fix(lint): exclude GitHub Actions expressions from noTemplateCurlyInString

GitHub Actions uses `${{ ... }}` syntax (double curly braces) which was
incorrectly flagged as a template literal placeholder. This fix detects
and skips patterns that have double opening braces followed by double
closing braces, as these are GitHub Actions expressions, not JavaScript
template literal mistakes.

Author: claude

crates/biome_js_analyze/src/lint/suspicious/no_template_curly_in_string.rs

@@ -40,6 +40,12 @@ declare_lint_rule! {
     /// const a = templateFunction`Hello ${name}`;
     /// ```
     ///
+    /// GitHub Actions expressions using double curly braces are also valid:
+    ///
+    /// ```js
+    /// const a = "${{ inputs.abc }}";
+    /// ```
+    ///
     pub NoTemplateCurlyInString {
         version: "1.9.3",
         name: "noTemplateCurlyInString",
@@ -61,13 +67,23 @@ impl Rule for NoTemplateCurlyInString {
         let token = node.value_token().ok()?;
         let text = token.text_trimmed();
 
-        let mut byte_iter = text.bytes().enumerate();
+        let mut byte_iter = text.bytes().enumerate().peekable();
         while let Some((i, byte)) = byte_iter.next() {
             if byte == b'$'
                 && let Some((_, b'{')) = byte_iter.next()
             {
+                // Check for GitHub Actions syntax: ${{ ... }}
+                // Skip if we have double braces on both sides
+                let is_double_open = byte_iter.peek().is_some_and(|(_, b)| *b == b'{');
+
                 for (j, inner_byte) in byte_iter.by_ref() {
                     if inner_byte == b'}' {
+                        // For ${{ syntax, only skip if it closes with }}
+                        if is_double_open && byte_iter.peek().is_some_and(|(_, b)| *b == b'}') {
+                            // This is GitHub Actions syntax ${{ ... }}, skip it
+                            byte_iter.next(); // consume the second }
+                            break;
+                        }
                         return Some((i as u32, (j + 1) as u32));
                     }
                 }

crates/biome_js_analyze/tests/specs/suspicious/noTemplateCurlyInString/valid.js

@@ -12,4 +12,10 @@ let a = '$2';
 let a = '${';
 let a = '$}';
 let a = '{foo}';
-let a = '{foo: "bar"}';
+let a = '{foo: "bar"}';
+
+// GitHub Actions expressions (double curly braces)
+let a = "${{ inputs.abc }}";
+let a = '${{ github.event.action }}';
+let a = "environment: ${{ inputs.environment }}";
+let a = "${{ secrets.MY_SECRET }}";

crates/biome_js_analyze/tests/specs/suspicious/noTemplateCurlyInString/valid.js.snap

@@ -19,4 +19,10 @@ let a = '${';
 let a = '$}';
 let a = '{foo}';
 let a = '{foo: "bar"}';
+
+// GitHub Actions expressions (double curly braces)
+let a = "${{ inputs.abc }}";
+let a = '${{ github.event.action }}';
+let a = "environment: ${{ inputs.environment }}";
+let a = "${{ secrets.MY_SECRET }}";
 ```