dot

The workflow is ordinary CI configuration, but it exposes GETDOT_TEST_TOKEN to live-test and CLI steps while allowing a manual dispatcher to choose the server URL. If those steps authenticate to the selected server, a dispatcher with permission to run the workflow could direct the token to an attacker-controlled endpoint; the relevant default domain is app[.]getdot[.]ai. No direct exfiltration implementation is shown in this fragment, so the risk depends on the behavior of the invoked tests and CLI.

This workflow builds binaries and publishes them as a GitHub Release. It contains a shell-injection risk because the pushed tag name is interpolated directly into shell commands; a crafted tag may execute commands in the release job, which has contents: write permission and access to GITHUB_TOKEN. Severity is high for repositories where untrusted users can push tags; use an environment variable and quote it as data rather than interpolating it into the script.