The free-form path input is interpolated directly into the bash -c string (cd __repo__/${{ inputs.path }}), allowing anyone who can trigger this workflow to inject shell commands that execute with all production credentials (TWINE_PASSWORD, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, GPG_PRIVATE_KEY, DOCKER_PASSWORD, etc.) in scope. Move the value to an env: variable and reference it as a shell variable instead, e.g. env: PUBLISH_PATH: ${{ inputs.path }} and cd "__repo__/$PUBLISH_PATH".