From 7a07dded5a2a32342b605b707069cb6d67e1d1e4 Mon Sep 17 00:00:00 2001
From: Denis Kasak <dkasak@termina.org.uk>
Date: Tue, 7 Jul 2026 11:09:30 +0200
Subject: [PATCH] Fix code injection in the release-artifacts.yml workflow

---
 .github/workflows/release-artifacts.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release-artifacts.yml b/.github/workflows/release-artifacts.yml
index a54722e95b..0f7a9ce157 100644
--- a/.github/workflows/release-artifacts.yml
+++ b/.github/workflows/release-artifacts.yml
@@ -204,8 +204,9 @@ jobs:
       - name: Attach to release
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          REF_NAME: ${{ github.ref_name }}
         run: |
-          gh release upload "${{ github.ref_name }}" \
+          gh release upload "$REF_NAME" \
             Sdist/* \
             Wheel*/* \
             debs.tar.xz \