Use PHP Matrix v1; Switch to composite action

[tangrufus]

No description provided.

To mitigate the risk, ensure the path added to $GITHUB_PATH cannot be manipulated by external or untrusted actors. The best method is to sanitize or validate ${ACTION_PATH} before use. Since ${{ github.action_path }} points to the location of the action's code (which may come from attacker-controlled repositories in some contexts), hardcoding trusted paths is preferred. However, if the binary must reside in the action path, validate that ${ACTION_PATH} matches an expected trusted base path before appending it to $GITHUB_PATH. At minimum, ensure the path does not contain dangerous characters (such as newlines, spaces, shell metacharacters), and that it is an absolute path under a safe parent directory.

Since only the snippet from action.yml is shown and shell commands are used, the most robust approach within the limitation of bash is to check the path prior to echoing. Insert a check ensuring ${ACTION_PATH} is absolute and does not contain suspicious characters. If validation fails, abort the workflow safely.

Specifically, replace the run line at line 99 with a script that:

• Verifies ${ACTION_PATH}:
  • Is an absolute path ([[ $ACTION_PATH = /* ]])
  • Does not contain dangerous characters using a regex (e.g., no whitespace, no semicolon, no newline).
• Optionally, restrict it to a specific safe base directory if known.
  If it passes, echo ${ACTION_PATH}/bin into $GITHUB_PATH; else, error and abort.

No additional imports/dependencies are required for bash.

---