Loading

Loading...

Back to Documentation

Security PolicyGHA-SEC013

GHA-SEC013Deprecated `set-output` Command

Problem Statement

The `::set-output` syntax is deprecated and insecure.

Vulnerability

Output Injection

Code Examples

Insecure Implementation

- run: echo "::set-output name=version::1.0"

Secure Implementation

- run: echo "version=1.0" >> "$GITHUB_OUTPUT"

Remediation Steps

Migrate to the modern `$GITHUB_OUTPUT` method.