security: fix expression injection in triage-issue.yml (#1672)

Move ${{ steps.run_script.outputs.labels }} from run: block to env: block to prevent GitHub Actions expression injection. Attacker-controlled issue body can prompt-inject Gemini API response, which flows unsanitized through ${{ }} into shell, enabling arbitrary command execution and secret exfiltration.

Author: XananasX7

.github/workflows/triage-issue.yml

@@ -56,9 +56,10 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           ISSUE_NUMBER: ${{ github.event.issue.number }}
+          LABELS: ${{ steps.run_script.outputs.labels }}
         run: |
           # Convert comma-separated labels to gh command arguments
-          IFS=',' read -ra ADDR <<< "${{ steps.run_script.outputs.labels }}"
+          IFS=',' read -ra ADDR <<< "$LABELS"
           priority_added=false
           for i in "${ADDR[@]}"; do
             # Trim whitespace
@@ -70,4 +71,4 @@ jobs:
             fi
           done
           # Remove 'triage me' label
-          gh issue edit "$ISSUE_NUMBER" --remove-label "triage me" || true
+          gh issue edit "$ISSUE_NUMBER" --remove-label "triage me" || true