From 0b2927dfcd38b2a7459530749095ae40cafee845 Mon Sep 17 00:00:00 2001
From: Stephen Crowe <6042774+crowecawcaw@users.noreply.github.com>
Date: Fri, 26 Jun 2026 13:21:16 -0700
Subject: [PATCH] fix: pass GitHub event context via env vars in reusable
 workflows

Move github.event.* interpolations (pull_request.number, event.action,
repository.name) out of inline run: scripts and into env: blocks so they
are referenced as shell variables rather than templated into script text.

Resolves ACAT script-injection finding 540a0df3-f469-4f97-ad17-b1ed5d37023d
(Bea-57529). These values are GitHub-controlled and structurally constrained,
so this is defense-in-depth, but it clears the scanner pattern permanently.

Signed-off-by: Stephen Crowe <6042774+crowecawcaw@users.noreply.github.com>
---
 .github/workflows/reusable_bump.yml              | 4 +++-
 .github/workflows/reusable_record_pr_details.yml | 7 +++++--
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/reusable_bump.yml b/.github/workflows/reusable_bump.yml
index 35bfb49..04adad0 100644
--- a/.github/workflows/reusable_bump.yml
+++ b/.github/workflows/reusable_bump.yml
@@ -74,9 +74,11 @@ jobs:
           git checkout -b bump/$NEXT_SEMVER
 
       - name: GenerateChangeLog
+        env:
+          REPO_NAME: ${{ github.event.repository.name }}
         run: |
           PREV_TAG=$(git describe --tags --abbrev=0)
-          NOTES=$(python .dot-github/.github/scripts/generate_release_notes.py "$NEXT_SEMVER" --since "$PREV_TAG" --repo "${{ github.event.repository.name }}")
+          NOTES=$(python .dot-github/.github/scripts/generate_release_notes.py "$NEXT_SEMVER" --since "$PREV_TAG" --repo "$REPO_NAME")
 
           # Prepend new release notes to the original changelog
           echo "$NOTES" > NEW_LOG.md
diff --git a/.github/workflows/reusable_record_pr_details.yml b/.github/workflows/reusable_record_pr_details.yml
index 9dc7b29..435a4e5 100644
--- a/.github/workflows/reusable_record_pr_details.yml
+++ b/.github/workflows/reusable_record_pr_details.yml
@@ -15,10 +15,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Create PR info artifact
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          PR_ACTION: ${{ github.event.action }}
         run: |
           mkdir -p ./pr-info
-          echo "${{ github.event.pull_request.number }}" > ./pr-info/pr-number.txt
-          echo "${{ github.event.action }}" > ./pr-info/pr-action.txt
+          echo "$PR_NUMBER" > ./pr-info/pr-number.txt
+          echo "$PR_ACTION" > ./pr-info/pr-action.txt
       
       - name: Upload PR info artifact
         uses: actions/upload-artifact@v4