Fix: Env-mediate expressions in run blocks

[ModeSevenIndustrialSolutions]

Fix: Env-mediate expressions in run blocks

zizmor --persona auditor reported 14 template-injection findings across the four reusable workflows. This clears all of them; the repository now reports zero findings.

The issue

GitHub expressions were expanded directly inside run: blocks. Expansion happens before the shell sees the script, so the expanded value becomes part of the script text rather than data — a crafted value can inject commands.

This also contradicts a convention docs/BRIEF.md already states:

Never interpolate ${{ }} into run: blocks; env-mediate dynamic values (zizmor template-injection).

So this brings the code into line with the documented design, and with go-workflows / node-workflows, both of which already report zero findings.

Two patterns fixed

1. Release jobs assigning TAG (6 sites — ensure-release, check-promoted, set-promoted-url). These steps already declared an env: block for GH_TOKEN, so the tag simply joins it:

 env:
   GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  TAG_NAME: ${{ needs.tag-validate.outputs.tag }}
 run: |
-  TAG="${{ needs.tag-validate.outputs.tag }}"
+  TAG="${TAG_NAME}"

2. SBOM summary steps (4 sites × 2 expressions = 8 findings):

+ env:
+   SBOM_COMPONENT_COUNT: ${{ steps.sbom.outputs.component_count }}
+   SBOM_DEPENDENCY_MANAGER: ${{ steps.sbom.outputs.dependency_manager }}
  run: |
-   echo "SBOM count: ${{ steps.sbom.outputs.component_count }}"
-   echo "Tool used: ${{ steps.sbom.outputs.dependency_manager }}"
+   echo "SBOM count: ${SBOM_COMPONENT_COUNT}"
+   echo "Tool used: ${SBOM_DEPENDENCY_MANAGER}"

The multiarch variants already had an env: block for TARGET_ARCH; the new entries join it, leaving the existing $TARGET_ARCH reference untouched.

No behavioural change

The same values reach the same commands. Only the transport changes — expression → environment variable → shell variable, instead of expression → literal script text.

Validation

• zizmor --persona auditor .github/workflows/ — "No findings to report." (was 14)
• Independent check: zero residual ${{ }} expressions inside any run: block across all 9 workflow files
• pre-commit run --files … — all hooks pass (yamllint, actionlint, workflow schema validation, reuse lint, codespell)

Replacements were applied by an assertion-checked script requiring an exact occurrence count per pattern, so a silent partial match would have failed rather than half-applied.

Note on merge order

This branches from main and touches the same four files as #37 (build egress hatch), though different regions — #37 changes the inputs: block and the python-build job, this changes the sbom/release jobs. They should merge cleanly in either order; if the second one conflicts, it'll be trivial to resolve.

[Copilot]

Pull request overview

This PR mitigates GitHub Actions template-injection risk by ensuring GitHub expressions are not interpolated directly into run: script bodies, instead passing dynamic values via env: and then referencing them as shell variables.

Changes:

• Env-mediate SBOM output values (component_count, dependency_manager) before emitting to $GITHUB_STEP_SUMMARY.
• Env-mediate validated tag values (tag / tag_name) before using them in release-related gh commands.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File	Description
.github/workflows/build-test.yaml	Moves SBOM output expressions out of the run: block into env: for the SBOM summary step.
.github/workflows/build-test-release.yaml	Env-mediates tag values in release steps and SBOM outputs in the SBOM summary step.
.github/workflows/build-test-release-multiarch.yaml	Env-mediates tag values in release steps and SBOM outputs in the multiarch SBOM summary step.
.github/workflows/build-test-multiarch.yaml	Moves SBOM output expressions out of the run: block into env: for the multiarch SBOM summary step.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.