From 5628eb485c01e49f08ba7159696f991fcdcc9d80 Mon Sep 17 00:00:00 2001
From: Andy Allan <git@gravitystorm.co.uk>
Date: Tue, 12 May 2026 15:16:40 +0100
Subject: [PATCH] Avoid string interpolation into bash commands

Although the `clone_url` and `sha` are safe, other similar aspects of
the pull request head are not (e.g. `head.ref`, `pull_request.title` etc)
and these must not be interpolated.

So let's use the convention of putting such data into environment
variables, where the contents are not interpolated into the bash
commands and are instead passed directly to the called program.

https://docs.github.com/en/actions/reference/security/secure-use#use-an-intermediate-environment-variable
---
 .github/workflows/danger.yml | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/danger.yml b/.github/workflows/danger.yml
index 4aa64c515..6c66ea587 100644
--- a/.github/workflows/danger.yml
+++ b/.github/workflows/danger.yml
@@ -23,11 +23,17 @@ jobs:
           ruby-version: 3.3
           bundler-cache: true
       - name: Create base branch
+        env:
+          BASE_CLONE_URL: ${{ github.event.pull_request.base.repo.clone_url }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
         run: |
-          git fetch ${{ github.event.pull_request.base.repo.clone_url }} ${{ github.event.pull_request.base.sha }}:danger_base
+          git fetch "$BASE_CLONE_URL" "$BASE_SHA:danger_base"
       - name: Create head branch
+        env:
+          HEAD_CLONE_URL: ${{ github.event.pull_request.head.repo.clone_url }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
         run: |
-          git fetch ${{ github.event.pull_request.head.repo.clone_url }} ${{ github.event.pull_request.head.sha }}:danger_head
+          git fetch "$HEAD_CLONE_URL" "$HEAD_SHA:danger_head"
       - name: Danger
         env:
           DANGER_GITHUB_BEARER_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-- 
2.47.3