CVE-2025-47271: OZI-Project/ozi-publish Code Injection vulnerability

The vulnerability lies in a GitHub Action defined in action.yml. Specifically, the 'Create pull request' step used a run command that directly interpolated GitHub context variables (like branch names) and inputs into a gh pr create shell command. The patch changes this to use environment variables, which is a standard mitigation for command injection in shell scripts. The vulnerable 'function' is considered to be the execution of this named step, as its run script contained the flawed command construction. A runtime profiler or logs for GitHub Actions would likely identify execution units by their step names. The patch diff clearly shows the removal of the vulnerable command string and its replacement with a safer method using environment variables.