From 6bddbb5cf3ab0f92b47e9f685fdbce485b6548bc Mon Sep 17 00:00:00 2001
From: Carlo Cabrera <30379873+carlocab@users.noreply.github.com>
Date: Wed, 30 Oct 2024 22:20:14 +0800
Subject: [PATCH] workflows/vendor-version: fix `template-injection` warnings

Fixes https://github.com/Homebrew/brew/security/code-scanning/40
Fixes https://github.com/Homebrew/brew/security/code-scanning/41
---
 .github/workflows/vendor-version.yml | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/vendor-version.yml b/.github/workflows/vendor-version.yml
index 25d9458e2bc0e..9ad05652ee82a 100644
--- a/.github/workflows/vendor-version.yml
+++ b/.github/workflows/vendor-version.yml
@@ -37,7 +37,7 @@ jobs:
         working-directory: ${{ steps.set-up-homebrew.outputs.gems-path }}/${{ steps.ruby-abi.outputs.version }}/gems
         run: |
           {
-            echo "vendor-version=$(cat ../.homebrew_vendor_version)"
+            echo "vendor-version=$(<../.homebrew_vendor_version)"
             echo "ignored<<EOS"
             git check-ignore -- *
             echo "EOS"
@@ -45,12 +45,14 @@ jobs:
 
       - name: Compare to base ref
         working-directory: ${{ steps.set-up-homebrew.outputs.gems-path }}/${{ steps.ruby-abi.outputs.version }}
+        env:
+          VENDOR_VERSION: ${{ steps.gem-info.outputs.vendor-version }}
+          IGNORED_GEMS: ${{ steps.gem-info.outputs.ignored }}
         run: |
           git checkout "origin/${GITHUB_BASE_REF}"
           rm .homebrew_vendor_version
           brew install-bundler-gems --groups=all
-          if [[ "$(cat .homebrew_vendor_version)" == "${{ steps.gem-info.outputs.vendor-version }}" ]]; then
-            ignored_gems="${{ steps.gem-info.outputs.ignored }}"
+          if [[ "$(<.homebrew_vendor_version)" == "${VENDOR_VERSION}" ]]; then
             while IFS= read -r gem; do
               gem_dir="./gems/${gem}"
               [[ -d "${gem_dir}" ]] || continue
@@ -64,5 +66,5 @@ jobs:
                 fi
                 exit "${exit_code}"
               fi
-            done <<< "${ignored_gems}"
+            done <<< "${IGNORED_GEMS}"
           fi