[READ-ONLY] Mirror of https://github.com/bombshell-dev/tty. Platform independent 2D layout engine for terminal applications based on Clay
chore: mitigate potential template injection
See https://docs.zizmor.sh/audits/#template-injection
Willow (GHOST)
(May 24, 2026, 3:53 PM +0100)
a968d96e
e71f7039
+12
-6
+12
-6
.github/workflows/publish.yml
+12
-6
.github/workflows/publish.yml
···
28
28
29
29
- name: Get Version
30
30
id: vars
31
-
run: echo ::set-output name=version::$(echo ${{github.ref_name}} | sed 's/^v//')
31
+
run: echo ::set-output name=version::$(echo "${GITHUB_REF_NAME}" | sed 's/^v//')
32
32
33
33
- name: Build JSR
34
-
run: deno task build:jsr ${{steps.vars.outputs.version}}
34
+
run: deno task build:jsr "${STEPS_VARS_OUTPUTS_VERSION}"
35
+
env:
36
+
STEPS_VARS_OUTPUTS_VERSION: ${{steps.vars.outputs.version}}
35
37
36
38
- name: dry run publish
37
39
run: deno publish --dry-run --allow-dirty
···
55
57
56
58
- name: Get Version
57
59
id: vars
58
-
run: echo ::set-output name=version::$(echo ${{github.ref_name}} | sed 's/^v//')
60
+
run: echo ::set-output name=version::$(echo "${GITHUB_REF_NAME}" | sed 's/^v//')
59
61
60
62
- name: Setup Node
61
63
uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
···
65
67
cache: ""
66
68
67
69
- name: Build NPM
68
-
run: deno task build:npm ${{steps.vars.outputs.version}}
70
+
run: deno task build:npm "${STEPS_VARS_OUTPUTS_VERSION}"
71
+
env:
72
+
STEPS_VARS_OUTPUTS_VERSION: ${{steps.vars.outputs.version}}
69
73
70
74
- name: dry run publish
71
75
run: npm publish --dry-run --tag=verify
···
126
130
127
131
- name: Get Version
128
132
id: vars
129
-
run: echo ::set-output name=version::$(echo ${{github.ref_name}} | sed 's/^v//')
133
+
run: echo ::set-output name=version::$(echo "${GITHUB_REF_NAME}" | sed 's/^v//')
130
134
131
135
- name: Build JSR
132
-
run: deno task build:jsr ${{steps.vars.outputs.version}}
136
+
run: deno task build:jsr "${STEPS_VARS_OUTPUTS_VERSION}"
137
+
env:
138
+
STEPS_VARS_OUTPUTS_VERSION: ${{steps.vars.outputs.version}}
133
139
134
140
- name: Publish JSR
135
141
run: deno publish --allow-dirty --token=${{ secrets.JSR_TOKEN }}