fix(16): WR-01/WR-03 bind PR context via env; symmetric HEAD_SHA fallback

Bind github.base_ref/base.sha/head.sha through env: and reference quoted
shell vars (no inline ${{ }} in run:) to close the script-injection vector.
Add a HEAD_SHA rev-parse fallback mirroring BASE_SHA and echo the final
${BASE_SHA}..${HEAD_SHA} range before gitleaks.

.gitea/workflows/ci.yml

@@ -358,17 +358,33 @@ jobs:
       # github.event.pull_request.base.sha may be empty on some Gitea versions.
       # If so, fall back to git merge-base to compute the real branch-point SHA.
       - name: Probe PR base/head SHA
+        # WR-01: bind context values through env: so they are never substituted
+        # into the rendered shell body (script-injection vector — github.base_ref
+        # is an attacker-influenceable branch name). Reference them as already-
+        # quoted shell variables only.
+        env:
+          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          PR_BASE_REF: ${{ github.base_ref }}
         run: |
           set -euo pipefail
-          echo "Event base.sha: ${{ github.event.pull_request.base.sha }}"
+          echo "Event base.sha: $PR_BASE_SHA"
-          echo "Event head.sha: ${{ github.event.pull_request.head.sha }}"
+          echo "Event head.sha: $PR_HEAD_SHA"
-          BASE_SHA="${{ github.event.pull_request.base.sha }}"
+          BASE_SHA="$PR_BASE_SHA"
-          HEAD_SHA="${{ github.event.pull_request.head.sha }}"
+          HEAD_SHA="$PR_HEAD_SHA"
           if [ -z "$BASE_SHA" ]; then
             echo "base.sha empty — computing merge-base fallback"
-            BASE_SHA=$(git merge-base "$(git rev-parse origin/${{ github.base_ref }})" HEAD)
+            BASE_SHA=$(git merge-base "$(git rev-parse "origin/$PR_BASE_REF")" HEAD)
             echo "Computed BASE_SHA via merge-base: $BASE_SHA"
           fi
+          # WR-03: mirror the base fallback for head so the scan range is never
+          # silently left half-empty (A.. only happens to default to A..HEAD).
+          if [ -z "$HEAD_SHA" ]; then
+            echo "head.sha empty — falling back to git rev-parse HEAD"
+            HEAD_SHA=$(git rev-parse HEAD)
+            echo "Computed HEAD_SHA via rev-parse: $HEAD_SHA"
+          fi
+          echo "Secret-scan range: ${BASE_SHA}..${HEAD_SHA}"
           echo "BASE_SHA=$BASE_SHA" >> "$GITHUB_ENV"
           echo "HEAD_SHA=$HEAD_SHA" >> "$GITHUB_ENV"