From 04239f56186c8018eb6e6eb7d3cd21c1f22f914b Mon Sep 17 00:00:00 2001
From: "clouddrove-factory[bot]"
 <clouddrove-factory[bot]@users.noreply.github.com>
Date: Mon, 20 Jul 2026 03:47:05 -0400
Subject: [PATCH 1/2] fix(infracost): replace deprecated set-output with
 GITHUB_OUTPUT

The Slack-message step used the legacy ::set-output workflow command,
which GitHub has deprecated and will disable. Write to $GITHUB_OUTPUT
instead, using a run-id-scoped heredoc delimiter for the multi-line
slack-message value.
---
 .github/workflows/infracost.yml | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/infracost.yml b/.github/workflows/infracost.yml
index 8f0ee8ea..15c4e8e5 100644
--- a/.github/workflows/infracost.yml
+++ b/.github/workflows/infracost.yml
@@ -87,8 +87,12 @@ jobs:
       - name: 📨 Generate Slack message
         id: infracost-slack
         run: |
-          echo "::set-output name=slack-message::$(infracost output --path=/tmp/infracost.json --format=slack-message --show-skipped)"
-          echo "::set-output name=diffTotalMonthlyCost::$(jq '(.diffTotalMonthlyCost // 0) | tonumber' /tmp/infracost.json)"
+          {
+            echo "slack-message<<EOF_${{ github.run_id }}"
+            infracost output --path=/tmp/infracost.json --format=slack-message --show-skipped
+            echo "EOF_${{ github.run_id }}"
+          } >> "$GITHUB_OUTPUT"
+          echo "diffTotalMonthlyCost=$(jq '(.diffTotalMonthlyCost // 0) | tonumber' /tmp/infracost.json)" >> "$GITHUB_OUTPUT"
 
       - name: 🚀 Send cost estimate to Slack
         uses: slackapi/slack-github-action@v3

From b26863154da498f94e4d434f37063daa21f266b6 Mon Sep 17 00:00:00 2001
From: "clouddrove-factory[bot]"
 <clouddrove-factory[bot]@users.noreply.github.com>
Date: Mon, 20 Jul 2026 03:51:51 -0400
Subject: [PATCH 2/2] fix(infracost): use a random heredoc delimiter for
 GITHUB_OUTPUT

github.run_id is public and sequential, so using it as the multiline
delimiter let a crafted infracost line in principle terminate the
heredoc early and smuggle extra key=value pairs into $GITHUB_OUTPUT.
Generate the delimiter from openssl rand instead.
---
 .github/workflows/infracost.yml | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/infracost.yml b/.github/workflows/infracost.yml
index 15c4e8e5..d1738a41 100644
--- a/.github/workflows/infracost.yml
+++ b/.github/workflows/infracost.yml
@@ -87,10 +87,11 @@ jobs:
       - name: 📨 Generate Slack message
         id: infracost-slack
         run: |
+          delimiter="EOF_$(openssl rand -hex 16)"
           {
-            echo "slack-message<<EOF_${{ github.run_id }}"
+            echo "slack-message<<${delimiter}"
             infracost output --path=/tmp/infracost.json --format=slack-message --show-skipped
-            echo "EOF_${{ github.run_id }}"
+            echo "${delimiter}"
           } >> "$GITHUB_OUTPUT"
           echo "diffTotalMonthlyCost=$(jq '(.diffTotalMonthlyCost // 0) | tonumber' /tmp/infracost.json)" >> "$GITHUB_OUTPUT"