Pass Semgrep inputs to the scan step through env

.github/workflows/semgrep.yml

@@ -36,6 +36,9 @@ jobs:
           fetch-depth: 0
 
       - name: Run Semgrep
+        env:
+          EXTRA_CONFIGS: ${{ inputs.extra-configs }}
+          BASELINE_COMMIT: ${{ github.event.pull_request.base.sha }}
         run: |
           # Replaces the registry's github-actions-mutable-action-tag rule, which only accepts
           # commit SHAs. Workflows lock action commits in actions.lock, so an exact vX.Y.Z tag
@@ -72,16 +75,19 @@ jobs:
                       - pattern-not-regex: '@[0-9a-f]{40}(\s|$)'
                       - pattern-not-regex: '@v[0-9]+\.[0-9]+\.[0-9]+(\s|$)'
           RULE
+          # EXTRA_CONFIGS is a space-separated list of flags, so it is split on purpose.
+          set -f
+          # shellcheck disable=SC2086
           semgrep scan \
             --config p/security-audit \
             --config p/owasp-top-ten \
             --config p/secrets \
             --config p/github-actions \
             --config "$RUNNER_TEMP/github-actions-mutable-action-tag.yml" \
             --exclude-rule yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag \
-            ${{ inputs.extra-configs }} \
+            $EXTRA_CONFIGS \
             --severity ERROR --severity WARNING \
-            --baseline-commit ${{ github.event.pull_request.base.sha }} \
+            --baseline-commit "$BASELINE_COMMIT" \
             --json \
             -o semgrep-results.json || true
 

scripts/test_semgrep_triage.py

@@ -314,6 +314,14 @@ def test_allows_exact_tags_shas_and_same_repo_actions(self):
         ):
             self.assertFalse(self.flagged(uses), uses)
 
+    def test_inputs_reach_the_shell_through_env(self):
+        steps = yaml.safe_load(WORKFLOW.read_text())["jobs"]["scan"]["steps"]
+        step = next(s for s in steps if s.get("name") == "Run Semgrep")
+        self.assertNotIn("${{", self.script)
+        self.assertEqual(step["env"]["EXTRA_CONFIGS"], "${{ inputs.extra-configs }}")
+        self.assertIn("$EXTRA_CONFIGS \\\n", self.script)
+        self.assertIn('--baseline-commit "$BASELINE_COMMIT"', self.script)
+
     def test_flags_floating_tags_and_branches(self):
         for uses in ("actions/checkout@v4", "actions/checkout@v4.4", "actions/checkout@main", "actions/setup-node@v4.4.0-beta.1"):
             self.assertTrue(self.flagged(uses), uses)