From 4668b7f86453e9fd75f6dad45f2919a96df0b91b Mon Sep 17 00:00:00 2001
From: Sash <sash@ela.city>
Date: Wed, 5 Aug 2026 17:17:12 +0700
Subject: [PATCH] ci: harden build-anchor inputs before shell use

Bind free-string program input under env before run scripts,
matching deploy-anchor. Defense-in-depth for the composite action.
---
 .github/actions/build-anchor/action.yaml | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/.github/actions/build-anchor/action.yaml b/.github/actions/build-anchor/action.yaml
index a32da816..9f2965d9 100644
--- a/.github/actions/build-anchor/action.yaml
+++ b/.github/actions/build-anchor/action.yaml
@@ -26,12 +26,15 @@ runs:
       if: inputs.replace_program_id == 'true'
       env:
         PROGRAM_ID: ${{ inputs.program_id }}
+        PROGRAM_NAME: ${{ inputs.program }}
       run: |
-        sed -i "s/declare_id!(\".*\")/declare_id!(\"${PROGRAM_ID}\")/g" ./programs/${{ inputs.program }}/src/lib.rs
+        sed -i "s/declare_id!(\".*\")/declare_id!(\"${PROGRAM_ID}\")/g" ./programs/${PROGRAM_NAME}/src/lib.rs
       shell: bash
 
     - name: Build with Anchor
-      run: ~/.cargo/bin/anchor build -p ${{ inputs.program }}
+      env:
+        PROGRAM_NAME: ${{ inputs.program }}
+      run: ~/.cargo/bin/anchor build -p "$PROGRAM_NAME"
       shell: bash
 
     - name: Store .so files