From 93a0ae253d12dbb46a967fef7b4fe758c1dd27f2 Mon Sep 17 00:00:00 2001
From: renner <80410025+renner0e@users.noreply.github.com>
Date: Wed, 7 Oct 2026 12:06:15 +0000
Subject: [PATCH] fix(ci): mitigate code injection in build from
 repo_organization (#2991)

* fix(ci): mitigate code injection in build from repo_organization

https://docs.github.com/en/actions/concepts/security/script-injections

* make it global

is pretty reusable
---
 .github/workflows/reusable-build.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/reusable-build.yml b/.github/workflows/reusable-build.yml
index 0e3348be..2fc1922a 100644
--- a/.github/workflows/reusable-build.yml
+++ b/.github/workflows/reusable-build.yml
@@ -31,6 +31,7 @@ on:
 
 env:
   IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}
+  GITHUB_REPOSITORY_OWNER: ${{ github.repository_owner }}
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref || github.run_id }}-${{ inputs.brand_name}}-${{ inputs.stream_name }}
@@ -142,7 +143,7 @@ jobs:
           MATRIX_IMAGE_FLAVOR: ${{ matrix.image_flavor }}
         run: |
           $(command -v just) \
-            repo_organization="${{ github.repository_owner }}" \
+            repo_organization="${GITHUB_REPOSITORY_OWNER}" \
             build \
             --image "${MATRIX_BASE_NAME}" \
             --tag "${MATRIX_STREAM_NAME}" \