From c3c93f73214d8447c9f5c5ed9181f129226db0ef Mon Sep 17 00:00:00 2001
From: kalo <24719519+KaloyanTanev@users.noreply.github.com>
Date: Tue, 14 Jul 2026 12:18:15 +0300
Subject: [PATCH] Fix potential code injection

---
 .github/workflows/patch-release-step1.yml | 4 +++-
 .github/workflows/patch-release-step2.yml | 4 +++-
 .github/workflows/patch-release-step3.yml | 4 +++-
 .github/workflows/patch-release-step4.yml | 4 +++-
 4 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/patch-release-step1.yml b/.github/workflows/patch-release-step1.yml
index 86d428d41..e4e704236 100644
--- a/.github/workflows/patch-release-step1.yml
+++ b/.github/workflows/patch-release-step1.yml
@@ -45,12 +45,14 @@ jobs:
 
       - name: 4. Get and Increment Version
         id: bump
+        env:
+          TARGET_MINOR_INPUT: ${{ inputs.target_minor }}
         run: |
           # Fetch all remote branches and tags
           git fetch --all
           git fetch --tags
 
-          TARGET_MINOR="${{ inputs.target_minor }}"
+          TARGET_MINOR="$TARGET_MINOR_INPUT"
 
           if [[ -n "$TARGET_MINOR" ]]; then
             # Opt-in: patch a specific (non-latest) minor.
diff --git a/.github/workflows/patch-release-step2.yml b/.github/workflows/patch-release-step2.yml
index 8510a02d3..f022e6777 100644
--- a/.github/workflows/patch-release-step2.yml
+++ b/.github/workflows/patch-release-step2.yml
@@ -44,12 +44,14 @@ jobs:
 
       - name: 3. Find Latest Release Branch
         id: find_branch
+        env:
+          TARGET_MINOR_INPUT: ${{ inputs.target_minor }}
         run: |
           # Fetch all remote branches and tags
           git fetch --all
           git fetch --tags
 
-          TARGET_MINOR="${{ inputs.target_minor }}"
+          TARGET_MINOR="$TARGET_MINOR_INPUT"
 
           if [[ -n "$TARGET_MINOR" ]]; then
             # Opt-in: patch a specific (non-latest) minor.
diff --git a/.github/workflows/patch-release-step3.yml b/.github/workflows/patch-release-step3.yml
index b658af07d..6b81d40ac 100644
--- a/.github/workflows/patch-release-step3.yml
+++ b/.github/workflows/patch-release-step3.yml
@@ -44,12 +44,14 @@ jobs:
 
       - name: 3. Find Latest Release Branch
         id: find_branch
+        env:
+          TARGET_MINOR_INPUT: ${{ inputs.target_minor }}
         run: |
           # Fetch all remote branches and tags
           git fetch --all
           git fetch --tags
 
-          TARGET_MINOR="${{ inputs.target_minor }}"
+          TARGET_MINOR="$TARGET_MINOR_INPUT"
 
           if [[ -n "$TARGET_MINOR" ]]; then
             # Opt-in: patch a specific (non-latest) minor.
diff --git a/.github/workflows/patch-release-step4.yml b/.github/workflows/patch-release-step4.yml
index 886c04804..2c286f565 100644
--- a/.github/workflows/patch-release-step4.yml
+++ b/.github/workflows/patch-release-step4.yml
@@ -55,12 +55,14 @@ jobs:
 
       - name: 3. Find Latest Release Branch
         id: find_branch
+        env:
+          TARGET_MINOR_INPUT: ${{ inputs.target_minor }}
         run: |
           # Fetch all remote branches and tags
           git fetch --all
           git fetch --tags
 
-          TARGET_MINOR="${{ inputs.target_minor }}"
+          TARGET_MINOR="$TARGET_MINOR_INPUT"
 
           if [[ -n "$TARGET_MINOR" ]]; then
             # Opt-in: patch a specific (non-latest) minor.