docs: recommend safe JSON consumption of changed files to prevent argument injection

[somaz94]

Documents the recommended pattern for safely forwarding the list of changed files to another command: consume the JSON output (json: true, escape_json: false) into a bash array with jq/mapfile and pass it after the -- end-of-options separator. Without this, a file whose name starts with - (e.g. --config=evil.cjs) can inject options into the downstream command and lead to code execution in CI.

• Adds a "Safely consume the list of changed files (recommended)" example to the Examples section.
• Adds an argument-injection caveat to the Important Notice section, alongside the existing spaces-in-filenames note.

Validation:

• <details> / code-fence balance preserved.
• Embedded bash snippet passes shellcheck -S style (clean).
• Edits are outside the AUTO-DOC managed regions, so auto-doc will not conflict.

related: #2880

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[somaz94]

Just a friendly ping 🙂 — this has been green and awaiting review for about 3 weeks now. Happy to rebase or address any feedback whenever a maintainer has a chance to take a look. Thanks for maintaining this project!

[somaz94]

@jackton1 — following up on my 8 Jul note and correcting it: I said this had been green for about three weeks, which wasn't accurate. There are zero workflow runs on this PR; the only checks are Codacy and GitGuardian, which are third-party apps reporting independently of the repo's own CI. Fork PRs from April onward all show zero runs, while in-repo PRs get the full 8.

That said, this one is docs-only (+31/−0, README.md alone), so the missing CI isn't material here — it just needs a read. It documents consuming the changed-files JSON outputs safely to avoid argument injection.

Would you have a moment to take a look?