Comment by inahga

I probably would have made the same mistake. It is negligent to write GitHub Actions without using static analysis.

Use zizmor in CI https://github.com/zizmorcore/zizmor

    error[template-injection]: code injection via template expansion
      --> .github/workflows/jira_issue.yml:24:29
       |
    22 |         run: |
       |         --- this run block
    23 |           # Escape special characters in title and body
    24 |           TITLE=$(echo '${{ github.event.issue.title }}' | sed 's/"/\\"/g' | sed "s/'/\\\'/g")
       |                             ^^^^^^^^^^^^^^^^^^^^^^^^ may expand into attacker-controllable code
       |
       = note: audit confidence → High
       = note: this finding has an auto-fix