use env var

.github/actions/test-ruby/action.yml

@@ -51,13 +51,29 @@ runs:
     - name: Additional Setup
       if: inputs.ADDITIONAL_SETUP != '[]'
       shell: bash
+      env:
+        ADDITIONAL_COMMANDS: ${{ inputs.ADDITIONAL_COMMANDS }}
       run: |
-        additional_setup='${{ inputs.ADDITIONAL_SETUP }}'
-        echo "$additional_setup" | jq -r '.[]' | while read -r command; do
-          echo "Executing additional setup command: $command"
-          eval "$command"
+        echo "$ADDITIONAL_COMMANDS" | jq -r '.[]' | while read -r command; do
+          echo "Executing command: $command"
+          $command
         done
 
+- name: Execute additional commands
+  if: inputs.ADDITIONAL_COMMANDS != '[]'
+  shell: bash
+  env:
+    ADDITIONAL_COMMANDS: ${{ inputs.ADDITIONAL_COMMANDS }}
+  run: |
+    echo "$ADDITIONAL_COMMANDS" | jq -r '.[]' | while read -r command; do
+      echo "Executing command: $command"
+      if [[ $command == bundle* || $command == rake* ]]; then
+        $command
+      else
+        echo "Skipping unauthorized command: $command"
+      fi
+    done
+
     - uses: actions/cache@v4
       with:
         path: vendor/bundle