xj 86dc0feeb4 fix: prevent shell injection in opencode-agents workflow (#722) ...

The triage-issue job interpolated $ISSUE_TITLE and $ISSUE_BODY unquoted
inside a double-quoted shell string, allowing any GitHub user to execute
arbitrary commands by opening an issue with shell metacharacters.

The duplicate-prs job similarly interpolated $COMMENT unquoted into a
gh pr comment --body argument.

Fix both by using printf with %s (prevents shell interpretation) and
--body-file (avoids inline interpolation entirely).

Co-authored-by: xj <gh-xj@users.noreply.github.com>

2026-03-03 16:19:49 -08:00

..

ISSUE_TEMPLATE

docs: split core docs and add issue templates

2026-01-26 16:02:27 -08:00

workflows

fix: prevent shell injection in opencode-agents workflow (#722)

2026-03-03 16:19:49 -08:00

pull_request_template.md

docs(contrib): add PR template and hygiene baseline (#724)

2026-03-03 16:09:38 -08:00