Define environment variables in env: section

Fix potential command injection via PR title, see https://securitylab.github.com/resources/github-actions-untrusted-input/
nsoranzo · Oct 14, 2024 · 70bea1b · 70bea1b
1 parent fcb3bdf
commit 70bea1b
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/.github/workflows/pr-title-update.yml b/.github/workflows/pr-title-update.yml
@@ -16,10 +16,10 @@ jobs:
       - name: Update PR title
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          TARGET_BRANCH: "${{ github.base_ref }}"
+          PR_TITLE: "${{ github.event.pull_request.title }}"
         run: |
-          PR_NUMBER=${{ github.event.pull_request.number }}
-          TARGET_BRANCH="${{ github.base_ref }}"
-          PR_TITLE="${{ github.event.pull_request.title }}"
           VERSION=$(echo $TARGET_BRANCH | grep -oP '\d+\.\d+')
           if [[ -n "$VERSION" && ! "$PR_TITLE" =~ ^\[$VERSION\] ]]; then
             NEW_TITLE="[$VERSION] $PR_TITLE"