Variables interpolated directly into sh string commands (dmg_staging, dmg_path, catalyst_app_path) could break or be exploited if paths contain shell-special characters.

Changes

• hdiutil invocation — switched from shell string interpolation to the array form of sh, bypassing the shell entirely:

  # before
  sh("hdiutil create -volname 'BlueWallet' -srcfolder '#{dmg_staging}' -ov -format UDZO '#{dmg_path}'")
  
  # after
  sh("hdiutil", "create", "-volname", "BlueWallet", "-srcfolder", dmg_staging, "-ov", "-format", "UDZO", dmg_path)

• GITHUB_OUTPUT writes — replaced sh("echo '...' >> $GITHUB_OUTPUT") with a direct Ruby File.open append, removing the shell layer entirely:

  # before
  sh("echo 'catalyst_app_path=#{catalyst_app_path}' >> $GITHUB_OUTPUT")
  sh("echo 'catalyst_dmg_path=#{dmg_path}' >> $GITHUB_OUTPUT")
  
  # after
  File.open(ENV['GITHUB_OUTPUT'], 'a') do |f|
    f.puts "catalyst_app_path=#{catalyst_app_path}"
    f.puts "catalyst_dmg_path=#{dmg_path}"
  end

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.