One serious problem not mentioned in the article is the feature that looks for magic strings in the output and treats them as special commands [0], meaning that

One serious problem not mentioned in the article is the feature that looks for magic strings in the output and treats them as special commands [0], meaning that you can't safely output anything that's not completely trusted or carefully filtered. At least it's deprecated now, but they apparently decided to postpone the removal because too many people are still using it. Maybe if we all do our part in migrating to the new way [1], they will eventually close this giant security hole. [0] https://github.blog/changelog/2022-10-11-github-actions-deprecating-save-state-and-set-output-commands/ https://github.blog/changelog/2022-10-11-github-actions-depr... [1] https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#environment-files https://docs.github.com/en/actions/using-workflows/workflow-...