Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
cliffhall 85d5bd447e ci(publish): pass release tag via env to avoid script injection ... Re-review nit: interpolating `${{ github.event.release.tag_name }}` directly into the `run:` block is a script-injection surface (a crafted tag with shell metacharacters would splice into the script). Pass it through `env: TAG` so it arrives as a plain shell variable instead. Purely defensive; no behavior change. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BrihGWcrM9JGRyu41nzZYw		2026-07-11 00:16:34 -04:00
..
main.yml	ci(publish): pass release tag via env to avoid script injection	2026-07-11 00:16:34 -04:00