typo3-conformance

This is publishing guidance rather than executable package code. Its examples contain a potentially unsafe GitHub Actions pattern: release-controlled text is written using a fixed output delimiter and later interpolated directly into shell source, allowing command injection under attacker control of release metadata. Treat the workflow template as needing hardening before use; no evidence of malware is present in the document itself.

The workflow contains a high-impact GitHub Actions expression-to-shell injection vulnerability. Untrusted release metadata is interpolated into a Bash command without shell-safe handling, allowing a suitably privileged release author or compromised release event to execute arbitrary commands with access to TER publishing secrets. Use environment variables or a safe file/input mechanism and quote the variable at runtime rather than embedding the expression directly in the run script.