fix(ci): prevent script injection in trigger-codepipeline workflow

[laileni-aws]

Summary

Fixes an ACAT/AppSec script injection finding in .github/workflows/trigger-codepipeline.yml (lines 24-26). The github.event.head_commit.author.name context value was interpolated directly via ${{ }} into the inline run: script.

A commit author name is user-controlled — an attacker can craft a commit whose author name contains shell metacharacters (e.g. $(...) or "; ...; "). When that commit lands on main, the workflow runs the injected command. This job has id-token: write and assumes GitHubActionsCodePipelineRole, so injected commands would execute with AWS credentials able to start CodePipeline.

Fix

Per GitHub Actions security-hardening guidance, the value is now bound to a step-level env: variable and referenced as a quoted shell variable ($COMMIT_AUTHOR). Environment values are passed to the shell as data rather than expanded into script text, which removes the injection vector. No behavior change for legitimate commits.

       - name: Trigger CodePipeline for Maven/NuGet
+        env:
+          COMMIT_AUTHOR: ${{ github.event.head_commit.author.name }}
         run: |
-          echo "Triggering CodePipeline for user commit by ${{ github.event.head_commit.author.name }}"
+          echo "Triggering CodePipeline for user commit by $COMMIT_AUTHOR"
           aws codepipeline start-pipeline-execution --name PackagePipeline

Note: the if: condition on the job also references head_commit.author.name, but that is a GitHub Actions expression (evaluated by the expression engine, not the shell), so it is not an injection vector and is unchanged.

Testing

• python3 -c "import yaml; yaml.safe_load(open('.github/workflows/trigger-codepipeline.yml'))" -> parses OK
• Confirmed no ${{ github.* }} interpolation remains inside the run: block.