"github.head_ref" is potentially untrusted. avoid using it directly in inline scripts. instead, pass it through an environment variable. see https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions for more details ``` - run: gh workflow run rerun.yml -F 'run_id=${{ github.run_id }}' --ref ${{ github.head_ref }} ^~~~~~~~~~~~~~~ ```