[Copilot]

GitHub code scanning alert #14 flagged expression injection vulnerabilities where untrusted/user-controlled context values were interpolated directly into run: scripts via ${{ }}, and secrets were exposed inline in Docker command arguments.

Changes

release-winget.yml — expression injection in PowerShell scripts

User-controlled values (github.event.inputs.version, github.ref_type, github.ref_name, github.repository, steps.version.outputs.value) were embedded directly into PowerShell run: blocks. Moved all to step-level env: and access via $env:VAR:

# Before
run: |
  $value = "${{ github.event.inputs.version }}"
  if (-not $value -and "${{ github.ref_type }}" -eq "tag") { ... }

# After
env:
  INPUT_VERSION: ${{ github.event.inputs.version }}
  GIT_REF_TYPE: ${{ github.ref_type }}
run: |
  $value = $env:INPUT_VERSION
  if (-not $value -and $env:GIT_REF_TYPE -eq "tag") { ... }

python.yml / release-pypi.yml — secret exposed in Docker command line

PYPI_TOKEN was inlined as -e TWINE_PASSWORD=${{ secrets.PYPI_TOKEN }}, putting the secret value in the shell command. Moved to step env: and use Docker's environment inheritance:

# Before
run: |
  docker run ... -e TWINE_PASSWORD=${{ secrets.PYPI_TOKEN }} ...

# After
env:
  TWINE_PASSWORD: ${{ secrets.PYPI_TOKEN }}
run: |
  docker run ... -e TWINE_PASSWORD ...

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.