Fix command injection in required-field-check workflow

[varadarajan-tw]

Summary

• Remediates OS command injection vulnerability (CWE-78) in the required-field-check GitHub Actions workflow
• PR filenames from the GitHub API were interpolated unquoted into bash commands via ${{ }} expressions, allowing arbitrary command execution if a filename contained shell metacharacters like $()
• Fix: output files as a JSON array, pass through an env variable (avoiding inline ${{ }} interpolation), parse safely with jq, and construct args with proper bash array quoting

JIRA - https://twilio-engineering.atlassian.net/browse/SECOPS-23951

Test plan

• Verify the Required Field Check workflow passes on this PR
• Confirm filenames with special characters are handled safely (no shell expansion)
• Validate that the workflow still correctly detects new required fields on PRs that modify destination definitions

Test: Verified that filenames with shell metacharacters are treated as literals and not executed.

Input: JSON array with malicious filename

CHANGED_FILES='["file1.ts", "file$(echo INJECTED).ts", "file with spaces.ts"]'

Parse with jq (new safe method)

while IFS= read -r file; do
ARGS+=(-p "$file")
done < <(echo "$CHANGED_FILES" | jq -r '.[]')

Result:

• file$(echo INJECTED).ts → treated as literal string, no command execution
• file with spaces.ts → properly quoted and handled
• All arguments correctly passed to CLI with proper escaping

🤖 Generated with Claude Code