From 2145b7d8589cbe5006733349135df05a0d4e5c9c Mon Sep 17 00:00:00 2001
From: CrazyMax <1951866+crazy-max@users.noreply.github.com>
Date: Thu, 10 Sep 2026 10:10:35 +0200
Subject: [PATCH] prevent workflow command injection in metadata logs

Signed-off-by: CrazyMax <1951866+crazy-max@users.noreply.github.com>
---
 src/main.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/main.ts b/src/main.ts
index 572d224..bf0f2dd 100644
--- a/src/main.ts
+++ b/src/main.ts
@@ -137,7 +137,7 @@ actionsToolkit.run(
     if (metadata) {
       await core.group(`Metadata`, async () => {
         const metadatadt = JSON.stringify(metadata, null, 2);
-        core.info(metadatadt);
+        GitHub.printUntrusted(metadatadt);
         core.setOutput('metadata', metadatadt);
       });
     }