fix: harden importlib import and prevent action script injection

- Use explicit `import importlib.util` in test helper instead of fragile
  `__import__("importlib").util` which can raise AttributeError
- Pass action inputs via env vars in Claude Code action to avoid shell
  script injection from direct ${{ inputs.* }} interpolation

Co-authored-by: Mervin Praison <[email protected]>

.github/actions/claude-code-action/action.yml

@@ -261,30 +261,34 @@ runs:
         CMD_ARGS=("-p" "--verbose" "--output-format" "stream-json")
         
         # Add max turns if specified
-        if [[ -n "${{ inputs.max_turns }}" ]]; then
-          CMD_ARGS+=("--max-turns" "${{ inputs.max_turns }}")
+        if [[ -n "$INPUT_MAX_TURNS" ]]; then
+          CMD_ARGS+=("--max-turns" "$INPUT_MAX_TURNS")
         fi
         
         # Add allowed tools (include GitHub tools by default)
         TOOLS="mcp__github__get_issue,mcp__github__get_issue_comments,mcp__github__update_issue,mcp__github__search_issues,mcp__github__list_issues,mcp__github__create_comment,Read,Write,Edit,Bash"
-        if [[ -n "${{ inputs.allowed_tools }}" ]]; then
-          TOOLS="$TOOLS,${{ inputs.allowed_tools }}"
+        if [[ -n "$INPUT_ALLOWED_TOOLS" ]]; then
+          TOOLS="$TOOLS,$INPUT_ALLOWED_TOOLS"
         fi
         CMD_ARGS+=("--allowedTools" "$TOOLS")
         
         # Add disallowed tools
-        if [[ -n "${{ inputs.disallowed_tools }}" ]]; then
-          CMD_ARGS+=("--disallowedTools" "${{ inputs.disallowed_tools }}")
+        if [[ -n "$INPUT_DISALLOWED_TOOLS" ]]; then
+          CMD_ARGS+=("--disallowedTools" "$INPUT_DISALLOWED_TOOLS")
         fi
         
         echo "📝 Executing Claude Code with prompt from file..."
         
         # Execute Claude Code with timeout, using stdin for the prompt
-        TIMEOUT_SECONDS=$((${{ inputs.timeout_minutes }} * 60))
-        timeout $TIMEOUT_SECONDS claude "${CMD_ARGS[@]}" < "${{ env.PROMPT_FILE }}"
+        TIMEOUT_SECONDS=$(( ${INPUT_TIMEOUT_MINUTES:-10} * 60 ))
+        timeout "$TIMEOUT_SECONDS" claude "${CMD_ARGS[@]}" < "$PROMPT_FILE"
         
         echo "✅ Claude Code execution completed"
       env:
         ANTHROPIC_API_KEY: ${{ inputs.anthropic_api_key }}
         CLAUDE_CODE_OAUTH_TOKEN: ${{ inputs.claude_code_oauth_token }}
-        GITHUB_TOKEN: ${{ inputs.github_token }} 
+        GITHUB_TOKEN: ${{ inputs.github_token }}
+        INPUT_MAX_TURNS: ${{ inputs.max_turns }}
+        INPUT_ALLOWED_TOOLS: ${{ inputs.allowed_tools }}
+        INPUT_DISALLOWED_TOOLS: ${{ inputs.disallowed_tools }}
+        INPUT_TIMEOUT_MINUTES: ${{ inputs.timeout_minutes }} 

tests/unit/test_sdk_job_store.py

@@ -31,8 +31,10 @@ def test_jobs_submit_and_get(simple_jobs_client):
 
 
 def _praisonai_jobs_available() -> bool:
+    import importlib.util
+
     try:
-        return __import__("importlib").util.find_spec("praisonai.jobs") is not None
+        return importlib.util.find_spec("praisonai.jobs") is not None
     except ModuleNotFoundError:
         return False