Unnamed repository; edit this file 'description' to name the repository. http://cgit.235523.xyz/rt-thread.git/atom/.github/workflows/pr_format_bot.yml?h=copilot%2Fbug-security-related-issue 2026-03-20T09:55:47Z 2026-03-20T09:55:47Z sourcecodereviewer 111017510+sourcecodereviewer@users.noreply.github.com 2026-03-20T09:40:17Z urn:sha1:f78bef1207125c3845765bdc46d5529e39f019ff Move user-controlled GitHub Actions context expressions (github.event.pull_request.head.ref, head.repo.full_name, pull_request.number, event.action) from direct interpolation in run: blocks to env: variables. Direct interpolation of these values in shell scripts allows attackers to inject arbitrary commands via crafted branch names under pull_request_target, which runs in the base repo context. Using env: variables ensures values are treated as literal strings by the shell, preventing command injection. Ref: https://securitylab.github.com/research/github-actions-untrusted-input/ Reported-by: Wilson Cyber Research (@sourcecodereviewer) Security: expression-injection 2025-10-01T03:00:07Z CYFS 2805686936@qq.com 2025-10-01T03:00:07Z urn:sha1:d9a6a5307bc915fd715c170c4626f1c4f264651e ci: add concurrency control to GitHub Actions 2025-09-26T01:05:24Z Yuqiang Wang yifang.wangyq@foxmail.com 2025-09-26T01:05:24Z urn:sha1:320aa25ad4cc5f16f0a6c016a7eb776b74cc68da 2025-09-23T10:55:08Z kurisaw 2053731441@qq.com 2025-09-23T10:48:25Z urn:sha1:550d072398de69da8cc892a3e68e82f40b82700e 2025-09-23T09:38:09Z Yuqiang Wang 2053731441@qq.com 2025-09-23T09:38:09Z urn:sha1:4123daf00c807abdae967791b9a25d2d631cafc2 * tools: add clang-format formatting script for CI * improve[ci]: standardize the naming of CI files related to clang-format