Check failure on line 69 in .github/workflows/dependabot-tapioca.yml

sonarqubecloud / SonarCloud Code Analysis

The expression github.event.pull_request.head.ref can be set by an external actor to a specially crafted value, enabling script injection. Change this workflow to not use user-controlled data directly in a run block, for example by assigning this expression to an environment variable.

See more on https://sonarcloud.io/project/issues?id=openaustralia_planningalerts&issues=AZ3TZ_wrJvNQ_U3gjcE_&open=AZ3TZ_wrJvNQ_U3gjcE_&pullRequest=2043