deployment-automation

No clear malware, credential theft, data exfiltration, destructive behavior, or backdoor is present. The primary risks are deployment configuration errors, mutable third-party tooling, unpinned external Helm content, and direct shell interpolation of secret-controlled values. The workflow should pin actions and kubectl to trusted commit or version identifiers, pin the Helm chart or digest, validate and safely quote inputs, and correct the environment-selection logic.