From 965c885796589b377423a96f57f7658ed1967c34 Mon Sep 17 00:00:00 2001
From: "fix-it-felix-sentry[bot]"
 <260785270+fix-it-felix-sentry[bot]@users.noreply.github.com>
Date: Fri, 1 May 2026 18:26:10 +0000
Subject: [PATCH] Fix shell injection vulnerability in GitHub Action workflow

This commit addresses a high-severity security finding where direct
interpolation of GitHub context data in run steps could allow code
injection attacks.

Changes:
- Line 41: Use environment variable for inputs.venv-dir
- Lines 46-48: Use environment variables for runner.os and inputs.venv-dir
- Line 54: Use environment variable for inputs.install-cmd

All vulnerable variables are now passed through env: blocks and
properly quoted in the run scripts to prevent shell injection.

Refs:
- https://linear.app/getsentry/issue/VULN-1617
- https://linear.app/getsentry/issue/DI-1911

Co-Authored-By: fix-it-felix-sentry[bot] <260785270+fix-it-felix-sentry[bot]@users.noreply.github.com>
---
 action.yml | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/action.yml b/action.yml
index fbd8ea8..a531c9f 100644
--- a/action.yml
+++ b/action.yml
@@ -38,20 +38,27 @@ runs:
         path: ${{ inputs.working-directory }}/${{ inputs.venv-dir }}
         key: setup-venv-${{ runner.os }}-py-${{ steps.setup-python.outputs.python-version }}-${{ steps.setup-python.outputs.python-path }}-${{ hashFiles(inputs.cache-dependency-path) }}-${{ inputs.install-cmd }}
 
-    - run: python -m venv ${{ inputs.venv-dir }}
+    - run: python -m venv "$VENV_DIR"
       if: steps.cache-venv.outputs.cache-hit != 'true'
       shell: bash
       working-directory: ${{ inputs.working-directory }}
+      env:
+        VENV_DIR: ${{ inputs.venv-dir }}
 
     - run: |
-        SCRIPT_DIR="${{ runner.os == 'Windows' && 'Scripts' || 'bin' }}"
-        source ${{ inputs.venv-dir }}/${SCRIPT_DIR}/activate
+        SCRIPT_DIR="${RUNNER_OS_VENV_SCRIPT_DIR}"
+        source "$VENV_DIR"/${SCRIPT_DIR}/activate
         echo "VIRTUAL_ENV=${VIRTUAL_ENV}" >> $GITHUB_ENV
         echo "${VIRTUAL_ENV}/${SCRIPT_DIR}" >> $GITHUB_PATH
       shell: bash
       working-directory: ${{ inputs.working-directory }}
+      env:
+        RUNNER_OS_VENV_SCRIPT_DIR: ${{ runner.os == 'Windows' && 'Scripts' || 'bin' }}
+        VENV_DIR: ${{ inputs.venv-dir }}
 
-    - run: ${{ inputs.install-cmd }}
+    - run: "$INSTALL_CMD"
       if: inputs.install-cmd != '' && steps.cache-venv.outputs.cache-hit != 'true'
       shell: bash
       working-directory: ${{ inputs.working-directory }}
+      env:
+        INSTALL_CMD: ${{ inputs.install-cmd }}