fix a theoretical code injection issue

pyca · Jan 3, 2025 · 284fb24 · 284fb24
1 parent 8640c1a
commit 284fb24
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/.github/actions/cache/action.yml b/.github/actions/cache/action.yml
@@ -13,8 +13,10 @@ runs:
   steps:
     - name: Normalize key
       id: normalized-key
-      run: echo "key=$(echo "${{ inputs.key }}" | tr -d ',')" >> $GITHUB_OUTPUT
+      run: echo "key=$(echo "${KEY}" | tr -d ',')" >> $GITHUB_OUTPUT
       shell: bash
+      env:
+        KEY: "${{ inputs.key }}"
     - uses: Swatinem/rust-cache@f0deed1e0edfc6a9be95417288c0e1099b1eeec3  # v2.7.7
       with:
         key: ${{ steps.normalized-key.outputs.key }}-3