From 91675d81d98964a95716b0539f4dccc43e158113 Mon Sep 17 00:00:00 2001
From: Will Griffin <willgriffin@gmail.com>
Date: Thu, 30 Jul 2026 09:40:52 -0600
Subject: [PATCH] ci(pdf): quote GITHUB_ENV and GITHUB_OUTPUT redirects

actionlint reported seven SC2086 findings across on-pull-request.yml,
publish.yml and test.yml, all of them writes to the runner-provided
$GITHUB_ENV / $GITHUB_OUTPUT paths with an unquoted redirect target.

Quote the redirect targets. This is the same pattern already applied to
changeset-check.yml in #122, which was scoped to #121 and left these
alone.

Lint hygiene only, no behavioural change: none of these scripts consume
untrusted input, and actionlint reports no "potentially untrusted"
findings in these three files.

Closes #125
---
 .github/workflows/on-pull-request.yml | 4 ++--
 .github/workflows/publish.yml         | 8 ++++----
 .github/workflows/test.yml            | 2 +-
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/on-pull-request.yml b/.github/workflows/on-pull-request.yml
index 308c697..ad719ec 100644
--- a/.github/workflows/on-pull-request.yml
+++ b/.github/workflows/on-pull-request.yml
@@ -64,7 +64,7 @@ jobs:
       - name: Get pnpm store directory
         shell: bash
         run: |
-          echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
+          echo "STORE_PATH=$(pnpm store path --silent)" >> "$GITHUB_ENV"
 
       - name: Setup pnpm cache
         uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
@@ -107,7 +107,7 @@ jobs:
             bump="patch"
           fi
 
-          echo "bump=$bump" >> $GITHUB_OUTPUT
+          echo "bump=$bump" >> "$GITHUB_OUTPUT"
           echo "PR title will perform a $bump version bump on squash merge"
 
       - name: Comment on PR
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index b3b3bfb..c1a6d61 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -54,7 +54,7 @@ jobs:
       - name: Get pnpm store directory
         shell: bash
         run: |
-          echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
+          echo "STORE_PATH=$(pnpm store path --silent)" >> "$GITHUB_ENV"
 
       - name: Setup pnpm cache
         uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
@@ -99,10 +99,10 @@ jobs:
         id: version-check
         run: |
           if git diff --quiet package.json; then
-            echo "changed=false" >> $GITHUB_OUTPUT
+            echo "changed=false" >> "$GITHUB_OUTPUT"
           else
-            echo "changed=true" >> $GITHUB_OUTPUT
-            echo "version=$(node -p "require('./package.json').version")" >> $GITHUB_OUTPUT
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+            echo "version=$(node -p "require('./package.json').version")" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Build
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 88f4768..0d3bd2e 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -36,7 +36,7 @@ jobs:
       - name: Get pnpm store directory
         shell: bash
         run: |
-          echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
+          echo "STORE_PATH=$(pnpm store path --silent)" >> "$GITHUB_ENV"
 
       - name: Setup pnpm cache
         uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5