From 962dde02f651a645724c699167c198ae112d4c71 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 25 Aug 2026 21:04:04 +0000
Subject: [PATCH 1/2] Improve workflow security: add least-privilege
 permissions and fix output injection

Co-authored-by: Anush008 <46051506+Anush008@users.noreply.github.com>
---
 .github/workflows/release.yml | 8 ++++++--
 .github/workflows/test.yml    | 8 ++++++++
 2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d546b6b..44b7b3a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -7,6 +7,10 @@ env:
 jobs:
   release:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
     steps:
       - name: "☁️ checkout repository"
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
@@ -27,8 +31,8 @@ jobs:
         run: |
           AUTHOR_NAME=$(git log -1 --pretty=format:%an ${{ github.sha }})
           AUTHOR_EMAIL=$(git log -1 --pretty=format:%ae ${{ github.sha }})
-          echo "AUTHOR_NAME=$AUTHOR_NAME" >> $GITHUB_OUTPUT
-          echo "AUTHOR_EMAIL=$AUTHOR_EMAIL" >> $GITHUB_OUTPUT
+          printf 'AUTHOR_NAME=%s\n' "$AUTHOR_NAME" >> $GITHUB_OUTPUT
+          printf 'AUTHOR_EMAIL=%s\n' "$AUTHOR_EMAIL" >> $GITHUB_OUTPUT
         id: author_info
   
       - name: "Semantic release🚀"
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index eb9f9d2..6965e69 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -12,6 +12,8 @@ env:
 jobs:
   build-onnx:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
       - name: Restore ONNX Build
@@ -40,6 +42,8 @@ jobs:
   test:
     needs: build-onnx
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     env:
       HF_TOKEN: ${{ secrets.HF_TOKEN }}
     strategy:
@@ -74,6 +78,8 @@ jobs:
 
   lint:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
@@ -92,6 +98,8 @@ jobs:
 
   clippy-features:
     runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:

From acd514447d2a7598e35f19eff5e4dc01f1c502b5 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Wed, 26 Aug 2026 04:55:41 +0000
Subject: [PATCH 2/2] fix(ci): use heredoc delimiter syntax for GITHUB_OUTPUT
 to prevent injection

Co-authored-by: Anush008 <46051506+Anush008@users.noreply.github.com>
---
 .github/workflows/release.yml | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 44b7b3a..ba4f460 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -28,12 +28,18 @@ jobs:
         run: bun install -D @semantic-release/git conventional-changelog-conventionalcommits@8 semantic-release-cargo
 
       - name: Get Author Name and Email
+        id: author_info
         run: |
           AUTHOR_NAME=$(git log -1 --pretty=format:%an ${{ github.sha }})
           AUTHOR_EMAIL=$(git log -1 --pretty=format:%ae ${{ github.sha }})
-          printf 'AUTHOR_NAME=%s\n' "$AUTHOR_NAME" >> $GITHUB_OUTPUT
-          printf 'AUTHOR_EMAIL=%s\n' "$AUTHOR_EMAIL" >> $GITHUB_OUTPUT
-        id: author_info
+          {
+            echo "AUTHOR_NAME<<EOF"
+            echo "$AUTHOR_NAME"
+            echo "EOF"
+            echo "AUTHOR_EMAIL<<EOF"
+            echo "$AUTHOR_EMAIL"
+            echo "EOF"
+          } >> "$GITHUB_OUTPUT"
   
       - name: "Semantic release🚀"
         id: release