From 9f3994c084d8a5b5e591323ba6eb8864874c8f5b Mon Sep 17 00:00:00 2001
From: utkrishtS <utkrisht.sahu@okta.com>
Date: Thu, 16 Jul 2026 10:09:05 +0530
Subject: [PATCH] fix(ci): prevent workflow script injection via env vars

---
 .github/actions/setup/action.yml | 9 ++++++---
 .github/workflows/publish.yml    | 7 ++++++-
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/.github/actions/setup/action.yml b/.github/actions/setup/action.yml
index c3c163c..ddece6d 100644
--- a/.github/actions/setup/action.yml
+++ b/.github/actions/setup/action.yml
@@ -24,11 +24,14 @@ runs:
         distribution: temurin
         java-version: ${{ inputs.java }}
 
-    - run: |
+    - env:
+        GRADLE: ${{ inputs.gradle }}
+        KOTLIN: ${{ inputs.kotlin }}
+      run: |
         curl -s "https://get.sdkman.io" | bash
         source "$HOME/.sdkman/bin/sdkman-init.sh"
-        sdk install gradle ${{ inputs.gradle }} && sdk default gradle ${{ inputs.gradle }}
-        sdk install kotlin ${{ inputs.kotlin }} && sdk default kotlin ${{ inputs.kotlin }}
+        sdk install gradle "$GRADLE" && sdk default gradle "$GRADLE"
+        sdk install kotlin "$KOTLIN" && sdk default kotlin "$KOTLIN"
       shell: bash
 
     - run: ./gradlew androidDependencies
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index ef49f37..dbf2b08 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -29,4 +29,9 @@ jobs:
 
       - run: ./gradlew exportVersion -PisSnapshot=false
 
-      - run: ./gradlew publishAndroidLibraryPublicationToMavenRepository -PossrhUsername="${{ secrets.OSSR_USERNAME }}" -PossrhPassword="${{ secrets.OSSR_PASSWORD }}" -PsigningKey="${{ secrets.SIGNING_KEY }}" -PsigningPassword="${{ secrets.SIGNING_PASSWORD }}" -PisSnapshot=false"
+      - env:
+          OSSR_USERNAME: ${{ secrets.OSSR_USERNAME }}
+          OSSR_PASSWORD: ${{ secrets.OSSR_PASSWORD }}
+          SIGNING_KEY: ${{ secrets.SIGNING_KEY }}
+          SIGNING_PASSWORD: ${{ secrets.SIGNING_PASSWORD }}
+        run: ./gradlew publishAndroidLibraryPublicationToMavenRepository -PossrhUsername="$OSSR_USERNAME" -PossrhPassword="$OSSR_PASSWORD" -PsigningKey="$SIGNING_KEY" -PsigningPassword="$SIGNING_PASSWORD" -PisSnapshot=false