typo3-conformance

The workflow contains a high-impact GitHub Actions expression-to-shell injection vulnerability. Untrusted release metadata is interpolated into a Bash command without shell-safe handling, allowing a suitably privileged release author or compromised release event to execute arbitrary commands with access to TER publishing secrets. Use environment variables or a safe file/input mechanism and quote the variable at runtime rather than embedding the expression directly in the run script.