It’s pretty absurd for github to suggest that you should go through multiple steps to disable commands to log untrusted output. [1] Poor form to expect developers to understand and check for a new way that they need to sanitize their input rather than Github fixing it (possibly in a backwards incompatible way)
At a minimum they should provide a shell script (`show $XYZ`) and a js function that handles generating those tokens and enabling/disabling workflow commands for you.
At a minimum they should provide a shell script (`show $XYZ`) and a js function that handles generating those tokens and enabling/disabling workflow commands for you.
[1] https://github.blog/changelog/2020-10-01-github-actions-depr...