Potential fix for code scanning alert no. 10: Code injection

[juancarlosjr97]

Potential fix for https://github.com/juancarlosjr97/release-it-containerized/security/code-scanning/10

To fix the issue, we will follow the recommended best practice of assigning the untrusted input to an intermediate environment variable and then referencing it using the native shell syntax. This approach ensures that the input is treated as a literal string and not executed as part of a shell command. Specifically:

1. Define an environment variable (HEAD_BRANCH) in the env section of the step, assigning it the value of ${{ github.event.workflow_run.head_branch }}.
2. Reference the environment variable in the shell script using $HEAD_BRANCH instead of ${{ github.event.workflow_run.head_branch }}.

This change will ensure that the input is properly sanitized and prevent potential code injection.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

[Copilot]

Pull Request Overview

This PR addresses a code-scanning alert by isolating untrusted input in an environment variable before use in the shell script, preventing potential code injection.

• Added HEAD_BRANCH as an environment variable in the release_options step.
• Replaced direct ${{ github.event.workflow_run.head_branch }} usage with the $HEAD_BRANCH variable in the script.

Comments suppressed due to low confidence (1)

.github/workflows/release.yaml:20

• Consider adding set -euo pipefail at the start of the script to ensure the step fails on errors or unset variables.

run: |

[Copilot]

[nitpick] Add a brief comment above this line explaining that assigning to HEAD_BRANCH prevents shell injection by treating the input as a literal.

Suggested change

	env:
	env:
	# Assigning to HEAD_BRANCH prevents shell injection by treating the input as a literal.

[Copilot]

[nitpick] You can simplify this step by using $HEAD_BRANCH directly in the conditional checks and remove the extra branch variable to reduce redundancy.

Suggested change

	branch="$HEAD_BRANCH"
	if [ -n "$branch" ] && [ "$branch" = "develop" ]; then
	if [ -n "$HEAD_BRANCH" ] && [ "$HEAD_BRANCH" = "develop" ]; then