frostebite b3b4352c80 docs: explain why exec.exec(cliPath, args, ...) isn't shell-injectable ...

CodeQL flagged this line (js/command-line-injection, critical) since
args ultimately derives from Action inputs, and its static analysis
can't see through @actions/exec's internals to confirm safety.

Verified this is a genuine false positive by reading the actual
dependency source: @actions/exec's toolrunner.js passes args straight
to child_process.spawn(fileName, args, options) -
node_modules/@actions/exec/lib/toolrunner.js line 413 - never a shell
string, never shell-parsed. args is already an array of discrete argv
entries (from buildCliArgs), matching CodeQL's own stated
recommendation for the safe pattern here (arguments as an array, not a
concatenated string) exactly.

Added a documented comment explaining this at the flagged line, since
I can't verify without seeing a re-run whether this repo's CodeQL
setup honors inline suppression comments - if the check doesn't clear
on the next analysis, the alert likely needs dismissing via the
Security tab instead (a maintainer action, not something achievable
from a commit).

No functional change - comment only.

2026-08-24 20:36:49 +01:00

..

index.js

docs: explain why exec.exec(cliPath, args, ...) isn't shell-injectable

2026-08-24 20:36:49 +01:00

index.js.map

docs: explain why exec.exec(cliPath, args, ...) isn't shell-injectable

2026-08-24 20:36:49 +01:00

licenses.txt

feat: rework thin wrapper to invoke game-ci/cli as a subprocess

2026-08-14 03:28:14 +01:00

sourcemap-register.js

Code cleanup (#511)

2023-03-03 16:25:40 -08:00