Fix template injection vulnerability in git config user.name

[Copilot]

The git configuration step used ${{ github.workflow }} for user.name, which is user-controllable via workflow filenames and enables template injection attacks.

Changes

• pkg/workflow/yaml_generation.go: Replace ${{ github.workflow }} with static string "github-actions[bot]"
• .github/workflows/*.lock.yml: Regenerate 56 workflow files with fixed configuration

Before/After

# Before - user-controllable expression
git config --global user.name "${{ github.workflow }}"

# After - static string
git config --global user.name "github-actions[bot]"

The username now matches the email pattern (github-actions[bot]@users.noreply.github.com) and eliminates the injection vector.

Original prompt

Update generated code to avoid using github.workflow as a user name.

error[template-injection]: code injection via template expansion
  --> ./.github/workflows/weekly-issue-summary.lock.yml:83:46
   |
81 |         run: |
   |         --- this run block
82 |           git config --global user.email "github-actions[bot]@users.noreply.github.com"
83 |           git config --global user.name "${{ github.workflow }}"
   |                                              ^^^^^^^^^^^^^^^ may expand into attacker-controllable code
   |
   = note: audit confidence → High
   = note: this finding has an auto-fix

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[github-actions]

Agentic Changeset Generator triggered by this pull request.

[Copilot]

Pull Request Overview

This PR fixes a template injection security vulnerability in GitHub Actions workflow files by replacing the user-controllable ${{ github.workflow }} expression with a static string for git configuration.

Key Changes:

• Updated the Go code generator to use a hardcoded bot username instead of a dynamic workflow name
• Regenerated all 56 affected workflow lock files with the secure configuration

Reviewed Changes

Copilot reviewed 58 out of 58 changed files in this pull request and generated no comments.

File	Description
pkg/workflow/yaml_generation.go	Modified generator to output static "github-actions[bot]" username instead of ${{ github.workflow }} expression
.github/workflows/go.mod	Added empty require block to go.mod structure
.github/workflows/*.lock.yml (56 files)	Regenerated workflow files with fixed git config using static username

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.