tree 4c86f4f9236039c017ad065c0829962a2c37f887
parent 3fa7bd9cee2cfdf3499a8803b226e43de7b7cdb4
author Roland Shoemaker <roland@golang.org> 1783373425 -0700
committer Gopher Robot <gobot@golang.org> 1783438624 -0700

action.yml: use step-level env vars instead of direct vars in commands

It seems unlikely that users would configure this action in a way to
allow injection of malicious content into the commands we run, but
better to be safe here, since GitHub Actions are a footgun with a hair
trigger.

Change-Id: I8d137a1f98f832c8d22506b309f20644fc74e4ec
Reviewed-on: https://go-review.googlesource.com/c/govulncheck-action/+/797300
Reviewed-by: Neal Patel <nealpatel@google.com>
Reviewed-by: Neal Patel <neal@golang.org>
TryBot-Bypass: Roland Shoemaker <roland@golang.org>
Auto-Submit: Roland Shoemaker <roland@golang.org>
Commit-Queue: Roland Shoemaker <roland@golang.org>