fix(github-action): harden action input handling

[kunaldhongade]

Summary

• harden the GitHub Action by passing inputs through environment variables before Bash consumes them
• preserve exact CLI forwarding and add a runtime test proving shell-like values are literal data, not executed
• repair a VitePress-breaking literal placeholder in the human-UAT outreach template
• upgrade Judge Lab from vulnerable Vinext dependencies and override transitive Nanoid to its fixed release

Why

Action inputs were interpolated directly into shell scripts. Quoting does not prevent command substitution after GitHub expression rendering, so shell-like values could execute in the runner. The PR also clears the existing CI blockers exposed by the first run.

Validation

• pnpm run lint
• pnpm typecheck
• pnpm test — 903 tests across 169 files
• pnpm build:packages
• pnpm docs:build
• pnpm --filter @submuxhq/codedecay pack --dry-run
• pnpm eval:pr-safety -- --run-id local-pr-safety-eval-766 — 2/2 scenarios passed
• GitHub Action focused suite — 27 tests passed
• Judge Lab: npm audit --audit-level=high, lint, typecheck, API/build test, and browser acceptance — all passed

Closes #766

[github-actions]

CodeDecay PR Check

Lead catch: Config area changed — judge-lab/package.json:33

judge-lab/package.json touches a config area and should be reviewed for regression impact.

Risk: Medium · Merge 42/100 · Decay 0/100 · Security 0/100

Full CodeDecay report

CodeDecay Report

Overall risk: Medium

Score	Value
Merge risk	42/100
Decay risk	0/100
Security risk	0/100

Findings	Count
High	5
Medium	2
Low	6

Changed Files

• docs/evals/uat-kit/outreach.md modified (+1/-1)
• judge-lab/package-lock.json modified (+30/-109)
• judge-lab/package.json modified (+4/-3)
• packages/github-action/action.yml modified (+85/-53)
• packages/github-action/test/action-runtime.test.ts modified (+29/-0)
• packages/github-action/test/action-yml.test.ts modified (+23/-13)

Likely Impacted Areas

• Medium Build and runtime configuration (config): judge-lab/package.json
• Low Dependency lockfile (config): judge-lab/package-lock.json
• Low Documentation (docs): docs/evals/uat-kit/outreach.md
• Low Tests (test): packages/github-action/test/action-runtime.test.ts, packages/github-action/test/action-yml.test.ts

Normalized Impact Graph

Graph artifact: .codedecay/local/impact-graph.json (4968 node(s), 10028 edge(s))

• Confidence: Direct: 10028, inferred: 0, heuristic: 0
• codedecay-js-babel-symbols via @babel/parser (available, adapter 1.0.0)
  • Limitation: Call expressions are not connected to target symbols in this adapter version.
  • Limitation: Only JavaScript and TypeScript files parsed by @babel/parser are represented.
  • Limitation: Static import resolution does not resolve runtime dependency injection or dynamic imports.
• codedecay-python-lezer via @lezer/python (available, adapter 1.0.0)
  • Limitation: Dynamic imports, dependency injection, decorators without literal routes, and framework route registries are not resolved.
  • Limitation: Python impact evidence uses the @lezer/python grammar and conservative module-to-file resolution.
  • Limitation: Static test imports do not prove execution or assertion quality.
• Graph limitation: A static test import does not prove the symbol executed or that assertions cover its behavior.

Language And Parser Coverage

• Source files classified: 2
• Fully supported parser files: 2
• Limited files: 0
• Unsupported files: 0

Merge Risk Breakdown

• Score: 42/100
• Raw score before dampeners: 42/100
• Adjusted score before severity cap: 42/100
• Highest contributing severity: Medium

Top contributors:

• +16 Config area changed (direct): judge-lab/package.json touches a config area and should be reviewed for regression impact.
• +6 Change size (structural): Changed lines amplify review cost across 6 file(s).
• +6 Config area changed (direct): judge-lab/package-lock.json touches a config area and should be reviewed for regression impact.
• +4 Docs area changed (heuristic): docs/evals/uat-kit/outreach.md touches a docs area and should be reviewed for regression impact.
• +4 Test area changed (heuristic): packages/github-action/test/action-runtime.test.ts touches a test area and should be reviewed for regression impact.

Notes:

• Untrusted memory context is visible but contributes 0 score until trusted evidence corroborates it.

Decay Risk Breakdown

• Score: 0/100
• Raw score before dampeners: 0/100
• Adjusted score before severity cap: 0/100

Security Risk Breakdown

• Score: 0/100
• Raw score before dampeners: 0/100
• Adjusted score before severity cap: 0/100

Security Matcher Coverage

• Changed source files scanned: 0
• Security candidates found: 0
• Skipped files: 0

Test Evidence

• Mode: heuristic-only
• Sources: none
• Notes:
• No runtime coverage artifact was found. Test audit remains heuristic-only.

Untrusted Memory Context

• Project invariant may be impacted (judge-lab/package-lock.json:26): Untrusted memory context: invariant "No hidden cloud or model call" applies to this change. The OSS CLI must remain useful without telemetry, API keys, hosted services, required LLM calls, or CodeDecayCloud.
• Project invariant may be impacted (judge-lab/package-lock.json:26): Untrusted memory context: invariant "Commands are explicit" applies to this change. CodeDecay must not run project commands unless they are configured and safety.allowCommands is true.
• Project invariant may be impacted (docs/evals/uat-kit/outreach.md:9): Untrusted memory context: invariant "Tool evidence is separate from AI suggestions" applies to this change. Reports must not present agent/model suggestions as verified evidence unless backed by deterministic checks or command output.
• Project invariant may be impacted (judge-lab/package.json:33): Untrusted memory context: invariant "Package remains installable from npm" applies to this change. The published package must include README, LICENSE, package.json, dist/index.js, and dist/index.d.ts without workspace-only dependency leaks.
• Past regression area changed (judge-lab/package.json:33): Untrusted memory context: past regression "Published npm package leaked workspace protocol" may be relevant. Published package installation failed when workspace protocol dependencies leaked into the npm package.
• Project invariant may be impacted (docs/evals/uat-kit/outreach.md:9): Untrusted memory context: invariant "Output must be actionable" applies to this change. Redteam reports and agent bundles should say what behavior to verify, which test proof is weak or missing, and what task a coding agent should perform.
• Architecture note applies (judge-lab/package.json:33): Untrusted architecture context: CLI is the published surface: The public npm package is @submuxhq/codedecay and the binary is codedecay. Internal workspace packages are implementation details.
• Architecture note applies (docs/evals/uat-kit/outreach.md:9): Untrusted architecture context: Evals protect the product promise: The PR safety eval is the first regression harness for whether CodeDecay catches AI-overlooked PR risks, not just whether unit tests pass.

Medium Risk Findings

• Config area changed (judge-lab/package.json:33): judge-lab/package.json touches a config area and should be reviewed for regression impact.

Low Risk Findings

• Config area changed (judge-lab/package-lock.json:26): judge-lab/package-lock.json touches a config area and should be reviewed for regression impact.
• Docs area changed (docs/evals/uat-kit/outreach.md:9): docs/evals/uat-kit/outreach.md touches a docs area and should be reviewed for regression impact.
• Test area changed (packages/github-action/test/action-runtime.test.ts:205): packages/github-action/test/action-runtime.test.ts touches a test area and should be reviewed for regression impact.
• Test area changed (packages/github-action/test/action-yml.test.ts:37): packages/github-action/test/action-yml.test.ts touches a test area and should be reviewed for regression impact.

Recommended Checks

• Flow check (CLI release smoke): Run built CLI smoke tests
• Flow check (CLI release smoke): Run package dry-run
• Flow check (CLI release smoke): Run published-package or tarball demo before release
• Flow check (GitHub Action dogfood): Check cwd/output/fail-on behavior
• Flow check (GitHub Action dogfood): Confirm CodeDecay dogfood check runs on the PR
• Flow check (GitHub Action dogfood): Verify action inputs match docs
• Flow check (PR safety efficacy benchmark): Confirm edge cases and fix tasks are actionable
• Flow check (PR safety efficacy benchmark): Confirm normal tests pass while behavior probes catch seeded regressions
• Flow check (PR safety efficacy benchmark): Run pnpm eval:pr-safety
• Flow check (Pull request redteam review): Check weak or missing test proof
• Flow check (Pull request redteam review): Keep deterministic evidence separate from AI suggestions
• Flow check (Pull request redteam review): Review edge cases and agent fix tasks

Notes

CodeDecay is deterministic and local-first. This report was generated without telemetry, API keys, LLMs, or model calls.

---

Found by CodeDecay - deterministic, local-first, no telemetry.