* fix: neutralize bidi and control chars in action logs
Prevent Trojan Source-style filename spoofing when git status paths are printed via log(), and sanitize conflicted paths in pull errors.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: guard neutralizeForLog against circular references
Track visited arrays/objects with a WeakSet so log() returns a marker instead of overflowing on cyclic values.
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
Avoid dumping listConfig().all via core.debug so checkout extraheader tokens are never written to action logs.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: prevent git option injection via new_branch
Validate new_branch as a branch name and pass it after -- so values like --force cannot force-checkout or force-push.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: tighten new_branch validation and simplify checkout
Reject Unicode whitespace/C1 controls in branch names, and drop the checkout -- separator after early validation.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix: validate new_branch with git check-ref-format
Reject invalid ref forms via check-ref-format --branch, align docs, and clarify the remote-helper warning wording.
Co-authored-by: Cursor <cursoragent@cursor.com>
---------
Co-authored-by: Cursor <cursoragent@cursor.com>
* cleanup: Removes JSON array parsing.
JSON is a subset of YAML, making it redundant.
* ci: add tests for parseInputArray.
Makes tools into a function to be able to mock it.
It does not need to be exported.
* Update runner version
---------
Co-authored-by: Federico Grandi <fgrandi30@gmail.com>
