Summary
The manual docs deploy path in .github/workflows/docs.yml interpolates github.event.inputs.version directly into a run: script. The release path in the same file already binds the version via env: / $MIKE_VERSION.
Proposed fix
Bind workflow_dispatch version under env: before mike deploy (quoted shell var), matching the release step pattern.
Note
CI hygiene / defense-in-depth — not filed as a vulnerability advisory.
Summary
The manual docs deploy path in
.github/workflows/docs.ymlinterpolatesgithub.event.inputs.versiondirectly into arun:script. The release path in the same file already binds the version viaenv:/$MIKE_VERSION.Proposed fix
Bind
workflow_dispatchversion underenv:beforemike deploy(quoted shell var), matching the release step pattern.Note
CI hygiene / defense-in-depth — not filed as a vulnerability advisory.