From 04c437fcdf627b875c5bfadd6d3e2a2804498858 Mon Sep 17 00:00:00 2001
From: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Date: Thu, 10 Sep 2026 10:54:49 +0200
Subject: [PATCH] prevent workflow command injection in metadata logs

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
---
 src/main.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/main.ts b/src/main.ts
index a1f1582..3f64d44 100644
--- a/src/main.ts
+++ b/src/main.ts
@@ -176,7 +176,7 @@ actionsToolkit.run(
     if (metadata) {
       await core.group(`Metadata`, async () => {
         const metadatadt = JSON.stringify(metadata, null, 2);
-        core.info(metadatadt);
+        GitHub.printUntrusted(metadatadt);
         core.setOutput('metadata', metadatadt);
       });
     }