build: avoid a script injection attack

nedbat · nedbat · commit 6dff85d81bb7 · 2022-07-17T06:36:10.000-04:00
Details here: https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable Found with https://rhysd.github.io/actionlint/
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
@@ -185,14 +185,16 @@ jobs:
           path: reports_repo/${{ env.report_dir }}
 
       - name: "Push to report repo"
+        env:
+          COMMIT_MESSAGE: ${{ github.event.head_commit.message }}
         run: |
           set -xe
           # Make the redirect to the latest report.
           echo "<html><head>" > reports_repo/latest.html
           echo "<meta http-equiv='refresh' content='0;url=${{ env.url }}' />" >> reports_repo/latest.html
           echo "<body>Coverage report redirect..." >> reports_repo/latest.html
           # Make the commit message.
-          echo "${{ env.total }}% - ${{ github.event.head_commit.message }}" > commit.txt
+          echo "${{ env.total }}% - $COMMIT_MESSAGE" > commit.txt
           echo "" >> commit.txt
           echo "${{ env.url }}" >> commit.txt
           echo "${{ env.sha10 }}: ${{ env.branch }}" >> commit.txt
