Upstream ee5455d9: fix(repo): prevent script injection in release-docker workflow (#3024)

[github-actions]

Upstream commit, filed automatically for a decision. No action is implied.

Commit	ee5455d9
Subject	fix(repo): prevent script injection in release-docker workflow (#3024)
Author	Mateusz Wroński
Date	2026-08-04

Files touched

.github/workflows/release-docker.yml | 26 ++++++++++++++++++--------
 1 file changed, 18 insertions(+), 8 deletions(-)

The decision

• Adopt — port it here, on our terms, with our tests
• Decline — close as not planned, with the reason in a comment

Spotlight Tools is a separate tool suite as of the fork and is not kept aligned with
upstream. Most of these should be declined; that is the system working, not a backlog
going stale. The reason for declining is the valuable part, because it is what tells
somebody later why the two builds differ.