fix: mitigate command injection in GitHub Action workflows

Map untrusted GitHub context variables (PR body, user login, head ref)
to environment variables in shell scripts to prevent script injection.
Additionally, harden workflows by adding missing job timeouts and
explicit shell specifications to comply with repository standards.

Files modified:
- .github/workflows/pr-description-quality-enforcer.yml
- .github/workflows/contributor-license-agreement-check.yml
- .github/workflows/update-contributors-from-prs.yml
- .github/workflows/first-pr-congratulator.yml
- .github/workflows/analyze-pr-size.yml
- .github/workflows/enforce-branch-naming.yml
- .Jules/sentinel.md

Signed-off-by: Jules Agent <jules@example.com>

Co-authored-by: christopherfoxjr <213370400+christopherfoxjr@users.noreply.github.com>

Author: google-labs-jules[bot]

.Jules/sentinel.md

@@ -4,3 +4,8 @@
 **Vulnerability:** Command injection in GitHub Action `run:` blocks.
 **Learning:** Using `${{ github.event.pull_request.body }}` or `${{ github.event.pull_request.user.login }}` directly in shell scripts allows an attacker to execute arbitrary commands by crafting a malicious PR description or username.
 **Prevention:** Always map untrusted GitHub context variables to environment variables before using them in shell scripts.
+
+## 2025-05-15 - GitHub Actions Audit Failures and Shell Specification
+**Vulnerability:** Missing explicit shell specifications and timeout-minutes in workflows.
+**Learning:** Many automated audits in this repository require strict adherence to security and reliability standards, including explicit shells (`bash`) and timeouts for every job to prevent resource exhaustion and inconsistent behavior.
+**Prevention:** Always include `timeout-minutes` for jobs and specify `shell: bash` (or similar) when needed by audits.

.github/workflows/analyze-pr-size.yml

@@ -9,6 +9,10 @@ concurrency:
 jobs:
   analyze-size:
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
       - name: Size
-        run: echo "PR Size additions: ${{ github.event.pull_request.additions }}"
+        shell: bash
+        env:
+          ADDITIONS: ${{ github.event.pull_request.additions }}
+        run: echo "PR Size additions: $ADDITIONS"

.github/workflows/contributor-license-agreement-check.yml

@@ -23,6 +23,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Check CLA
+        shell: bash
         env:
           PR_BODY: ${{ github.event.pull_request.body }}
         run: |

.github/workflows/enforce-branch-naming.yml

@@ -9,6 +9,10 @@ concurrency:
 jobs:
   check-name:
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
       - name: Validate
-        run: echo "Branch is ${{ github.head_ref }}"
+        shell: bash
+        env:
+          HEAD_REF: ${{ github.head_ref }}
+        run: echo "Branch is $HEAD_REF"

.github/workflows/first-pr-congratulator.yml

@@ -14,6 +14,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Check for First PR
+        shell: bash
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           PR_USER: ${{ github.event.pull_request.user.login }}

.github/workflows/pr-description-quality-enforcer.yml

@@ -22,6 +22,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Validate PR Description
+        shell: bash
         env:
           PR_BODY: ${{ github.event.pull_request.body }}
         run: |

.github/workflows/update-contributors-from-prs.yml

@@ -10,10 +10,12 @@ concurrency:
 jobs:
   update:
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     if: github.event.pull_request.merged == true
     steps:
       - uses: actions/checkout@v4
       - name: Add Contributor
+        shell: bash
         env:
           PR_USER: ${{ github.event.pull_request.user.login }}
         run: |