fix: us environment variable for untrusted input

Co-authored-by: Iain Lane <[email protected]>
grafana · Jul 4, 2024 · e9a80d1 · e9a80d1
1 parent 69003a5
commit e9a80d1
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/actions/argo-lint/action.yaml b/actions/argo-lint/action.yaml
@@ -15,5 +15,7 @@ runs:
       uses: grafana/shared-workflows/actions/install-argo-cli@main
 
     - name: Run
+      env:
+        WORKFLOW_PATH: ${{ inputs.path }}
       shell: bash
-      run: argo lint --offline ${{ inputs.path }}
+      run: argo lint --offline "${WORKFLOW_PATH}"