.github/workflows/add-upstream-bugfix-note.yml:60

• The upstream-link detection regex github\.com/salt/pull/([0-9]+) is missing the /<repo>/ path segment (and doesn’t match the common saltstack/salt repo). This will cause the job to skip adding notes even when the PR description contains a valid upstream PR link. Adjust the regex to match the actual upstream URL patterns you want to support.

          BODY="${{ github.event.pull_request.body }}"
          if [[ "$BODY" =~ (https://)?github\.com/salt/pull/([0-9]+) ]]; then
            URL="${BASH_REMATCH[0]}"
            if [[ ! "$URL" =~ ^https:// ]]; then URL="https://$URL"; fi
            echo "URL=$URL" >> $GITHUB_ENV

.github/workflows/add-upstream-bugfix-note.yml:71

• The “rebase merge detected” fallback derives SHAs by taking the last pull_request.commits commits from the base branch. That’s not guaranteed to correspond to the commits introduced by this PR (it can include unrelated commits if other changes land on the base branch around the same time), so notes may be attached to the wrong commits. Prefer determining the exact merged commit SHAs for the PR (e.g., via the GitHub API/GraphQL for the PR’s commit SHAs or by computing the exact commit range introduced by the merge) rather than using git log ... -n COUNT on the base branch tip.

              COUNT=${{ github.event.pull_request.commits }}
              echo "Rebase merge detected. Using last $COUNT commits from ${{ github.event.pull_request.base.ref }}"
              git fetch origin ${{ github.event.pull_request.base.ref }}
              COMMITS=$(git log origin/${{ github.event.pull_request.base.ref }} -n "$COUNT" --pretty=format:"%H" | tr '\n' ' ')
              echo "COMMITS=$COMMITS" >> $GITHUB_ENV
            fi

.github/workflows/add-upstream-bugfix-note.yml:124

• Same env-file injection concern here: the PR body content is untrusted input and could include the chosen delimiter string. Prefer a unique delimiter per write and/or validate/sanitize values before appending to $GITHUB_ENV.

            # Use heredoc delimiters to prevent env-file injection
            {
              echo "URL<<EOF"
              echo "$URL"
              echo "EOF"
              echo "COMMITS<<EOF"
              echo "$COMMITS"
              echo "EOF"
            } >> $GITHUB_ENV

.github/workflows/add-upstream-bugfix-note.yml:147

• This second write to $GITHUB_ENV should also be quoted (use >> "$GITHUB_ENV") for shell safety/consistency.

            DELIMITER="ghadelimiter_${RANDOM}_${RANDOM}_${RANDOM}"
            {
              echo "URL<<${DELIMITER}"
              echo "$URL"
              echo "${DELIMITER}"
              echo "COMMITS<<${DELIMITER}"
              echo "$COMMITS"
              echo "${DELIMITER}"
            } >> $GITHUB_ENV

.github/workflows/add-upstream-bugfix-note.yml:176

• This $GITHUB_ENV write should be quoted as well (>> "$GITHUB_ENV") to avoid potential word-splitting/globbing issues.

          done

          echo "NOTES_ADDED=$NOTES_ADDED" >> $GITHUB_ENV