error[template-injection]: code injection via template expansion
  --> /Users/william/tmp/action.yml:70:7
   |
70 |       - name: Install Dependencies
   |         ^^^^^^^^^^^^^^^^^^^^^^^^^^ this step
71 |         # Note tomli required for codespell with pyproject.toml
...
74 |         #   pip install -q git+https://github.com/ultralytics/actions@main codespell tomli
75 | /       run: |
76 | |         packages="ultralytics-actions"
...  |
87 | |
88 | |         ultralytics-actions-info
   | |________________________________^ inputs.spelling may expand into attacker-controllable code
   |
   = note: audit confidence → Low

error[template-injection]: code injection via template expansion
   --> /Users/william/tmp/action.yml:211:7
    |
211 |       - name: Commit and Push Changes
    |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ this step
212 |         if: (github.event_name == 'pull_request' || github.event_name == 'pull_request_target') && github.event.action != 'closed'
213 | /       run: |
214 | |         git config --global user.name "${{ inputs.github_username }}"
...   |
223 | |           echo "No changes to commit"
224 | |         fi
    | |__________^ inputs.github_username may expand into attacker-controllable code
    |
    = note: audit confidence → Low

error[template-injection]: code injection via template expansion
   --> /Users/william/tmp/action.yml:211:7
    |
211 |       - name: Commit and Push Changes
    |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ this step
212 |         if: (github.event_name == 'pull_request' || github.event_name == 'pull_request_target') && github.event.action != 'closed'
213 | /       run: |
214 | |         git config --global user.name "${{ inputs.github_username }}"
...   |
223 | |           echo "No changes to commit"
224 | |         fi
    | |__________^ inputs.github_email may expand into attacker-controllable code
    |
    = note: audit confidence → Low

error[template-injection]: code injection via template expansion
   --> /Users/william/tmp/action.yml:211:7
    |
211 |       - name: Commit and Push Changes
    |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ this step
212 |         if: (github.event_name == 'pull_request' || github.event_name == 'pull_request_target') && github.event.action != 'closed'
213 | /       run: |
214 | |         git config --global user.name "${{ inputs.github_username }}"
...   |
223 | |           echo "No changes to commit"
224 | |         fi
    | |__________^ github.head_ref may expand into attacker-controllable code
    |
    = note: audit confidence → High

error[template-injection]: code injection via template expansion
   --> /Users/william/tmp/action.yml:211:7
    |
211 |       - name: Commit and Push Changes
    |         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ this step
212 |         if: (github.event_name == 'pull_request' || github.event_name == 'pull_request_target') && github.event.action != 'closed'
213 | /       run: |
214 | |         git config --global user.name "${{ inputs.github_username }}"
...   |
223 | |           echo "No changes to commit"
224 | |         fi
    | |__________^ github.ref may expand into attacker-controllable code
    |
    = note: audit confidence → High

5 findings: 0 unknown, 0 informational, 0 low, 0 medium, 5 high