fix: use env var indirection for boolean inputs (CMD_EXEC)

[nbuckwalt]

Security Fix: CMD_EXEC via direct input interpolation

Summary

7 boolean inputs are directly interpolated into the `run:` shell script via `${{ inputs.xxx }}` expressions:

• `inputs.android`, `inputs.dotnet`, `inputs.haskell`, `inputs.large-packages`
• `inputs.docker-images`, `inputs.tool-cache`, `inputs.swap-storage`

A caller passing `'; malicious_command; true` as any of these inputs would execute arbitrary shell code in any job using this action.

Fix

Map all 7 inputs to an `env:` block (`ANDROID`, `DOTNET`, `HASKELL`, `LARGE_PACKAGES`, `DOCKER_IMAGES`, `TOOL_CACHE`, `SWAP_STORAGE`) and reference the quoted env vars in the script. Behavior is identical.

References

• GitHub Security Lab: Preventing pwn requests
• Rule: CMD_EXEC (CRITICAL) — 7 findings

🤖 Generated with Claude Code