Add link to new member playbook to auto-generated PRs #319
Conversation
I always end up having to revisit the rest of the playbook to remember the next steps. This saves me a few keystrokes 😁
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
There was a zizmor warning that I was able to fix with |
| ISSUE_USER: ${{ env.ISSUE_USER }} | ||
| USERNAME: ${{ env.USERNAME }} | ||
| ISSUE_NUMBER: ${{ env.ISSUE_NUMBER }} |
There was a problem hiding this comment.
Something seems off here. Either we don't need to make these re-assignments, or we're no longer capturing the proper data.
There was a problem hiding this comment.
I'm not sure I understand. What zizmor was pointing out in was that the environment variables could be exposed to injection via shell expansion. By refactoring this was that risk is mitigated. I'm seeing all of the variables being used below ... feels like I'm missing something now 😄
There was a problem hiding this comment.
This seems correct to me. By makings these reassignments and using them like this, it stops injection attacks.
It does look a bit weird and unnecessary on first glance, but it is absolutely on purpose 😄
There was a problem hiding this comment.
@Stormheg can you link me to something that explains that? I don't understand why we're putting something into the environment when it's already in the environment.
I always end up having to revisit the rest of the playbook to remember the next steps. This saves me a few keystrokes 😁