CI: Disable variable substitution on input to the twitter script

This prevents command injection through backticks in commit messages.
fleximus · Aug 15, 2021 · 6602ab2 · 6602ab2
1 parent 788472f
commit 6602ab2
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/.github/workflows/twitter.yml b/.github/workflows/twitter.yml
@@ -14,7 +14,7 @@ jobs:
  node-version: '14'
  - run: npm i twit
  - run: |
- node ${{ github.workspace }}/Meta/tweet-commits.js << EOF
+ node ${{ github.workspace }}/Meta/tweet-commits.js << 'EOF'
  ${{ toJSON(github.event) }}
  EOF
  env: