From 7ba8484b4431725ab655d895102e80a84dbaaa9b Mon Sep 17 00:00:00 2001
From: "C.Lee Taylor" <47312074+leet4tari@users.noreply.github.com>
Date: Tue, 5 Dec 2023 11:59:04 +0200
Subject: [PATCH] ci(fix): prevent code injection (#214)

Update pr_title workflow, to prevent code injection.
---
 .github/workflows/pr_title.yml | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/pr_title.yml b/.github/workflows/pr_title.yml
index dd7905d1..ebd66669 100644
--- a/.github/workflows/pr_title.yml
+++ b/.github/workflows/pr_title.yml
@@ -1,5 +1,7 @@
+---
 name: PR
-on:
+
+'on':
   pull_request:
     types:
       - opened
@@ -15,6 +17,9 @@ jobs:
         run: |
           npm install -g @commitlint/cli @commitlint/config-conventional
           echo "module.exports = {extends: ['@commitlint/config-conventional']}" > commitlint.config.js
+
       - name: lint
+        env:
+          PR_TITLE: ${{github.event.pull_request.title}}
         run: |
-          echo "${{github.event.pull_request.title}}" | commitlint
+          echo "$PR_TITLE" | commitlint