From 3fad8d7734899899039c45b8253fdd89ae0c15b3 Mon Sep 17 00:00:00 2001
From: begininvoke <56797886+begininvoke@users.noreply.github.com>
Date: Wed, 19 Aug 2026 00:34:06 -0700
Subject: [PATCH] fix(security): Using variable interpolation `${{...}}` with
 `github` context data in a `run:` step could allow an attack

---
 .github/workflows/phpcs.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/phpcs.yml b/.github/workflows/phpcs.yml
index ef8b410..cd86832 100644
--- a/.github/workflows/phpcs.yml
+++ b/.github/workflows/phpcs.yml
@@ -51,7 +51,9 @@ jobs:
         run: composer install --prefer-dist
 
       - name: Run PHP_CodeSniffer
+        env:
+          GITHUB_BASE_REF: ${{ github.base_ref }}
         run: |
           HEAD_REF=$(git rev-parse HEAD)
           git checkout $HEAD_REF
-          ./vendor/bin/phpcs-changed -s --git --git-base origin/${{ github.base_ref }} ${{ steps.changed-files.outputs.all_changed_files }}
+          ./vendor/bin/phpcs-changed -s --git --git-base origin/$GITHUB_BASE_REF ${{ steps.changed-files.outputs.all_changed_files }}