The FerrFlow GitHub Action built three of its shell steps with ${{ }} interpolation, which substitutes a value into the script before the shell parses it. Any workflow that wired force_version, package or version from data it did not control: an issue title, a workflow_dispatch input, a matrix value derived from a pull request: could therefore have had that data executed as shell, in a job that by design holds a repository write token.

All three inputs now reach the step as environment variables, are quoted at every use, and are checked before they are passed on: version must be latest or a semver triple, force_version must be VERSION or NAME@VERSION, and each entry in package must look like a package name. Anything else fails the step with a clear message instead of running.

Arguments are assembled into an array and passed as ferrflow "${args[@]}", so a value containing spaces or shell metacharacters is one inert argument rather than parsed source.

What you need to do: nothing beyond moving to a current version of the Action. No input changed name, shape or meaning. If you were passing a value that does not match the formats above: a version string with unusual characters, for instance. The step will now tell you rather than silently doing something else.

Also fixed in the same change: mode: publish did not forward the bot inputs, so bot: true combined with mode: publish silently ran without the hosted bot token.