safe branch

Author: Artmann

.github/workflows/package.yml

@@ -55,17 +55,20 @@ jobs:
 
       - name: Extract and sanitize branch name
         id: branch-name
+        env:
+          UNTRUSTED_HEAD_REF: ${{ github.head_ref }}
+          EVENT_NAME: ${{ github.event_name }}
         run: |
-          # Get branch name from ref
-          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
-            BRANCH="${{ github.head_ref }}"
+          # Get branch name from ref (use env vars to avoid direct interpolation)
+          if [[ "$EVENT_NAME" == "pull_request" ]]; then
+            BRANCH="$UNTRUSTED_HEAD_REF"
           else
             BRANCH="${GITHUB_REF#refs/heads/}"
           fi
           # Sanitize branch name for filename (replace / with -)
-          SAFE_BRANCH=$(echo "$BRANCH" | sed 's/\//-/g')
-          echo "branch=$SAFE_BRANCH" >> $GITHUB_OUTPUT
-          echo "Branch name: $BRANCH (sanitized: $SAFE_BRANCH)"
+          SAFE_BRANCH=$(printf '%s' "$BRANCH" | sed 's/\//-/g')
+          printf 'branch=%s\n' "$SAFE_BRANCH" >> "$GITHUB_OUTPUT"
+          printf 'Branch name: %s (sanitized: %s)\n' "$BRANCH" "$SAFE_BRANCH"
 
       - name: Package extension
         run: npm run package