In general, the fix is to prevent arbitrary content from pr_number.txt from being written directly into the GITHUB_ENV file. We should (1) strip newlines so the variable assignment cannot be split across multiple lines, and (2) optionally validate that the value is a numeric PR number before using it. This ensures an attacker cannot inject additional environment variables by crafting pr_number.txt with embedded newlines or KEY=VALUE lines.

The best minimal fix here, without changing the workflow’s overall behavior, is to read pr_number.txt into a shell variable, normalize it to a single line, validate that it looks like a PR number (digits only), and then write it to $GITHUB_ENV using the hardened echo pattern recommended by GitHub: echo "VAR=$(echo "$VAR" | tr -d '\n')" >> "$GITHUB_ENV". If validation fails, the step should fail early rather than proceeding with a malicious or malformed value.

Concretely, in .github/workflows/pr-test-summary.yml lines 27–33, replace the simple cat-and-echo sequence with a small shell script that:

• Checks the file exists (as now).
• Reads PR_NUMBER from the file.
• Strips whitespace/newlines.
• Verifies it matches ^[0-9]+$.
• Writes PR_NUMBER=<sanitized_value> to $GITHUB_ENV using double quotes around $GITHUB_ENV.

No external dependencies are needed; we can use standard POSIX tools (tr, grep/shell pattern) available in ubuntu-latest.