From 513d9e2b8c11ad0c10c136c3900b66d5a8875aaa Mon Sep 17 00:00:00 2001
From: Chris Wolfgang <210299580+Chris-Wolfgang@users.noreply.github.com>
Date: Tue, 22 Sep 2026 23:03:39 -0400
Subject: [PATCH] security(ci): pass the resolved package version to apicompat
 through env

zizmor's second template-injection finding in this repository: api-compat.yaml
spliced ${{ steps.nuget.outputs.version }} straight into the bash script that
downloads the previous package, so a step output was parsed as shell rather than
read as data. The value is produced by the preceding step from NuGet's own
version list, but "a step output reaches a run: body by expansion" is the shape
the rule exists to catch, and the fix costs nothing.

The version now arrives as PREV_VERSION and the script reads it with normal
quoting. Behaviour is unchanged.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 .github/workflows/api-compat.yaml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/api-compat.yaml b/.github/workflows/api-compat.yaml
index 9f677470..4d3b8ef7 100644
--- a/.github/workflows/api-compat.yaml
+++ b/.github/workflows/api-compat.yaml
@@ -90,9 +90,13 @@ jobs:
 
       - name: Download previous .nupkg + extract
         shell: bash
+        # The resolved version arrives through env rather than template expansion, so a step
+        # output is never spliced into the script body (zizmor template-injection).
+        env:
+          PREV_VERSION: ${{ steps.nuget.outputs.version }}
         run: |
           set -euo pipefail
-          v='${{ steps.nuget.outputs.version }}'
+          v="$PREV_VERSION"
           mkdir -p ./previous
           curl -fsSL "https://api.nuget.org/v3-flatcontainer/wolfgang.trypattern/$v/wolfgang.trypattern.$v.nupkg" \
             -o "./previous/wolfgang.trypattern.$v.nupkg"