Escape user-controlled variables in GA workflow "benchmarks.yml" (#7415)

scikit-image · May 12, 2024 · f5f4b0c · f5f4b0c
1 parent cd20256
commit f5f4b0c
Showing 1 changed file with 5 additions and 2 deletions.
diff --git a/.github/workflows/benchmarks.yml b/.github/workflows/benchmarks.yml
@@ -67,6 +67,9 @@ jobs:
           OMP_NUM_THREADS: 1
           ASV_FACTOR: 1.5
           ASV_SKIP_SLOW: 1
+          # Escape user controlled variables
+          BASELINE_LABEL: "${{ github.event.pull_request.base.label }}"
+          CONTENDER_LABEL: "${{ github.event.pull_request.head.label }}"
         run: |
           set -x
 
@@ -75,8 +78,8 @@ jobs:
           # ID this runner
           asv machine --yes
 
-          echo "Baseline:  ${{ github.event.pull_request.base.sha }} (${{ github.event.pull_request.base.label }})"
-          echo "Contender: ${GITHUB_SHA} (${{ github.event.pull_request.head.label }})"
+          echo "Baseline:  ${{ github.event.pull_request.base.sha }} ($BASELINE_LABEL)"
+          echo "Contender: ${GITHUB_SHA} ($CONTENDER_LABEL)"
 
           # Run benchmarks for current commit against base
           ASV_OPTIONS="--split --show-stderr --factor $ASV_FACTOR"