update pr testing workflow with stronger checks

.github/workflows/pr-test-trigger.yml

@@ -93,26 +93,41 @@ jobs:
           TCTEST_TOKEN_TC: ${{ secrets.TCTEST_TOKEN_TC }}
           GITHUB_TOKEN: ${{ github.token }}
         run: |
-          parallelism=$(echo "${COMMENT_BODY}" | grep -oiP 'PARALLELISM=\d+' | head -1)
-          pattern=$(echo "${COMMENT_BODY}" | grep -oiP 'PATTERN=\K\S+' | head -1)
+          # Extract PARALLELISM=<digits> — digits only, safe for arithmetic comparison.
+          parallelism_value=$(echo "${COMMENT_BODY}" | grep -oiP '(?<=PARALLELISM=)\d+' | head -1)
+
+          # Extract PATTERN and allow only characters valid in a Go test name:
+          # alphanumerics, underscores, hyphens, dots, slashes, backslashes, parentheses, and the anchors ^ and $.
+          # Any other character causes the pattern to be rejected entirely.
+          raw_pattern=$(echo "${COMMENT_BODY}" | grep -oiP '(?<=PATTERN=)\S+' | head -1)
+          if [[ -n "${raw_pattern}" ]]; then
+            if [[ ! "${raw_pattern}" =~ ^[a-zA-Z0-9_.^$/|\\()-]+$ ]]; then
+              echo "::error::PATTERN contains disallowed characters: ${raw_pattern}"
+              exit 1
+            fi
+            pattern="${raw_pattern}"
+          fi
+
+          # Validate PKGS (from GitHub API) before embedding in properties string.
+          if [[ ! "${PKGS}" =~ ^[a-zA-Z0-9_-]+$ ]]; then
+            echo "::error::PKGS contains unexpected characters: ${PKGS}"
+            exit 1
+          fi
           properties="PKG=${PKGS}"
-          if [[ -n "${parallelism}" ]]; then
-            parallelism_value="${parallelism#*=}"
+          if [[ -n "${parallelism_value}" ]]; then
             if [[ "${parallelism_value}" -gt 20 ]]; then
               echo "::error::Parallelism value ${parallelism_value} exceeds maximum of 20"
               exit 1
             fi
             properties="${properties};ACCTEST_PARALLELISM=${parallelism_value}"
           fi
 
-          # Build tctest command with optional pattern
-          tctest_cmd="tctest pr ${PR_NUMBER}"
+          # Invoke tctest directly — no eval, no string-assembled commands.
           if [[ -n "${pattern}" ]]; then
-            tctest_cmd="${tctest_cmd} \"${pattern}\""
-          fi
-          tctest_cmd="${tctest_cmd} --properties \"${properties}\" --comment"
-
-          eval ${tctest_cmd}
+            tctest pr "${PR_NUMBER}" "${pattern}" --properties "${properties}" --comment --reappend-split-character
+          else
+            tctest pr "${PR_NUMBER}" --properties "${properties}" --comment --reappend-split-character
+          fix
 
       - name: Comment on Test Start
         if: steps.run_tests.outcome == 'success'