quote variables, use actions SHAs

[robandpdx]

This pull request introduces a robust validation layer for GitHub owner and repository names in the request workflow, ensures all workflow dependencies are pinned to specific commit SHAs for improved reproducibility, and makes minor shell and quoting improvements for better reliability. The most important changes are summarized below:

Validation Enhancements:

• Added a new script, validate-request.mjs, which strictly validates GitHub owner and repository names according to GitHub's naming rules, and integrated this validation into both the initialize-request and approve-or-deny-request workflows. This prevents malformed or malicious requests from proceeding in the automation pipeline. [1] [2] [3] [4]
• Added comprehensive tests for the new validation logic, covering valid and invalid owner/repo names and malformed payloads.

Workflow Security and Reproducibility:

• Updated all GitHub Actions in workflow files (initialize-request.yml, approve-or-deny-request.yml, pr.yml, test.yml) to use commit SHA-pinned versions instead of floating tags, ensuring consistent and secure CI/CD runs. [1] [2] [3] [4] [5] [6] [7]

Shell Script Improvements:

• Improved shell quoting and assignment in workflow scripts for version detection and GitHub output writing, enhancing script safety and POSIX compliance. [1] [2] [3]

These changes collectively strengthen the reliability, security, and maintainability of the repository's automation workflows.This pull request updates several GitHub Actions workflows to improve security and reliability by pinning action dependencies to specific commit SHAs, and makes minor improvements to shell scripting for better compatibility and correctness.

Workflow dependency updates:

• All references to third-party actions in .github/workflows/approve-or-deny-request.yml, .github/workflows/initialize-request.yml, .github/workflows/pr.yml, and .github/workflows/test.yml are now pinned to specific commit SHAs instead of version tags. This includes actions/checkout, actions/setup-node, actions/github-script, peter-murray/issue-body-parser-action, and tintef/nyc-reporter-action. Pinning actions to SHAs ensures builds are reproducible and not affected by upstream changes. [1] [2] [3] [4] [5] [6] [7]

Shell scripting improvements:

• Updated shell script syntax in workflow steps to use more robust quoting and variable assignment practices, such as wrapping variables in double quotes and using $(...) instead of backticks for command substitution. This improves compatibility and prevents potential bugs. [1] [2] [3]

These changes collectively enhance the security, reliability, and maintainability of the CI/CD workflows.

[Copilot]

Copilot review overview

🟡 Changes recommended

The approve/deny workflow can emit an invalid version=null output when no latest release exists, and the initialize workflow has an inconsistent == test that should be made portable/consistent.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review tier: Lite
Findings: 2

New issues introduced by this change (2)

Severity	Finding
	.github/​workflows/​approve-or-deny-request.yml — Handle missing latest release before writing workflow output
	.github/​workflows/​initialize-request.yml — Use '=' instead of '==' in test for null VERSION

What changed in this PR

This pull request hardens the repository’s CI/CD by pinning GitHub Actions dependencies to commit SHAs and tightening a few shell-script constructs used in workflows, improving supply-chain security and script robustness.

Changes:

• Pinned third-party GitHub Actions usages to full commit SHAs across workflows (e.g., checkout, setup-node, github-script, nyc reporter, issue-body parser).
• Improved shell scripting in workflows by quoting variables/paths and using $(...) command substitution.

File	Description
.github/​workflows/​test.yml	Pins actions/checkout and actions/setup-node to SHAs for reproducible main-branch tests.
.github/​workflows/​pr.yml	Pins actions to SHAs and pins the NYC reporter action for PR CI consistency.
.github/​workflows/​initialize-request.yml	Pins actions to SHAs and improves shell quoting/command substitution when resolving requested versions.
.github/​workflows/​approve-or-deny-request.yml	Pins actions to SHAs and improves shell quoting/command substitution when resolving requested versions.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.