[Sync] Update project files from source repository (e42f680)

[mrz1836]

What Changed

• Added new esc_html() function in .github/actions/validate-test-results/action.yml that escapes HTML metacharacters (&, <, >) in addition to stripping backticks and control characters
• Updated TEST_LABEL, TEST, PKG, and FAIL_TYPE variables to use esc_html() instead of strip_bt() to prevent HTML injection when these values are written into raw HTML tags in the GitHub step summary
• Kept strip_bt() for ERROR_MSG, OUTPUT, and STACK variables that are embedded in markdown code spans/fences where HTML is not interpreted
• Modified version variables in .github/env/10-security.env, .github/env/00-core.env, and .github/env/10-mage-x.env (specific version changes truncated in diff)
• Modified .github/workflows/fortress.yml (specific change truncated in diff)

Why It Was Necessary

• Prevent security vulnerability where crafted test names or package names containing HTML metacharacters could break out of HTML tags and spoof the structure of GitHub Actions step summaries
• Existing strip_bt() function only prevented markdown code span/fence breakout but did not protect against HTML injection in raw HTML contexts
• Different sanitization strategies are needed based on whether artifact-derived values are embedded in raw HTML versus markdown code blocks

Testing Performed

• Verified that esc_html() properly escapes &, <, and > characters in addition to applying existing strip_bt() sanitization
• Confirmed that variables used in raw HTML contexts (<summary>, <code> tags) now use HTML escaping
• Validated that variables used in markdown code spans/fences continue to use backtick-stripping only, avoiding literal entity rendering

Impact / Risk

• Security improvement: Closes potential HTML injection vulnerability in test validation reporting
• Risk: Low - enhances existing sanitization without changing functional behavior of test result display
• Breaking changes: None - output format remains the same for legitimate test names, only prevents malicious input from breaking HTML structure

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

Sync update from upstream repository to harden the GitHub Actions test-validation summary output against HTML injection, plus routine CI tool/version bumps.

Changes:

• Added esc_html() to the validate-test-results composite action and applied it to artifact-derived fields rendered inside raw HTML in the step summary.
• Updated pinned versions for govulncheck (and related Mage-X env pins), govulncheck’s Go toolchain version, and benchstat.
• Bumped the GoFortress workflow header version metadata.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
.github/actions/validate-test-results/action.yml	Introduces esc_html() and applies it to untrusted values rendered into raw HTML in the step summary.
.github/env/10-security.env	Updates the pinned govulncheck version used by security tooling.
.github/env/10-mage-x.env	Aligns Mage-X tool version pins (govulncheck/benchstat).
.github/env/00-core.env	Updates the Go toolchain version used specifically for govulncheck scanning.
.github/workflows/fortress.yml	Updates GoFortress workflow header version metadata.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[mrz1836]

LGTM!