fix security issue: untrusted ci output

.github/workflows/issue.yml

@@ -12,8 +12,6 @@ jobs:
     runs-on: ubuntu-latest
     name: Auto-assign new issues to projects
     steps:
-    - run: echo "${{github.event.issue.title}}"
-
     - name: Assign Bugs to the Bug Tracker
       uses: srggrs/assign-one-project-github-action@1.2.1
       if: github.event.action == 'opened' && startsWith(github.event.issue.title, '🐛 BUG:')

.github/workflows/main.yml

@@ -20,8 +20,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - id: setup
+        env:
+          MESSAGE: ${{ github.event.commits[0].message }}
         run:  |
-              TRIMMED=$(echo "${{ github.event.commits[0].message }}" | sed '1!d;q')
+              TRIMMED=$(echo "$MESSAGE" | sed '1!d;q')
               echo "::set-output name=COMMIT_MSG::${TRIMMED}" 
       - name: Send a Discord notification when a PR is merged
         env: