tflint-plugin.yml
+++ b/.github/workflows/go-tflint-plugin.yml
@@ -54,7 +54,7 @@ jobs:
       with:
         go-version-file: 'tflint-ruleset-blueprint/go.mod'
     - run: echo "GORELEASER_CURRENT_TAG=v0.0.0" >> $GITHUB_ENV # sample tag for testing goreleaser
-    - run: echo "${{env.GORELEASER_CURRENT_TAG}}"
+    - run: echo "$GORELEASER_CURRENT_TAG"
     - name: Run GoReleaser
       uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
       with:
diff --git a/.github/workflows/release-tflint-plugin.yml b/.github/workflows/release-tflint-plugin.yml
index b9425152f74..a53f05f877d 100644
--- a/.github/workflows/release-tflint-plugin.yml
+++ b/.github/workflows/release-tflint-plugin.yml
@@ -23,7 +23,7 @@ jobs:
       with:
         go-version-file: 'tflint-ruleset-blueprint/go.mod'
     - run: echo "GORELEASER_CURRENT_TAG=${GITHUB_REF#refs/tags/tflint-ruleset-blueprint/}" >> $GITHUB_ENV
-    - run: echo "${{env.GORELEASER_CURRENT_TAG}}"
+    - run: echo "$GORELEASER_CURRENT_TAG"
     - name: Run GoReleaser
       uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
       with:
@@ -34,6 +34,6 @@ jobs:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     - name: upload
       run: |
-          gh release upload "tflint-ruleset-blueprint/${{env.GORELEASER_CURRENT_TAG}}" dist/tflint-ruleset-blueprint_*.zip dist/checksums.txt --repo ${{ github.repository }} --clobber
+          gh release upload "tflint-ruleset-blueprint/${GORELEASER_CURRENT_TAG}" dist/tflint-ruleset-blueprint_*.zip dist/checksums.txt --repo "${GITHUB_REPOSITORY}" --clobber
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/update-tooling.yml b/.github/workflows/update-tooling.yml
index 984fbd4b3fb..45be9a15055 100644
--- a/.github/workflows/update-tooling.yml
+++ b/.github/workflows/update-tooling.yml
@@ -107,7 +107,7 @@ jobs:
           git config user.name 'Cloud Foundation Bot'
           git config user.email 'cloud-foundation-bot@google.com'
           git add infra/build/Makefile
-          git diff-index --quiet HEAD || git commit -m "chore: Update Tools to ${{env.NEW_IMG_VERSION}}"
+          git diff-index --quiet HEAD || git commit -m "chore: Update Tools to ${NEW_IMG_VERSION}"
       - name: Create Pull Request
         if: env.BUMP_IMG == 'true'
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1