[ivanasabi]

Summary

Security audit followed up on release.yml: the Check versions job interpolated github.event.release.tag_name directly into a run: block four times. A crafted tag name could reach shell metacharacter evaluation in that job. Exploitation requires prior release/tag creation rights, so risk is low — fixed as hardening.

       - name: 🔎 Check versions
+        env:
+          RELEASE_TAG_NAME: ${{ github.event.release.tag_name }}
         run: |
           ...
-          echo "tag_name: ${{ github.event.release.tag_name }}"
+          echo "tag_name: $RELEASE_TAG_NAME"
-          if [ "${{ github.event.release.tag_name }}" != "... " ]; then
+          if [ "$RELEASE_TAG_NAME" != "..." ]; then

Evidence

$ python3 -c "import yaml; yaml.safe_load(open('.github/workflows/release.yml'))" && echo OK
OK

No behavior change: same four comparisons, same failure messages.

Merge Danger

Door: two-way (revert the commit)

Blast Radius: CI-only

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud