From ac88d88af3d2873902507e0b5959ddefa3200859 Mon Sep 17 00:00:00 2001
From: "Yann Esposito (Yogsototh)" <guillaume@ereteo.net>
Date: Tue, 16 Jun 2026 14:59:52 +0200
Subject: [PATCH] Harden Build workflow: drop eval, use $GITHUB_OUTPUT (PSIRT
 follow-up)

Follow-up to #59, addressing the remaining findings from the PSIRT
review of build.yml.

- Replace the deprecated `::set-output` command with the `$GITHUB_OUTPUT`
  environment file in the setup job's set-matrix step. GitHub deprecated
  `::set-output` citing output-injection concerns; the environment file
  is the supported, safer mechanism. Also fixes a stray trailing `}` in
  the emitted JSON (`...["test"]}}` -> `...["test"]}`).
- Remove `eval` from the test job's run step. `eval 'lein ... ${CMD}'`
  re-parsed a matrix-derived variable through the shell; passing it as a
  normal quoted argument (`lein do clean, compile :all, "$CMD"`) removes
  the eval/command-injection anti-pattern.

No behavior change: `matrix.cmd` is hardcoded to `test`, so both jobs run
exactly as before (the matrix output is still consumed via
`needs.setup.outputs.matrix`).

Not in this PR: bumping action major versions (setup-java v2->v4,
cache v3->v4) is a runtime-behavior change better handled by Dependabot;
the actions are already SHA-pinned as of #59.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .github/workflows/build.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 54fc1ed4..2227ab9e 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -45,10 +45,10 @@ jobs:
           set -x
           case "${GITHUB_EVENT_NAME}" in
             #scheduled)
-            #  echo '::set-output name=matrix::{"jdk":["11","17","21"],"cmd":["test"]}}'
+            #  echo 'matrix={"jdk":["11","17","21"],"cmd":["test"]}' >> "$GITHUB_OUTPUT"
             # ;;
             *)
-              echo '::set-output name=matrix::{"jdk":["11","17","21"],"cmd":["test"]}}'
+              echo 'matrix={"jdk":["11","17","21"],"cmd":["test"]}' >> "$GITHUB_OUTPUT"
               ;;
           esac
   lint:
@@ -100,7 +100,7 @@ jobs:
           lein: 2.9.8
       - run: |
           set -x
-          eval 'lein do clean, compile :all, ${CMD}'
+          lein do clean, compile :all, "$CMD"
         env:
           CMD: ${{ matrix.cmd }}
   all-pr-checks: