From df8503d7fea187db0f3aeb581ba6d7de20cf7d98 Mon Sep 17 00:00:00 2001
From: "aikido-autofix[bot]"
 <119856028+aikido-autofix[bot]@users.noreply.github.com>
Date: Tue, 29 Sep 2026 08:11:00 +0000
Subject: [PATCH] fix(security): autofix Template Injection in GitHub Workflows
 Action

---
 .github/workflows/ci-workable.yaml                   | 9 ++++++---
 .github/workflows/common_image_tagging_workflow.yaml | 9 ++++++---
 2 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/ci-workable.yaml b/.github/workflows/ci-workable.yaml
index 468dd8fe44..2c069f7062 100644
--- a/.github/workflows/ci-workable.yaml
+++ b/.github/workflows/ci-workable.yaml
@@ -43,11 +43,14 @@ jobs:
       - name: set the build branch
         id: set-branch
         shell: bash
+        env:
+          MANUAL_BUILD_BRANCH: ${{ inputs.manual_build_branch }}
+          REF_NAME: ${{ github.ref_name }}
         run: |
-          if [[ "${{ inputs.manual_build_branch }}" == "" ]]; then
-            ACTUAL_BRANCH=${{ github.ref_name }}
+          if [[ "$MANUAL_BUILD_BRANCH" == "" ]]; then
+            ACTUAL_BRANCH=$REF_NAME
           else
-            ACTUAL_BRANCH=${{ inputs.manual_build_branch }}
+            ACTUAL_BRANCH=$MANUAL_BUILD_BRANCH
           fi
           echo "ref-for-name=${ACTUAL_BRANCH#workable_feature/*}" >> $GITHUB_OUTPUT
           echo "ref-for-checkout=$ACTUAL_BRANCH" >> $GITHUB_OUTPUT
diff --git a/.github/workflows/common_image_tagging_workflow.yaml b/.github/workflows/common_image_tagging_workflow.yaml
index bc9ecc26b2..f93c3fb892 100644
--- a/.github/workflows/common_image_tagging_workflow.yaml
+++ b/.github/workflows/common_image_tagging_workflow.yaml
@@ -40,11 +40,14 @@ jobs:
       - name: set image tag
         id: set-tag
         shell: bash
+        env:
+          INPUT_TAG: ${{ inputs.tag }}
+          INPUT_REF: ${{ inputs.ref }}
         run: |
-          if [[ "${{ inputs.tag }}" == "" ]]; then
-            FINAL_TAG=${{ inputs.ref }}-${GITHUB_SHA::7}-ts.$(date +%s)
+          if [[ "$INPUT_TAG" == "" ]]; then
+            FINAL_TAG=$INPUT_REF-${GITHUB_SHA::7}-ts.$(date +%s)
           else
-            FINAL_TAG=${{ inputs.tag }}
+            FINAL_TAG=$INPUT_TAG
           fi
           echo "Using tag: $FINAL_TAG"
           echo "tag=$FINAL_TAG" >> $GITHUB_OUTPUT