play-store-publish

The fragment documents legitimate Google Play release workflows and shows no evidence of malware or explicit data theft. The promotion workflow has a shell-injection vulnerability because `versionCode` and `userFraction` dispatch inputs are interpolated directly into a `run` script; pass them through environment variables and validate them. The mutable `r0adkll/upload-google-play@v1` reference and unpinned Python dependencies add supply-chain risk, while the workflows handle Google Play service-account and Android signing credentials. Overall severity is moderate; no suspicious domain or IP address is present in the fragment.