Prevent shell injection

gitea-pr-comment/action.yml

@@ -96,8 +96,11 @@ runs:
         -t "$GIT_SERVER_TOKEN"
 
     - name: Create pull request comment
+      env:
+        PR: ${{ inputs.pr }}
+        MESSAGE: ${{ inputs.message }}
       shell: bash
       run: >-
         cd "${{ inputs.path || env.GITHUB_WORKSPACE }}" &&
         echo "$PWD" &&
-        tea --debug comment '${{ inputs.pr }}' '${{ inputs.message }}'
+        tea --debug comment "${PR}" "${MESSAGE}"