tools: align Bash snippets in GHA with lint-sh conventions

aduh95 · aduh95 · commit b82d8cd923c3 · 2026-06-25T16:07:38.000+02:00
Our shell scripts enforce passing arbitrary values via quoted env variables to avoid injections. Signed-off-by: Antoine du Hamel <duhamelantoine1995@gmail.com> PR-URL: #63829 Reviewed-By: Michaël Zasso <targos@protonmail.com> Reviewed-By: Luigi Pinca <luigipinca@gmail.com> Reviewed-By: Colin Ihrig <cjihrig@gmail.com> Reviewed-By: Tierney Cyren <hello@bnb.im>
diff --git a/.github/workflows/comment-labeled.yml b/.github/workflows/comment-labeled.yml
@@ -30,7 +30,7 @@ jobs:
         env:
           NUMBER: ${{ github.event.issue.number || github.event.pull_request.number }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: gh issue comment "$NUMBER" --repo ${{ github.repository }} --body "$STALE_MESSAGE"
+        run: gh issue comment "$NUMBER" --repo "$GITHUB_REPOSITORY" --body "$STALE_MESSAGE"
 
   fast-track:
     permissions:
@@ -41,7 +41,8 @@ jobs:
       - name: Request Fast-Track
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: gh pr comment ${{ github.event.pull_request.number }} --repo ${{ github.repository }} --body "$FAST_TRACK_MESSAGE"
+          NUMBER: ${{ github.event.pull_request.number }}
+        run: gh pr comment "$NUMBER" --repo "$GITHUB_REPOSITORY" --body "$FAST_TRACK_MESSAGE"
 
   notable-change:
     permissions:
@@ -52,4 +53,5 @@ jobs:
       - name: Add notable change description
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: gh pr comment ${{ github.event.pull_request.number }} --repo ${{ github.repository }} --body "$NOTABLE_CHANGE_MESSAGE"
+          NUMBER: ${{ github.event.pull_request.number }}
+        run: gh pr comment "$NUMBER" --repo "$GITHUB_REPOSITORY" --body "$NOTABLE_CHANGE_MESSAGE"
diff --git a/.github/workflows/label-flaky-test-issue.yml b/.github/workflows/label-flaky-test-issue.yml
@@ -49,4 +49,5 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           NUMBER: ${{ github.event.issue.number }}
-        run: gh issue edit "$NUMBER" --repo ${{ github.repository }} --add-label "${{ steps.extract-labels.outputs.LABELS }}"
+          LABELS: ${{ steps.extract-labels.outputs.LABELS }}
+        run: gh issue edit "$NUMBER" --repo "$GITHUB_REPOSITORY" --add-label "$LABELS"
diff --git a/.github/workflows/linters.yml b/.github/workflows/linters.yml
@@ -227,8 +227,10 @@ jobs:
             /tools/lint-pr-url.mjs
             /doc/api/
           sparse-checkout-cone-mode: false
-      # GH Actions squashes all PR commits, HEAD^ refers to the base branch.
-      - run: git diff HEAD^ HEAD -G"pr-url:" -- "*.md" | ./tools/lint-pr-url.mjs ${{ github.event.pull_request.html_url }}
+      # We've checked out a merge commit, HEAD^ refers to the base branch.
+      - run: git diff HEAD^ HEAD -G"pr-url:" -- "*.md" | ./tools/lint-pr-url.mjs "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
   lint-readme:
     runs-on: ubuntu-slim
     steps:
