WorldSEnder 73a970b3df Merge commit from fork ...

* fix: variable interpolation/injection in scripts

github actions variable interpolation works differently than
interpolation in bash syntax. The only safe way for untrusted user input
is in general to store it in an env variable for scripts to access and use
plain old bash string interpolation.
The place where variables are still interpolated 'raw' are places that are
either guaranteed to be a commit hash, or a number, as per github action
inputs.

* be resilient against expansion in 'publish' workflow

even though this requires elevated access, pass event input as
an environment variable in the 'publish' workflow to avoid injection
of arbitrary commands frrom the input string

2026-03-27 10:50:03 +01:00

..

ISSUE_TEMPLATE

Update documentation.md (#3591)

2024-10-12 20:37:37 +08:00

workflows

Merge commit from fork

2026-03-27 10:50:03 +01:00

dependabot.yml

Stop dependabot from spamming PRs (#3347)

2023-07-29 22:01:25 +09:00

FUNDING.yml

Remove patreon link (#1424)

2020-07-24 12:44:02 +08:00

PULL_REQUEST_TEMPLATE.md

Fix cargo make config and tests (#2640)

2022-04-28 21:04:55 +05:00