From be73c1e9b47fd8f50e86084ca8abac72c60aeb13 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 27 Mar 2026 02:12:44 +0000
Subject: [PATCH 1/2] Initial plan


From 5829e61bb5dca2cffe97a9b418224560cd2fe211 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 27 Mar 2026 02:16:37 +0000
Subject: [PATCH 2/2] Fix security code scanning alert #14: expression
 injection in GitHub Actions workflows

Agent-Logs-Url: https://github.com/BYVoid/OpenCC/sessions/31e9f14d-f16c-4187-bfde-264193ae0543

Co-authored-by: BYVoid <245270+BYVoid@users.noreply.github.com>
---
 .github/workflows/python.yml         |  7 +++++--
 .github/workflows/release-pypi.yml   |  7 +++++--
 .github/workflows/release-winget.yml | 17 ++++++++++++-----
 3 files changed, 22 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/python.yml b/.github/workflows/python.yml
index 7ac251f48..443ac3930 100644
--- a/.github/workflows/python.yml
+++ b/.github/workflows/python.yml
@@ -77,10 +77,13 @@ jobs:
 
       - name: Build package and upload from docker (Linux)
         if: runner.os == 'Linux'
+        env:
+          TWINE_USERNAME: __token__
+          TWINE_PASSWORD: ${{ secrets.PYPI_TOKEN }}
         run: |
           docker run --rm -v "${PWD}:/opt/OpenCC" \
-            -e TWINE_USERNAME=__token__ \
-            -e TWINE_PASSWORD=${{ secrets.PYPI_TOKEN }} \
+            -e TWINE_USERNAME \
+            -e TWINE_PASSWORD \
             -e VERSION=${VERSION} \
             ubuntu:22.04 /bin/bash /opt/OpenCC/release-pypi-linux.sh testonly
 
diff --git a/.github/workflows/release-pypi.yml b/.github/workflows/release-pypi.yml
index e5602b136..451ad3585 100644
--- a/.github/workflows/release-pypi.yml
+++ b/.github/workflows/release-pypi.yml
@@ -25,10 +25,13 @@ jobs:
 
     - name: Build package and upload from docker (Linux)
       if: runner.os == 'Linux'
+      env:
+        TWINE_USERNAME: __token__
+        TWINE_PASSWORD: ${{ secrets.PYPI_TOKEN }}
       run: |
         docker run --rm -v "${PWD}:/opt/OpenCC" \
-          -e TWINE_USERNAME=__token__ \
-          -e TWINE_PASSWORD=${{ secrets.PYPI_TOKEN }} \
+          -e TWINE_USERNAME \
+          -e TWINE_PASSWORD \
           -e VERSION=${VERSION} \
           ubuntu:22.04 /bin/bash /opt/OpenCC/release-pypi-linux.sh
 
diff --git a/.github/workflows/release-winget.yml b/.github/workflows/release-winget.yml
index eabe4efb7..94da6bde7 100644
--- a/.github/workflows/release-winget.yml
+++ b/.github/workflows/release-winget.yml
@@ -31,10 +31,14 @@ jobs:
       - name: Resolve version
         id: version
         shell: pwsh
+        env:
+          INPUT_VERSION: ${{ github.event.inputs.version }}
+          GIT_REF_TYPE: ${{ github.ref_type }}
+          GIT_REF_NAME: ${{ github.ref_name }}
         run: |
-          $value = "${{ github.event.inputs.version }}"
-          if (-not $value -and "${{ github.ref_type }}" -eq "tag") {
-            $value = "${{ github.ref_name }}"
+          $value = $env:INPUT_VERSION
+          if (-not $value -and $env:GIT_REF_TYPE -eq "tag") {
+            $value = $env:GIT_REF_NAME
           }
           if ($value.StartsWith("ver.")) {
             $clean = $value.Substring(4)
@@ -47,11 +51,14 @@ jobs:
 
       - name: Build portable release and WinGet manifests
         shell: pwsh
+        env:
+          RELEASE_VERSION: ${{ steps.version.outputs.value }}
+          GITHUB_REPO: ${{ github.repository }}
         run: |
           ./scripts/release-windows-winget.ps1 `
-            -Version "${{ steps.version.outputs.value }}" `
+            -Version "$env:RELEASE_VERSION" `
             -OutputDir release `
-            -GitHubRepository "${{ github.repository }}" `
+            -GitHubRepository "$env:GITHUB_REPO" `
             -PackageIdentifier "BYVoid.OpenCC" `
             -Publisher "BYVoid"