From a18f2519fafde7f404f3db6f584738987c1797a2 Mon Sep 17 00:00:00 2001
From: Frank Chen <frankchn@amazon.com>
Date: Tue, 14 Jul 2026 11:04:21 -0700
Subject: [PATCH] ci: prevent script injection in commit lint

---
 .github/workflows/ci.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9d416e8a..a03dfce7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -25,7 +25,10 @@ jobs:
       with:
         python-version: "3.12"
     - name: Lint commit messages
-      run: python .github/scripts/lintcommit.py --range "origin/${{ github.event.pull_request.base.ref }}..${{ github.event.pull_request.head.sha }}"
+      env:
+        PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+        PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+      run: python .github/scripts/lintcommit.py --range "${PR_BASE_SHA}..${PR_HEAD_SHA}"
 
   build:
     runs-on: ubuntu-latest