[nebeid]

Issues:

Addresses V2265233159

Description of changes:

Continuation of 8afd2f6, extending the same script-injection hardening to security-review.yml.

Directly interpolating ${{ github.event.* }} context expressions into run: shell bodies lets Actions splice them in as text before the shell runs — a script-injection risk. This PR hoists each flagged value into the step's env: block and references it as a quoted shell variable instead. Behavior is unchanged.

• Update commit status: hoist github.event.repository.name, github.event.pull_request.number, and github.event.pull_request.head.sha into env.
• Post review comment: hoist github.event.repository.name and github.event.pull_request.number into env.

Call-outs:

• This workflow runs on pull_request_target, so hardening these interpolations matters even though the flagged fields (repo name, PR number, commit SHA) are format-constrained.
• ${{ github.repository }} is left inline — it is not github.event.* attacker-influenced input.

Testing:

CI-config-only, no product code impact. File parses as valid YAML; no ${{ github.event.* }} interpolations remain in any run: body.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license and the ISC license.

[github-actions]

🔒 Security Review — View Report

Please review before merging.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.20%. Comparing base (b06d89b) to head (cbf9e16).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #3365   +/-   ##
=======================================
  Coverage   78.20%   78.20%           
=======================================
  Files         695      695           
  Lines      124172   124172           
  Branches    17238    17239    +1     
=======================================
+ Hits        97104    97106    +2     
+ Misses      26147    26145    -2     
  Partials      921      921           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.