In @.github/workflows/npm-publish.yml:
- Around line 49-53: The workflow currently injects user-controlled values
directly into the shell via inline expression interpolation (e.g.,
RELEASE_NAME="${{ github.event.release.name || inputs.release_name }}"), which
enables shell injection; change these to pass values through environment
variables instead: set an env entry (e.g., env: RELEASE_NAME: ${{
github.event.release.name || inputs.release_name }}) on the step and reference
$RELEASE_NAME inside the run block, and do the same for other occurrences (steps
named resolve-targets, publish, and the summary step using
steps.resolve-targets.outputs.*) by moving all `${{ ... }}` references into env
entries and reading them from the environment in the script.
- Around line 111-123: The publish step currently runs pnpm publish without
authentication and will fail; fix by either setting NODE_AUTH_TOKEN for pnpm
(add env: NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }} to the "Publish packages"
job so pnpm can authenticate) or change the step to use npm publish instead
(replace pnpm publish with npm publish) to leverage OIDC via setup-node@v4;
update the "Publish packages" run invocation accordingly and ensure the
selected_packages filter logic and --no-git-checks remain unchanged.