Merge pull request from GHSA-575m-p85v-vjjp

Prevent code injection

.github/workflows/munge-pr.yml

@@ -3,6 +3,10 @@ name: Munge PR
 on:
   pull_request_target:
 
+permissions:
+  contents: read
+  pull-requests: write
+
 defaults:
   run:
     shell: 'bash -Eeuo pipefail -x {0}'
@@ -25,6 +29,7 @@ jobs:
       - id: gather
         name: Affected Images
         run: |
+          (set +x; echo "::stop-commands::$(echo -n ${{ github.token }} | sha256sum | head -c 64)")
           git fetch --quiet https://github.com/docker-library/official-images.git master
           images="$(git diff --no-renames --name-only FETCH_HEAD...HEAD -- library/)"
           if [ -n "$images" ]; then
@@ -47,6 +52,8 @@ jobs:
             }
           ')"
           jq . <<<"$images"
+          set +x
+          echo "::$(echo -n ${{ github.token }} | sha256sum | head -c 64)::"
           echo "::set-output name=images::$images"
     outputs:
       images: '${{ steps.gather.outputs.images }}'
@@ -59,10 +66,12 @@ jobs:
     steps:
       - name: Apply Labels
         uses: actions/github-script@v5
+        env:
+          IMAGES: ${{ needs.gather.outputs.images }}
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
-            const data = ${{ needs.gather.outputs.images }};
+            const data = JSON.parse(process.env.IMAGES);
             var labels = data.images;
             if (data.new.length > 0) {
               labels.push('new-image');