infra-ci-cd-github-actions

The fragment documents legitimate deployment workflows and contains no clear malicious payload or intentional data theft. However, the rollback workflow has a significant command-injection risk because the manually supplied deployment ID is interpolated unquoted into a shell command. Validate it against a strict Vercel deployment-ID format and pass it safely as a separate argument or avoid shell interpolation. Pin third-party actions to immutable commit SHAs and explicitly restrict workflow permissions. Overall this is a security-risky example, but malware is not indicated.