This PR refactors the linting workflow to fix a couple of critical code execution vulnerabilities that could be triggered by someone opening a pull request.
I entirely removed the repo_linter.sh script and moved its logic inline into the main.yml file. Because the workflow was executing the shell script directly from the checked-out repository, an attacker could modify that script in their PR and the runner would execute their malicious commands. Inlining the logic forces the runner to only execute the trusted workflow definitions from the base branch, neutralizing the potential threat.
I also changed how npx awesome-lint is executed. The previous logic cloned the untrusted codebase, cd'd into that directory, and ran npx. Since npx prioritizes local executables, an attacker could commit a malicious script to node_modules/.bin/awesome-lint inside their repo, and the workflow would trigger their payload instead of the actual global package. The npx command now runs from a clean, trusted working directory and just passes the repository URL as an argument, preventing the local-binary resolution exploit.
Lastly, I bumped the checkout action to v4.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.
## 📋 Pull Request Information
**Original PR:** https://github.com/sindresorhus/awesome/pull/4173
**Author:** [@thelonelyhill](https://github.com/thelonelyhill)
**Created:** 5/16/2026
**Status:** ❌ Closed
**Base:** `main` ← **Head:** `patch-4`
---
### 📝 Commits (2)
- [`6c834cf`](https://github.com/sindresorhus/awesome/commit/6c834cf1a1a589af23f7e866167f782f639f3a2e) Delete .github/workflows/repo_linter.sh
- [`a505d9c`](https://github.com/sindresorhus/awesome/commit/a505d9cb0ae3032e8142214cb10b1933f73b2c02) Fix workflow security vulnerabilities and update checkout action
### 📊 Changes
**2 files changed** (+19 additions, -25 deletions)
<details>
<summary>View changed files</summary>
📝 `.github/workflows/main.yml` (+19 -2)
➖ `.github/workflows/repo_linter.sh` (+0 -23)
</details>
### 📄 Description
This PR refactors the linting workflow to fix a couple of critical code execution vulnerabilities that could be triggered by someone opening a pull request.
I entirely removed the repo_linter.sh script and moved its logic inline into the main.yml file. Because the workflow was executing the shell script directly from the checked-out repository, an attacker could modify that script in their PR and the runner would execute their malicious commands. Inlining the logic forces the runner to only execute the trusted workflow definitions from the base branch, neutralizing the potential threat.
I also changed how npx awesome-lint is executed. The previous logic cloned the untrusted codebase, cd'd into that directory, and ran npx. Since npx prioritizes local executables, an attacker could commit a malicious script to node_modules/.bin/awesome-lint inside their repo, and the workflow would trigger their payload instead of the actual global package. The npx command now runs from a clean, trusted working directory and just passes the repository URL as an argument, preventing the local-binary resolution exploit.
Lastly, I bumped the checkout action to v4.
---
<sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
📋 Pull Request Information
Original PR: https://github.com/sindresorhus/awesome/pull/4173
Author: @thelonelyhill
Created: 5/16/2026
Status: ❌ Closed
Base:
main← Head:patch-4📝 Commits (2)
6c834cfDelete .github/workflows/repo_linter.sha505d9cFix workflow security vulnerabilities and update checkout action📊 Changes
2 files changed (+19 additions, -25 deletions)
View changed files
📝
.github/workflows/main.yml(+19 -2)➖
.github/workflows/repo_linter.sh(+0 -23)📄 Description
This PR refactors the linting workflow to fix a couple of critical code execution vulnerabilities that could be triggered by someone opening a pull request.
I entirely removed the repo_linter.sh script and moved its logic inline into the main.yml file. Because the workflow was executing the shell script directly from the checked-out repository, an attacker could modify that script in their PR and the runner would execute their malicious commands. Inlining the logic forces the runner to only execute the trusted workflow definitions from the base branch, neutralizing the potential threat.
I also changed how npx awesome-lint is executed. The previous logic cloned the untrusted codebase, cd'd into that directory, and ran npx. Since npx prioritizes local executables, an attacker could commit a malicious script to node_modules/.bin/awesome-lint inside their repo, and the workflow would trigger their payload instead of the actual global package. The npx command now runs from a clean, trusted working directory and just passes the repository URL as an argument, preventing the local-binary resolution exploit.
Lastly, I bumped the checkout action to v4.
🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.