fix: use github.head_ref env var as trusted input

Update slugify-value to 1.3.3
Update shortify-git-revision to 1.5.1

Signed-off-by: Nick Reynolds <nickittynack@users.noreply.github.com>

action.yml

@@ -26,73 +26,87 @@ runs:
         INPUT_SLUG_MAXLENGTH: ${{ inputs.slug-maxlength }}
         INPUT_SHORT_LENGTH: ${{ inputs.short-length }}
 
-    - uses: rlespinasse/slugify-value@v1.3.2
+    # From Environment Variables
+    - uses: rlespinasse/slugify-value@v1.4.0
       with:
         key: GITHUB_REPOSITORY
         value: ${{ github.repository }}
         prefix: ${{ inputs.prefix }}
         slug-maxlength: ${{ inputs.slug-maxlength }}
-    - uses: rlespinasse/slugify-value@v1.3.2
+    - uses: rlespinasse/slugify-value@v1.4.0
       with:
         key: GITHUB_REF
         prefix: ${{ inputs.prefix }}
         slug-maxlength: ${{ inputs.slug-maxlength }}
-    - uses: rlespinasse/slugify-value@v1.3.2
+    - uses: rlespinasse/slugify-value@v1.4.0
       with:
         key: GITHUB_HEAD_REF
         prefix: ${{ inputs.prefix }}
         slug-maxlength: ${{ inputs.slug-maxlength }}
-    - uses: rlespinasse/slugify-value@v1.3.2
+    - uses: rlespinasse/slugify-value@v1.4.0
       with:
         key: GITHUB_BASE_REF
         prefix: ${{ inputs.prefix }}
         slug-maxlength: ${{ inputs.slug-maxlength }}
 
-    # Specific values
-    - uses: rlespinasse/slugify-value@v1.3.2
+    # From Specific values
+    - uses: rlespinasse/slugify-value@v1.4.0
       with:
         key: GITHUB_EVENT_REF
         value: ${{ github.event.ref }}
         prefix: ${{ inputs.prefix }}
         slug-maxlength: ${{ inputs.slug-maxlength }}
-
-    # Calculated values
-    - id: get-github-ref-name
-      run: echo "::set-output name=github-ref-name::${{ github.head_ref || github.ref_name }}"
-      shell: bash
-    - uses: rlespinasse/slugify-value@v1.3.2
+    - uses: rlespinasse/slugify-value@v1.4.0
       with:
         key: GITHUB_REF_NAME
-        value: ${{ steps.get-github-ref-name.outputs.github-ref-name }}
+        # Related to https://github.com/rlespinasse/github-slug-action/issues/104
+        value: ${{ env.GITHUB_HEAD_REF_RAW || env.GITHUB_REF_NAME_RAW }}
         prefix: ${{ inputs.prefix }}
         slug-maxlength: ${{ inputs.slug-maxlength }}
+      env:
+        GITHUB_HEAD_REF_RAW: ${{ github.head_ref }}
+        GITHUB_REF_NAME_RAW: ${{ github.ref_name }}
+
+    # From Calculated values
     - id: get-github-repository-owner-part
-      run: echo "::set-output name=github-repository-owner-part::$(echo $GITHUB_REPOSITORY | cut -d/ -f1)"
+      run: |
+        ownerpart=$(echo $GITHUB_REPOSITORY | cut -d/ -f1)
+        if [ -f "$GITHUB_OUTPUT" ]; then
+          echo "github-repository-owner-part=${ownerpart}" >> "$GITHUB_OUTPUT"
+        else
+          echo "::set-output name=github-repository-owner-part::${ownerpart}"
+        fi
       shell: bash
-    - uses: rlespinasse/slugify-value@v1.3.2
+    - uses: rlespinasse/slugify-value@v1.4.0
       with:
         key: GITHUB_REPOSITORY_OWNER_PART
         value: ${{ steps.get-github-repository-owner-part.outputs.github-repository-owner-part }}
         prefix: ${{ inputs.prefix }}
         slug-maxlength: ${{ inputs.slug-maxlength }}
     - id: get-github-repository-name-part
-      run: echo "::set-output name=github-repository-name-part::$(echo $GITHUB_REPOSITORY | cut -d/ -f2)"
+      run: |
+        namepart=$(echo $GITHUB_REPOSITORY | cut -d/ -f2)
+        if [ -f "$GITHUB_OUTPUT" ]; then
+          echo "github-repository-name-part=${namepart}" >> "$GITHUB_OUTPUT"
+        else
+          echo "::set-output name=github-repository-name-part::${namepart}"
+        fi
       shell: bash
-    - uses: rlespinasse/slugify-value@v1.3.2
+    - uses: rlespinasse/slugify-value@v1.4.0
       with:
         key: GITHUB_REPOSITORY_NAME_PART
         value: ${{ steps.get-github-repository-name-part.outputs.github-repository-name-part }}
         prefix: ${{ inputs.prefix }}
         slug-maxlength: ${{ inputs.slug-maxlength }}
 
-    # Short
-    - uses: rlespinasse/shortify-git-revision@v1.4.0
+    # From sha
+    - uses: rlespinasse/shortify-git-revision@v1.6.0
       with:
         name: GITHUB_SHA
         short-on-error: true
         length: ${{ steps.prefligth.outputs.PREFLIGHT_SHORT_LENGTH }}
         prefix: ${{ inputs.prefix }}
-    - uses: rlespinasse/shortify-git-revision@v1.4.0
+    - uses: rlespinasse/shortify-git-revision@v1.6.0
       with:
         name: GITHUB_EVENT_PULL_REQUEST_HEAD_SHA
         revision: ${{ github.event.pull_request.head.sha }}

preflight.sh

@@ -31,4 +31,8 @@ else
   fi
 fi
 echo "::debug ::Set PREFLIGHT_SHORT_LENGTH=$PREFLIGHT_SHORT_LENGTH"
-echo "::set-output name=PREFLIGHT_SHORT_LENGTH::$PREFLIGHT_SHORT_LENGTH"
+if [ -f "$GITHUB_OUTPUT" ]; then
+  echo "PREFLIGHT_SHORT_LENGTH=${PREFLIGHT_SHORT_LENGTH}" >> "$GITHUB_OUTPUT"
+else
+  echo "::set-output name=PREFLIGHT_SHORT_LENGTH::${PREFLIGHT_SHORT_LENGTH}"
+fi