From 65c34b98bd43982da258c8a5f91955304d173821 Mon Sep 17 00:00:00 2001
From: tanya732 <sinha.tanya26@gmail.com>
Date: Tue, 4 Aug 2026 20:17:36 +0530
Subject: [PATCH] ci: GitHub Actions against script injection

---
 .github/actions/maven-publish/action.yml | 4 +++-
 .github/workflows/rl-scanner.yml         | 4 +++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/.github/actions/maven-publish/action.yml b/.github/actions/maven-publish/action.yml
index 70a3aec33..5e519b4df 100644
--- a/.github/actions/maven-publish/action.yml
+++ b/.github/actions/maven-publish/action.yml
@@ -22,11 +22,13 @@ runs:
 
     - name: Setup Java
       shell: bash
+      env:
+        JAVA_VERSION: ${{ inputs.java-version }}
       run: |
         curl -s "https://get.sdkman.io" | bash
         source "/home/runner/.sdkman/bin/sdkman-init.sh"
         sdk list java
-        sdk install java ${{ inputs.java-version }} && sdk default java ${{ inputs.java-version }}
+        sdk install java "$JAVA_VERSION" && sdk default java "$JAVA_VERSION"
         export JAVA_HOME=${SDKMAN_DIR}/candidates/java/current
         echo "JAVA_HOME is set to $JAVA_HOME"
 
diff --git a/.github/workflows/rl-scanner.yml b/.github/workflows/rl-scanner.yml
index 2b53f6f4a..4b49b98f6 100644
--- a/.github/workflows/rl-scanner.yml
+++ b/.github/workflows/rl-scanner.yml
@@ -53,8 +53,10 @@ jobs:
         uses: ./.github/actions/get-version
 
       - name: Create tgz build artifact
+        env:
+          ARTIFACT_NAME: ${{ inputs.artifact-name }}
         run: |
-          tar -czvf ${{ inputs.artifact-name }} *
+          tar -czvf "$ARTIFACT_NAME" *
 
       - name: Run RL Scanner
         id: rl-scan-conclusion