fix(security): harden sandbox command execution and validate sandbox names #4450

	# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
	# SPDX-License-Identifier: Apache-2.0

	name: commit-lint

	on:
	pull_request:
	types: [opened, synchronize, reopened, edited]

	permissions:
	contents: read

	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	jobs:
	commit-lint:
	runs-on: ubuntu-latest
	timeout-minutes: 5
	steps:
	- name: Checkout
	uses: actions/checkout@v6

	- name: Setup Node.js
	uses: actions/setup-node@v6
	with:
	node-version: "22"
	cache: npm

	- name: Install dependencies
	run: npm install --ignore-scripts

	- name: Lint PR title
	env:
	PR_TITLE: ${{ github.event.pull_request.title }}
	run: printf '%s\n' "$PR_TITLE" \| npx commitlint --verbose

Provide feedback