workflows/vendor-version: fix template-injection warnings

Fixes https://github.com/Homebrew/brew/security/code-scanning/40 Fixes https://github.com/Homebrew/brew/security/code-scanning/41
Homebrew · Oct 30, 2024 · 6bddbb5 · 6bddbb5
1 parent 6469a24
commit 6bddbb5
Showing 1 changed file with 6 additions and 4 deletions.
diff --git a/.github/workflows/vendor-version.yml b/.github/workflows/vendor-version.yml
@@ -37,20 +37,22 @@ jobs:
         working-directory: ${{ steps.set-up-homebrew.outputs.gems-path }}/${{ steps.ruby-abi.outputs.version }}/gems
         run: |
           {
-            echo "vendor-version=$(cat ../.homebrew_vendor_version)"
+            echo "vendor-version=$(<../.homebrew_vendor_version)"
             echo "ignored<<EOS"
             git check-ignore -- *
             echo "EOS"
           } >> "${GITHUB_OUTPUT}"
 
       - name: Compare to base ref
         working-directory: ${{ steps.set-up-homebrew.outputs.gems-path }}/${{ steps.ruby-abi.outputs.version }}
+        env:
+          VENDOR_VERSION: ${{ steps.gem-info.outputs.vendor-version }}
+          IGNORED_GEMS: ${{ steps.gem-info.outputs.ignored }}
         run: |
           git checkout "origin/${GITHUB_BASE_REF}"
           rm .homebrew_vendor_version
           brew install-bundler-gems --groups=all
-          if [[ "$(cat .homebrew_vendor_version)" == "${{ steps.gem-info.outputs.vendor-version }}" ]]; then
-            ignored_gems="${{ steps.gem-info.outputs.ignored }}"
+          if [[ "$(<.homebrew_vendor_version)" == "${VENDOR_VERSION}" ]]; then
             while IFS= read -r gem; do
               gem_dir="./gems/${gem}"
               [[ -d "${gem_dir}" ]] || continue
@@ -64,5 +66,5 @@ jobs:
                 fi
                 exit "${exit_code}"
               fi
-            done <<< "${ignored_gems}"
+            done <<< "${IGNORED_GEMS}"
           fi