Merge pull request #1617 from crazy-max/fix-metadata-workflow-commands

prevent workflow command injection in metadata logs
2026-09-11 05:34:22 +02:00 · 2026-09-10 18:13:15 -07:00
parent 104b27ceb2 dcc3c70566
commit 03b4d6cac0
3 changed files with 29 additions and 29 deletions
@@ -137,7 +137,7 @@ actionsToolkit.run(
    if (metadata) {
      await core.group(`Metadata`, async () => {
        const metadatadt = JSON.stringify(metadata, null, 2);
-        core.info(metadatadt);
+        GitHub.printUntrusted(metadatadt);
        core.setOutput('metadata', metadatadt);
      });
    }