fork-upstream-sync

This workflow automates upstream synchronization and issue/PR updates, but directly interpolates the manually supplied fetch_depth value into shell code, creating a command-injection path for users authorized to dispatch the workflow. Injected commands would run in a GitHub-hosted runner, and the job has contents, issues, and pull-requests write permissions; no suspicious external domain, credential harvesting, or malware behavior is visible in this fragment. Severity is high for untrusted or broadly authorized dispatchers; restrict dispatch access and pass the value through an environment variable with validation.