container-hadolint

The workflow contains a significant pull-request shell-injection risk because repository-controlled filenames are interpolated into a shell script. It also executes an unverified binary downloaded from a mutable release URL. These issues warrant remediation; no direct evidence of malicious payload behavior is present in the provided code.