fix: prevent script injection in security workflow PR number step

[adiadd]

Summary

Fixes a script-injection issue in .github/workflows/security.yaml.

The Save PR number step interpolated an untrusted GitHub context value directly into an inline shell script:

run: echo "${{ github.event.pull_request.number }}" > pr-number.txt

GitHub Actions expands ${{ }} before the shell runs, substituting the raw value into the script text. Any field under the github.event context must be treated as untrusted input, so this is the classic script-injection pattern.

Fix

Bind the expression to an intermediate environment variable and reference it quoted in the script — GitHub's documented mitigation for inline scripts:

env:
  PR_NUMBER: ${{ github.event.pull_request.number }}
run: echo "$PR_NUMBER" > pr-number.txt

The value is now passed as environment data and the shell never re-evaluates it as code. No ${{ }} remains inside any run: block.

Verification

• Scanned all six workflow files: this was the only ${{ }} interpolated into a run: block. Remaining expressions (matrix.python-version, secrets.GITHUB_TOKEN, the run-id: action input, and if: conditions) are not shell interpolations and are safe.
• YAML parses cleanly.
• Behavior is unchanged: pr-number.txt still receives the PR number consumed by security-pr-comment.yaml.

[sromoam]

Looks ok to me.

[github-actions]

Security Scan Results

ASH Security Scan Report

• Report generated: 2026-06-26T20:12:52+00:00
• Time since scan: 2 minutes

Scan Metadata

• Project: ASH
• Scan executed: 2026-06-26T20:10:39+00:00
• ASH version: 3.1.2

Summary

Scanner Results

The table below shows findings by scanner, with status based on severity thresholds and dependencies:

• Severity levels:
  • Suppressed (S): Findings that have been explicitly suppressed and don't affect scanner status
  • Critical (C): Highest severity findings that require immediate attention
  • High (H): Serious findings that should be addressed soon
  • Medium (M): Moderate risk findings
  • Low (L): Lower risk findings
  • Info (I): Informational findings with minimal risk
• Duration (Time): Time taken by the scanner to complete its execution
• Actionable: Number of findings at or above the threshold severity level that require attention
• Result:
  • PASSED = No findings at or above threshold
  • FAILED = Findings at or above threshold
  • MISSING = Required dependencies not available
  • SKIPPED = Scanner explicitly disabled
  • ERROR = Scanner execution error
• Threshold: The minimum severity level that will cause a scanner to fail
  • Thresholds: ALL, LOW, MEDIUM, HIGH, CRITICAL
  • Source: Values in parentheses indicate where the threshold is set:
    • global (global_settings section in the ASH_CONFIG used)
    • config (scanner config section in the ASH_CONFIG used)
    • scanner (default configuration in the plugin, if explicitly set)
• Statistics calculation:
  • All statistics are calculated from the final aggregated SARIF report
  • Suppressed findings are counted separately and do not contribute to actionable findings
  • Scanner status is determined by comparing actionable findings to the threshold

Scanner	Suppressed	Critical	High	Medium	Low	Info	Actionable	Result	Threshold
bandit	0	1	0	0	4036	0	1	FAILED	MEDIUM (global)
cdk-nag	0	0	0	0	0	0	0	PASSED	MEDIUM (global)
cfn-nag	0	0	0	0	0	0	0	MISSING	MEDIUM (global)
checkov	0	1	0	0	0	0	1	SKIPPED	MEDIUM (global)
detect-secrets	0	0	0	0	0	0	0	PASSED	MEDIUM (global)
grype	0	0	0	0	0	0	0	MISSING	MEDIUM (global)
npm-audit	0	0	0	0	0	0	0	PASSED	MEDIUM (global)
opengrep	0	0	0	0	0	0	0	MISSING	MEDIUM (global)
semgrep	0	0	0	0	0	0	0	PASSED	MEDIUM (global)
syft	0	0	0	0	0	0	0	MISSING	MEDIUM (global)

Top 2 Hotspots

Files with the highest number of security findings:

Finding Count	File Location
1	.github/workflows/workflow.yml
1	tests/test_top_level_exports.py

Detailed Findings

Show 2 actionable findings

Finding 1: CKV2_GHA_1

• Severity: HIGH
• Scanner: checkov
• Rule ID: CKV2_GHA_1
• Location: .github/workflows/workflow.yml:11-12

Description:
Ensure top-level permissions are not set to write-all

---

Finding 2: B102

• Severity: HIGH
• Scanner: bandit
• Rule ID: B102
• Location: tests/test_top_level_exports.py:71-73

Description:
Use of exec detected.

Code Snippet:

ns = {}
        exec("from stickler import *", ns)  # noqa: S102
        exported_names = set(ns) - {"__builtins__"}

---

Report generated by Automated Security Helper (ASH) at 2026-06-26T20:12:53+00:00