ci: wrap untrusted input into variables

to avoid potential script injection

see: https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions

.github/workflows/ci.yml

@@ -41,7 +41,7 @@ jobs:
           NPM_TOKEN: ${{ secrets.NPM_PUBLISH_TOKEN }}
         run: |
           npm config set //registry.npmjs.org/:_authToken "${NPM_TOKEN}"
-          preid=$(sed -e s:/:-:g <<<${{ github.head_ref }}).${{ github.run_number }}.${{ github.run_attempt }}
+          preid="${HEAD_REF//\//-}".${{ github.run_number }}.${{ github.run_attempt }}
           npm --no-git-tag-version version prerelease --preid="${preid}"
           pnpm publish --no-git-checks --access public --tag development
 

.vscode/settings.json

@@ -1,7 +1,7 @@
 {
   "diffEditor.ignoreTrimWhitespace": false,
   "editor.codeActionsOnSave": {
-    "source.fixAll.eslint": true
+    "source.fixAll.eslint": "explicit"
   },
   "editor.defaultFormatter": "esbenp.prettier-vscode",
   "editor.fontLigatures": true,