./testdata/err/one_error.yaml:6:41: "github.event.head_commit.message" is potentially untrusted. avoid using it directly in inline scripts. instead, pass it through an environment variable. see https://docs.github.com/en/actions/reference/security/secure-use#good-practices-for-mitigating-script-injection-attacks for more details [expression]
  |
6 |       - run: echo "Checking commit '${{ github.event.head_commit.message }}'"
  |                                         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
