From b0334851769f1a4f921e7d9f235afb86e17bd8b5 Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Wed, 29 Jul 2026 17:24:09 +0000
Subject: [PATCH] ci: prevent script injection in Publish SDK Artifacts
 workflow

---
 .github/workflows/manual-sdk-release-artifacts.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/manual-sdk-release-artifacts.yml b/.github/workflows/manual-sdk-release-artifacts.yml
index 1946645c7..7b982e125 100644
--- a/.github/workflows/manual-sdk-release-artifacts.yml
+++ b/.github/workflows/manual-sdk-release-artifacts.yml
@@ -34,8 +34,10 @@ jobs:
     steps:
       - name: Determine CMake target and SDK library path
         id: split-string
+        env:
+          SDK_TARGET: ${{ inputs.sdk_target }}
         run: |
-          INPUT="${{ inputs.sdk_target }}"
+          INPUT="$SDK_TARGET"
           IFS=':' read -ra PATH_AND_TARGET <<< "$INPUT"
           echo "SDK_PATH=${PATH_AND_TARGET[0]}" >> $GITHUB_OUTPUT
           echo "SDK_CMAKE_TARGET=${PATH_AND_TARGET[1]}" >> $GITHUB_OUTPUT