fix: complete script injection hardening across all actions

[vaind]

Summary

Follow-up to #150 which moved user inputs to env vars but left step outputs (steps.*.outputs.*) directly interpolated in run: blocks. An attacker controlling e.g. git tags in a dependency repo could still inject arbitrary commands.

• updater/action.yml: Move all remaining step outputs (tags, URLs, branch names) to env: blocks; replace PowerShell double-quote string interpolation with concatenation throughout to eliminate any possibility of subexpression evaluation
• sentry-cli/integration-test/action.yml: Same double-quote to concatenation fix
• danger/action.yml: Move Docker image version tag from direct ${{ }} interpolation to env var with semver validation

After this change, the only ${{ }} expressions remaining in run: blocks are GitHub-controlled values (github.action_path, github.repository, github.repository_owner).

Refs: VULN-1100

Test plan

• Verify updater action still works (dependency name/path validation, PR creation, changelog update)
• Verify danger action still runs (container setup with version from properties file)
• Verify sentry-cli integration tests still pass

🤖 Generated with Claude Code

[linear-code]

VULN-1100 Command Injection vulnerabilities in getsentry/github-workflows in 4 locations

[Copilot]

Pull request overview

Hardens composite GitHub Actions against script injection by removing direct interpolation of step outputs into run: blocks and by avoiding PowerShell double-quoted interpolation patterns.

Changes:

• updater/action.yml: Move step outputs into env: and switch to PowerShell string concatenation for output/log construction.
• sentry-cli/integration-test/action.yml: Replace PowerShell double-quoted interpolation with concatenation.
• danger/action.yml: Pass Docker image version via env with a semver format validation before use.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
updater/action.yml	Reworks multiple pwsh steps to avoid ${{ steps.* }} in run: and removes double-quoted interpolation in favor of concatenation.
sentry-cli/integration-test/action.yml	Updates module import and Pester invocation to avoid double-quoted interpolation.
danger/action.yml	Uses DANGER_VERSION env var for the Docker image tag and validates it as semver to prevent injection.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The GitHub API endpoint string is built by concatenating unencoded query parameter values ($env:BASE_BRANCH and $env:PR_BRANCH). Because DEPENDENCY_PATH validation allows characters like '#', the resulting branch name can contain '#', which will be treated as a URL fragment delimiter and truncate the request. Prefer passing query params via gh api -f base=... -f head=... (lets gh handle encoding) or explicitly URL-encode these values before concatenation.

Suggested change

	$apiUrl = 'repos/${{ github.repository }}/pulls?base=' + $env:BASE_BRANCH + '&head=${{ github.repository_owner }}:' + $env:PR_BRANCH
	$urls = @(gh api $apiUrl --jq '.[].html_url')
	$urls = @(
	gh api `
	repos/${{ github.repository }}/pulls `
	-f "base=$env:BASE_BRANCH" `
	-f "head=${{ github.repository_owner }}:$env:PR_BRANCH" `
	--jq '.[].html_url'
	)

[Copilot]

When $urls is an array (the branch where this throw happens), concatenating it into a string will produce an unhelpful value (often "System.Object[]") instead of the matched URLs. Consider joining the array (e.g., with -join) so the exception message contains the actual URLs for debugging.

Suggested change

	throw ('Unexpected number of PRs matched (' + $urls.Length + '): ' + $urls)
	throw ('Unexpected number of PRs matched (' + $urls.Length + '): ' + ($urls -join ', '))