)]}'
{
  "commit": "7f2238d0b409df6437abed4a94cbe020c9c6217b",
  "tree": "cf353b290fd968fc4f593b0dcfd7c7f05374ea7e",
  "parents": [
    "5c11b69c8ee0fdb85ea444fc91e815378a349ee3"
  ],
  "author": {
    "name": "Richard Levasseur",
    "email": "richardlev@gmail.com",
    "time": "Mon Oct 26 21:01:51 2026 -0700"
  },
  "committer": {
    "name": "GitHub",
    "email": "noreply@github.com",
    "time": "Mon Oct 26 21:01:51 2026 -0700"
  },
  "message": "workflows: harden GitHub Actions YAML against injection (#4361)\n\nInterpolating GitHub Actions expressions directly into shell `run:`\nblocks, `actions/github-script` scripts, and `.bazelrc` configs risks\ncommand, script, or flag injection when inputs or refs contain shell\nmetacharacters, newlines, or leading hyphens.\n\nPass workflow inputs and context values through step-scoped `env:`\nvariables, sanitize branch names written to `.bazelrc`, use\n`printf \u0027%s\\n\u0027` instead of `echo`, and guard CLI arguments with\n`--flag\u003dvalue` or `--` separators. Also require `parse_comment` to\nsucceed before posting failure reactions on issue comments.",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "c6fe1a5691efc119839e6e28619d5c2004673538",
      "old_mode": 33188,
      "old_path": ".github/actions/setup-bazel/action.yaml",
      "new_id": "c5c735cf136b79194f05843f45a7fdfc04147131",
      "new_mode": 33188,
      "new_path": ".github/actions/setup-bazel/action.yaml"
    },
    {
      "type": "modify",
      "old_id": "d6766251bbf2cc9b67c18fe52dd3aa7a08dd1b74",
      "old_mode": 33188,
      "old_path": ".github/workflows/backport_create_releases.yaml",
      "new_id": "b97911a3d158732a6ffca35f6fb404f9ccbaabfe",
      "new_mode": 33188,
      "new_path": ".github/workflows/backport_create_releases.yaml"
    },
    {
      "type": "modify",
      "old_id": "293e38996335c7b9095176e0fe88ace5fb1427f3",
      "old_mode": 33188,
      "old_path": ".github/workflows/on_comment.yaml",
      "new_id": "49504163af6fb82387ffd4c308580086d08a37a0",
      "new_mode": 33188,
      "new_path": ".github/workflows/on_comment.yaml"
    },
    {
      "type": "modify",
      "old_id": "f6f4b2b0aa07f8d7006c0a6da72f0ae9c3fedf68",
      "old_mode": 33188,
      "old_path": ".github/workflows/on_pr_closed.yaml",
      "new_id": "932a876522643e1ac23e809f10bddbe36f732231",
      "new_mode": 33188,
      "new_path": ".github/workflows/on_pr_closed.yaml"
    },
    {
      "type": "modify",
      "old_id": "8060ff921e0728f0f1ea1756122e2cc85d5d10fa",
      "old_mode": 33188,
      "old_path": ".github/workflows/pr-metadata-checks.yaml",
      "new_id": "67b3b77649377612d5b80c65bce84c5f74e57c85",
      "new_mode": 33188,
      "new_path": ".github/workflows/pr-metadata-checks.yaml"
    },
    {
      "type": "modify",
      "old_id": "345009325fd26e10ffafddcf645f838138419f36",
      "old_mode": 33188,
      "old_path": ".github/workflows/publish_pypi.yaml",
      "new_id": "6273c526ffdcbb39ca1a1d736da5e9996b604530",
      "new_mode": 33188,
      "new_path": ".github/workflows/publish_pypi.yaml"
    },
    {
      "type": "modify",
      "old_id": "db28a036421071e61eb760d81245ad119b1d6afb",
      "old_mode": 33188,
      "old_path": ".github/workflows/release_add_backports.yaml",
      "new_id": "3dac0a4720729fc2e1b4956c41c2ee366b080222",
      "new_mode": 33188,
      "new_path": ".github/workflows/release_add_backports.yaml"
    },
    {
      "type": "modify",
      "old_id": "073c86323784eb1ea11a8bc81f7a969bb2b69614",
      "old_mode": 33188,
      "old_path": ".github/workflows/release_build_artifacts.yaml",
      "new_id": "bbab6c6d85676ea24ed3442839f290cb0e859d93",
      "new_mode": 33188,
      "new_path": ".github/workflows/release_build_artifacts.yaml"
    },
    {
      "type": "modify",
      "old_id": "1c6f91738b0bab5b2ca3b1ce7dbaa08fe1718f70",
      "old_mode": 33188,
      "old_path": ".github/workflows/release_create_rc.yaml",
      "new_id": "fc3ac53d5c905f36fd3c2b56ae5d5a507576499c",
      "new_mode": 33188,
      "new_path": ".github/workflows/release_create_rc.yaml"
    },
    {
      "type": "modify",
      "old_id": "dac263e04a2957631e1b7de97446b3eb009138a1",
      "old_mode": 33188,
      "old_path": ".github/workflows/release_create_release_branch.yaml",
      "new_id": "f7db11aa99a16a5ce932d3f7b255634c49d56f34",
      "new_mode": 33188,
      "new_path": ".github/workflows/release_create_release_branch.yaml"
    },
    {
      "type": "modify",
      "old_id": "483bffdb788c399cd4d21770fb2a928021e89f6d",
      "old_mode": 33188,
      "old_path": ".github/workflows/release_process_backports.yaml",
      "new_id": "60c6a43af04aefc7eaecc2987394f8bdfd09151b",
      "new_mode": 33188,
      "new_path": ".github/workflows/release_process_backports.yaml"
    },
    {
      "type": "modify",
      "old_id": "79b50951ef57df6309b0cd4646708fbb0fcf3bb0",
      "old_mode": 33188,
      "old_path": ".github/workflows/release_promote.yaml",
      "new_id": "a65eb698b2b4763a3a8a8ad9cd5ff7d77dbbd01a",
      "new_mode": 33188,
      "new_path": ".github/workflows/release_promote.yaml"
    }
  ]
}