fix: prevent expression injection in pr-command workflow (CWE-78)

[YashasviChaurasia]

Description of the change

• Fixes a GitHub Actions expression injection vulnerability in .github/workflows/pr-command.yaml (CVSS 3.1: 8.6 High)
• The github.event.comment.body was interpolated directly into a run: block via ${{ }}, allowing arbitrary command injection through crafted PR comments
• Moved the comment body to an env: variable so the shell receives it as a plain string, preventing injection

Details

Before (vulnerable):

  run: |
    COMMENT="${{ github.event.comment.body }}"

After (safe):

  env:
    COMMENT: ${{ github.event.comment.body }}
  run: |
    if [[ "$COMMENT" == /build* ]]; then

References

• https://securitylab.github.com/resources/github-actions-untrusted-input/
• https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#understanding-the-risk-of-script-injections

Test plan

• Verify /build comment still triggers the build job
• Verify /merge comment still triggers the merge job
• Confirm no expression injection is possible via crafted comments

Related issue number

How to verify the PR

Was the PR tested

• I have added >=1 unit test(s) for every new method I have added.
• I have ensured all unit tests pass

[github-actions]

Thanks for making a pull request! 😃
One of the maintainers will review and advise on the next steps.