From d43acaf80ce3e150455fe22702318728801ea707 Mon Sep 17 00:00:00 2001
From: XananasX7 <mehdiananas007@gmail.com>
Date: Sat, 13 Jun 2026 16:25:35 +0000
Subject: [PATCH] ci: harden workflow against expression injection

Interpolating GitHub context values directly into `run:` steps creates
an expression-injection vector. Move the affected values into an `env:`
block and reference them as environment variables in the shell script
instead. This prevents shell metacharacters in context values from
altering step behaviour.

Signed-off-by: El Mehdi Abenhazou <mehdiananas007@gmail.com>
---
 .github/workflows/benchmark-compare.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/benchmark-compare.yml b/.github/workflows/benchmark-compare.yml
index 84288b4a3fd..5fbb657ce34 100644
--- a/.github/workflows/benchmark-compare.yml
+++ b/.github/workflows/benchmark-compare.yml
@@ -63,12 +63,12 @@ jobs:
           COMMENT_BODY: ${{ github.event.comment.body }}
         run: pnpm benchmarks prepare-for-github-action "$COMMENT_BODY"
 
-      - run: pnpm benchmarks run-compare "$COMPARE_SHA" "$BENCHMARK_TARGET"
+      - env:
+          COMPARE_SHA: ${{steps.info.outputs.compareSha}}
+          BENCHMARK_TARGET: ${{steps.info.outputs.benchmarkTarget}}
+        run: pnpm benchmarks run-compare "$COMPARE_SHA" "$BENCHMARK_TARGET"
         id: benchmark
         name: Running benchmark
-        env:
-          BENCHMARK_TARGET: ${{steps.info.outputs.benchmarkTarget}}
-          COMPARE_SHA: ${{steps.info.outputs.compareSha}}
 
       - uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5
         with: