Question

A workflow triggered by pull_request builds a Docker image tagged with the source branch name. A security reviewer flags this step because a malicious contributor could craft a branch name to execute arbitrary commands on the runner:

```yaml
- name: Build image
  run: docker build -t myapp:${{ github.head_ref }} .
```

Which change most effectively eliminates the script injection risk while keeping the branch name available to the step?

Accepted Answer

Assign github.head_ref to an intermediate environment variable via the step's env block, then reference it as "$BRANCH" inside the run script.

Answer

Wrap the expression in double quotes: docker build -t "myapp:${{ github.head_ref }}" . so the shell treats it as a single string.

Answer

Change the trigger to pull_request_target so the workflow runs with the base branch context and cannot be influenced by the fork.

Answer

Set permissions: contents: read at the job level to prevent the injected commands from modifying the repository.