Question

A workflow triggered by `issues` runs the following step to log the new issue title:

```yaml
- name: Log issue
  run: echo "New issue: ${{ github.event.issue.title }}"
```

A security reviewer flags this as a script injection risk because an attacker can craft an issue title containing shell metacharacters. Which change most effectively eliminates the injection vulnerability while preserving the logging behavior?

Accepted Answer

Assign the title to an intermediate environment variable via the `env:` key and reference it in the script with shell quoting, e.g. `echo "New issue: $TITLE"`

Answer

Wrap the expression in single quotes: `run: echo 'New issue: ${{ github.event.issue.title }}'`

Answer

Add `permissions: contents: read` to the job so the token cannot modify the repository

Answer

Escape the expression with backslashes: `run: echo \"New issue: ${{ github.event.issue.title }}\"`