Possible using variable interpolation `${{ in action.yml

[begininvoke]

This might be a false positive, but .github/actions/get_release/action.yml around line 26 looked worth a second pair of eyes.

The workflow uses ${{ inputs.repository }} directly inside a run: step without sanitization, allowing an attacker to inject arbitrary shell commands via the repository input. This leads to OS command injection (CWE-78) on the runner, potentially resulting in theft of secrets (e.g., GITHUB_TOKEN) and source code. Risk level is high because the input is user-controlled and executes in a privileged CI environment.

The code in question

      run: |
        URL=$(echo ${{ inputs.repository }} | sed 's/^.*github\.com\/\([[:alnum:]\-]\+\/[[:alnum:]\-]\+\)\/\?$/\1/;t;Q1')
        echo "value=$URL" >> $GITHUB_OUTPUT

Something like this might fix it:

diff --git a/.github/actions/get_release/action.yml b/.github/actions/get_release/action.yml
--- a/.github/actions/get_release/action.yml
+++ b/.github/actions/get_release/action.yml
@@ -23,7 +23,9 @@ runs:
       id: extract_repo
       run: |
         URL=$(echo ${{ inputs.repository }} | sed 's/^.*github\.com\/\([[:alnum:]\-]\+\)\/[[:alnum:]\-]\+\/\?$/\1/;t;Q1')
         echo "value=$URL" >> $GITHUB_OUTPUT
+      env:
+        REPOSITORY: ${{ inputs.repository }}
+      run: |
+        URL=$(echo "$REPOSITORY" | sed 's/^.*github\.com\/\([[:alnum:]\-]\+\)\/[[:alnum:]\-]\+\/\?$/\1/;t;Q1')
+        echo "value=$URL" >> $GITHUB_OUTPUT

For reference: rule yaml.github-actions.security.run-shell-injection.run-shell-injection, CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')). Rated high.

I have not run the test suite here, so treat the suggestion as a starting point rather than something ready to merge.

---

Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.