cmake: Fixes for CVE-2022-43552, CVE-2023-27536, CVE-2023-27535, CVE-2023-27538, CVE-2023-23916 and CVE-2023-46218 #34876

	# Copyright (c) Microsoft Corporation.
	# Licensed under the MIT License.

	name: Check Package CGManifests

	on:
	push:
	branches: [main, dev, 1.0, 2.0, fasttrack/*]
	pull_request:
	branches: [main, dev, 1.0, 2.0, fasttrack/*]

	permissions: read-all

	jobs:

	build:
	name: Check Package CGManifests
	runs-on: ubuntu-latest
	steps:

	- name: Check out code
	uses: actions/checkout@v4

	- name: Get base commit for PRs
	if: ${{ github.event_name == 'pull_request' }}
	run: \|
	git fetch origin ${{ github.base_ref }}
	echo "base_sha=$(git rev-parse origin/${{ github.base_ref }})" >> $GITHUB_ENV
	echo "Merging ${{ github.sha }} into ${{ github.base_ref }}"

	- name: Get base commit for Pushes
	if: ${{ github.event_name == 'push' }}
	run: \|
	git fetch origin ${{ github.event.before }}
	echo "base_sha=${{ github.event.before }}" >> $GITHUB_ENV
	echo "Merging ${{ github.sha }} into ${{ github.event.before }}"

	- name: Get the changed files
	run: \|
	echo "Files changed: '$(git diff-tree --no-commit-id --name-only -r ${{ env.base_sha }} ${{ github.sha }})'"
	changed_specs=$(git diff-tree --diff-filter=d --no-commit-id --name-only -r ${{ env.base_sha }} ${{ github.sha }} \| { grep "SPECS./.\.spec$" \|\| test $? = 1; })
	echo "Files to validate: '${changed_specs}'"
	echo "updated-specs=$(echo ${changed_specs})" >> $GITHUB_ENV

	- name: Check each spec
	run: \|
	.github/workflows/overwrite_shell_link.sh
	.github/workflows/validate-cg-manifest.sh ${{ env.updated-specs }}

Provide feedback