A branch name that turned auto-merge on for every pull request→
If your tool writes GitHub Actions YAML from a config file, you have built a code generator whose output runs with a privileged token. Here is how to validate every substituted value against the grammar it actually lands in, and prove it from both sides.
