fix: prevent code injection
Description
Prevent code injection from PR titles.
How Has This Been Tested?
I've used `act` to test locally the pull request, with the code injection title.
@@ -19,4 +19,6 @@ jobs:
echo "module.exports = {extends: ['@commitlint/config-conventional']}" > commitlint.config.js
- name: lint
run: |
- echo "${{github.event.pull_request.title}}" | commitlint
+ echo "$PR_TITLE" | commitlint
+ env:
+ PR_TITLE: ${{github.event.pull_request.title}}
