chore: workflow cleanup

Uses intermediate file for getting github.event information. Direct
shell interpretation doesn't escape special characters, which can cause
problems or lead to code execution. Skips the job for dependabot PRs.

.github/workflows/conventional-commits-lint.js

@@ -16,7 +16,7 @@ const ALLOWED_CONVENTIONAL_COMMIT_PREFIXES = [
 ];
 
 const object = process.argv[2];
-const payload = JSON.parse(fs.readFileSync(process.stdin.fd, "utf-8"));
+const payload = JSON.parse(fs.readFileSync(process.argv[3], "utf-8"));
 
 let validate = [];
 

.github/workflows/conventional-commits.yml

@@ -16,10 +16,13 @@ on:
       - reopened
       - ready_for_review
 
+permissions:
+  contents: read
+
 jobs:
   check-conventional-commits:
     runs-on: ubuntu-latest
-
+    if: github.actor != 'dependabot[bot]' # skip for dependabot PRs
     steps:
       - uses: actions/checkout@v4
         with:
@@ -29,15 +32,14 @@ jobs:
       - if: ${{ github.event_name == 'pull_request_target' }}
         run: |
           set -ex
-
-          node .github/workflows/conventional-commits-lint.js pr <<EOF
-          ${{ toJSON(github.event) }}
-          EOF
+          TMP_FILE=$(mktemp)
+          echo '${{ toJSON(github.event) }}' > "$TMP_FILE"
+          node .github/workflows/conventional-commits-lint.js pr "$TMP_FILE"
 
       - if: ${{ github.event_name == 'push' }}
         run: |
           set -ex
 
-          node .github/workflows/conventional-commits-lint.js push <<EOF
-          ${{ toJSON(github.event) }}
-          EOF
+          TMP_FILE=$(mktemp)
+          echo '${{ toJSON(github.event) }}' > "$TMP_FILE"
+          node .github/workflows/conventional-commits-lint.js push "$TMP_FILE"