fix(updater): URL-encode existing-PR query params; add changelog entry

PR branches derived from CMake dependency paths can contain '#', which
the previous query-string concatenation would treat as a URL fragment
delimiter and truncate. Switch to `gh api -X GET -f` so gh URL-encodes
the values, ensuring existing PRs are still matched when the branch
name contains special characters.

Also add the changelog entry for this PR so the advisory danger check
passes.

Author: vaind

CHANGELOG.md

@@ -10,6 +10,7 @@
 
 ### Fixes
 
+- Complete script injection hardening across all actions: move remaining step outputs to env vars, validate Danger version against semver ([#152](https://github.com/getsentry/github-workflows/pull/152))
 - Updater - Trigger CI for new PRs without changelog updates ([#166](https://github.com/getsentry/github-workflows/pull/166))
 - Updater - Select the first branch when multiple branches point at `HEAD` ([#165](https://github.com/getsentry/github-workflows/pull/165))
 

updater/action.yml

@@ -325,8 +325,14 @@ runs:
         BASE_BRANCH: ${{ steps.root.outputs.baseBranch }}
         PR_BRANCH: ${{ steps.root.outputs.prBranch }}
       run: |
-        $apiUrl = 'repos/${{ github.repository }}/pulls?base=' + $env:BASE_BRANCH + '&head=${{ github.repository_owner }}:' + $env:PR_BRANCH
-        $urls = @(gh api $apiUrl --jq '.[].html_url')
+        # Use -f to let gh URL-encode query params; PR branch can contain '#' from CMake dependency paths.
+        $head = '${{ github.repository_owner }}:' + $env:PR_BRANCH
+        $base = $env:BASE_BRANCH
+        $urls = @(gh api 'repos/${{ github.repository }}/pulls' `
+          -X GET `
+          -f ('base=' + $base) `
+          -f ('head=' + $head) `
+          --jq '.[].html_url')
         if ($urls.Length -eq 0)
         {
             'url=' | Tee-Object $env:GITHUB_OUTPUT -Append