fix: harden --ghactions-runner-image-repo input

- Quote the URL in snippet git clone commands to prevent shell injection
- Add --depth=1 to limit clone exposure and speed up provisioning
- Validate that only HTTPS URLs are accepted for the runner image repo

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: deekay2310

cmd/mapt/cmd/params/params.go

@@ -1,6 +1,9 @@
 package params
 
 import (
+	"fmt"
+	"strings"
+
 	"github.com/redhat-developer/mapt/pkg/integrations/cirrus"
 	"github.com/redhat-developer/mapt/pkg/integrations/github"
 	"github.com/redhat-developer/mapt/pkg/integrations/gitlab"
@@ -288,18 +291,32 @@ func AddGHActionsFlags(fs *pflag.FlagSet) {
 
 func GithubRunnerArgs() *github.GithubRunnerArgs {
 	if viper.IsSet(ghActionsRunnerToken) {
+		imageRepo := viper.GetString(ghActionsRunnerImageRepo)
+		if imageRepo != "" {
+			if err := validateRunnerImageRepo(imageRepo); err != nil {
+				logging.Errorf("invalid --ghactions-runner-image-repo: %v", err)
+				return nil
+			}
+		}
 		return &github.GithubRunnerArgs{
 			Token:           viper.GetString(ghActionsRunnerToken),
 			RepoURL:         viper.GetString(ghActionsRunnerRepo),
 			Labels:          viper.GetStringSlice(ghActionsRunnerLabels),
 			Platform:        &github.Linux,
 			Arch:            linuxArchAsGithubActionsArch(viper.GetString(LinuxArch)),
-			RunnerImageRepo: viper.GetString(ghActionsRunnerImageRepo),
+			RunnerImageRepo: imageRepo,
 		}
 	}
 	return nil
 }
 
+func validateRunnerImageRepo(repo string) error {
+	if !strings.HasPrefix(repo, "https://") {
+		return fmt.Errorf("only HTTPS URLs are allowed, got: %s", repo)
+	}
+	return nil
+}
+
 func AddCirrusFlags(fs *pflag.FlagSet) {
 	fs.StringP(cirrusPWToken, "", "", cirrusPWTokenDesc)
 	fs.StringToStringP(cirrusPWLabels, "", nil, cirrusPWLabelsDesc)

pkg/integrations/github/snippet-linux-ppc64le.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-git clone {{ .RunnerImageRepo }} /opt/action-runner-image-pz
+git clone --depth=1 "{{ .RunnerImageRepo }}" /opt/action-runner-image-pz
 
 cd /opt/action-runner-image-pz
 bash -c '. scripts/vm.sh rhel 9 minimal --skip-snap-lxd'

pkg/integrations/github/snippet-linux-s390x.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-git clone {{ .RunnerImageRepo }} /opt/action-runner-image-pz
+git clone --depth=1 "{{ .RunnerImageRepo }}" /opt/action-runner-image-pz
 
 cd /opt/action-runner-image-pz
 bash -c '. scripts/vm.sh ubuntu 22.04 minimal --skip-snap-lxd'