From 17e48eab23fc65856577c9e858511079ed9f419a Mon Sep 17 00:00:00 2001
From: Zhiwei Liang <zliang@akamai.com>
Date: Tue, 14 Jul 2026 17:15:03 -0400
Subject: [PATCH] fix: prevent GitHub Actions script injection

---
 .github/workflows/e2e-suite-windows.yml | 4 +++-
 .github/workflows/e2e-suite.yml         | 7 +++++--
 .github/workflows/release.yml           | 4 +++-
 3 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/e2e-suite-windows.yml b/.github/workflows/e2e-suite-windows.yml
index a8919de0..4b06de84 100644
--- a/.github/workflows/e2e-suite-windows.yml
+++ b/.github/workflows/e2e-suite-windows.yml
@@ -70,9 +70,11 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - run: make MODULE="${{ inputs.module }}" RUN_LONG_TESTS="${{ inputs.run_long_tests }}" test-int
+      - run: make MODULE="$env:MODULE" RUN_LONG_TESTS="$env:RUN_LONG_TESTS" test-int
         env:
           LINODE_CLI_TOKEN: ${{ secrets.LINODE_TOKEN_2 }}
+          MODULE: ${{ inputs.module }}
+          RUN_LONG_TESTS: ${{ inputs.run_long_tests }}
 
       - uses: actions/github-script@v9
         id: update-check-run
diff --git a/.github/workflows/e2e-suite.yml b/.github/workflows/e2e-suite.yml
index f4db2acc..b2ff238a 100644
--- a/.github/workflows/e2e-suite.yml
+++ b/.github/workflows/e2e-suite.yml
@@ -117,9 +117,10 @@ jobs:
           pip install .[obj,dev]
 
       - name: Install Package
-        run: make install SPEC="${{ inputs.OPENAPI_SPEC_URL }}"
+        run: make install SPEC="$OPENAPI_SPEC_URL"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          OPENAPI_SPEC_URL: ${{ inputs.OPENAPI_SPEC_URL }}
 
       - name: Set LINODE_CLI_TOKEN
         run: |
@@ -129,9 +130,11 @@ jobs:
         run: |
           timestamp=$(date +'%Y%m%d%H%M')
           report_filename="${timestamp}_cli_test_report.xml"
-          make test-int TEST_ARGS="--junitxml=${report_filename}" TEST_SUITE="${{ inputs.test_suite }}" RUN_LONG_TESTS="${{ inputs.run_long_tests }}"
+          make test-int TEST_ARGS="--junitxml=${report_filename}" TEST_SUITE="$TEST_SUITE" RUN_LONG_TESTS="$RUN_LONG_TESTS"
         env:
           LINODE_CLI_TOKEN: ${{ env.LINODE_CLI_TOKEN }}
+          TEST_SUITE: ${{ inputs.test_suite }}
+          RUN_LONG_TESTS: ${{ inputs.run_long_tests }}
 
       - name: Upload Test Report as Artifact
         if: always()
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d0120a8f..ca5d5e7d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -55,9 +55,11 @@ jobs:
       # DockerFile.
       - uses: actions/github-script@v9
         id: cli_version
+        env:
+          RELEASE_TAG_NAME: ${{ github.event.release.tag_name }}
         with:
           script: |
-            let tag_name = '${{ github.event.release.tag_name }}';
+            let tag_name = process.env.RELEASE_TAG_NAME;
             
             if (tag_name.startsWith("v")) {
               tag_name = tag_name.slice(1);