Fix script injection (#422)

Author: eapache-opslevel

.github/workflows/changie-gen.yaml

@@ -39,14 +39,24 @@ jobs:
             echo "No changelog exists for this PR, creating a new one"
           fi
 
-      - name: Create changie log
+      - name: Setup Go
         if: >-
           github.event.workflow_run.conclusion == 'success' &&
           steps.changelog_check.outputs.exists == 'false'
-        uses: miniscruff/changie-action@6dcc2533cac0495148ed4046c438487e4dceaa23 # v2
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
-          version: latest
-          args: new --kind Dependency --body "${{ github.event.workflow_run.display_title }}"
+          go-version-file: src/go.mod
+
+      - name: Create changie log
+        if: >-
+          github.event.workflow_run.conclusion == 'success' &&
+          steps.changelog_check.outputs.exists == 'false'
+        env:
+          PR_TITLE: ${{ github.event.workflow_run.display_title }}
+        shell: bash
+        run: |
+          CHANGIE=$(cd src && go tool -n changie)
+          "$CHANGIE" new --kind Dependency --body "$PR_TITLE"
 
       - name: Commit & Push changes
         if: >-