Opus finding
Audit article claims four `${{ }}` interpolations were eliminated but `inputs.message` still appears in run-name
lowdocs-gaphigh
- .github/workflows/messages.yml:2
- articles/workflow-security-audit-2026-04-11.md:117-121
The article asserts "all four direct interpolations in messages.yml eliminated" but `run-name` still interpolates `inputs.message` and `inputs.source` at the top of the file. While `run-name` is rendered for display and not executed as shell, this contradicts the article's claim. It also means a malicious message body becomes part of the workflow run title shown in the UI, which can confuse log review or be used for UI spoofing of trusted-looking run names. The audit's own coverage claim is therefore inaccurate.
Recommendation
Either update the article to acknowledge run-name interpolation is benign (with rationale) or replace the run-name expression with a sanitized alternative. Don't claim 'all four' when one remains.