zernio

The workflow has a command-injection vulnerability: the manually provided version is interpolated unquoted into a shell command. Restrict and validate the version and pass it through a safely quoted environment variable or an argument-safe mechanism. Apart from this issue, the publishing and release steps appear consistent with the workflow's purpose.