chore: clean up workflows

.github/workflows/automate_changeset_feedback.yml

@@ -34,7 +34,7 @@ jobs:
           # This will let us diff only the contents of the PR, without fetching more history
           ref: 'refs/pull/${{ github.event.pull_request.number }}/merge'
       - name: fetch base
-        run: git fetch --depth 1 origin ${{ github.base_ref }}
+        run: git fetch --depth 1 origin "$GITHUB_BASE_REF"
 
       - uses: backstage/actions/changeset-feedback@2cd6978b476cbdc39fec48346f8b6ca13199dd6a # v0.7.8
         name: Generate feedback

.github/workflows/ci.yml

@@ -124,17 +124,21 @@ jobs:
         run: yarn backstage-cli repo fix --check --publish
 
       - name: Install jest-junit reporter
+        env:
+          RUNNER_TEMP: ${{ runner.temp }}
+          WORKSPACE: ${{ matrix.workspace }}
         run: |
-          npm install jest-junit@17.0.0 --ignore-scripts --prefix ${{ runner.temp }}/jest-junit
-          mkdir -p ${{ runner.temp }}/test-results/${{ matrix.workspace }}
+          npm install jest-junit@17.0.0 --ignore-scripts --prefix "$RUNNER_TEMP/jest-junit"
+          mkdir -p "$RUNNER_TEMP/test-results/$WORKSPACE"
 
       - name: Test changed packages
         id: tests
         env:
           JEST_JUNIT_OUTPUT_DIR: ${{ runner.temp }}/test-results/${{ matrix.workspace }}
           JEST_JUNIT_CLASSNAME: '{filepath}'
           JEST_JUNIT_UNIQUE_OUTPUT_NAME: 'true'
-        run: yarn test:all --maxWorkers=3 --reporters=default --reporters=${{ runner.temp }}/jest-junit/node_modules/jest-junit
+          RUNNER_TEMP: ${{ runner.temp }}
+        run: yarn test:all --maxWorkers=3 --reporters=default --reporters="$RUNNER_TEMP/jest-junit/node_modules/jest-junit"
 
       - name: Upload coverage to Codecov
         if: ${{ !cancelled() && steps.tests.outcome != 'skipped' }}
@@ -194,9 +198,13 @@ jobs:
       - name: Install root dependencies
         run: yarn install --immutable
       - name: Verify lockfile duplicates
-        run: node scripts/ci/verify-lockfile-duplicates.js workspaces/${{ matrix.workspace }}/yarn.lock
+        env:
+          WORKSPACE: ${{ matrix.workspace }}
+        run: node scripts/ci/verify-lockfile-duplicates.js "workspaces/$WORKSPACE/yarn.lock"
       - name: Verify changesets
-        run: node scripts/ci/verify-changesets.js ${{ matrix.workspace }}
+        env:
+          WORKSPACE: ${{ matrix.workspace }}
+        run: node scripts/ci/verify-changesets.js "$WORKSPACE"
   result:
     if: ${{ always() }}
     name: check all required jobs

.github/workflows/coverage-baseline.yml

@@ -76,17 +76,21 @@ jobs:
         run: yarn install --immutable
 
       - name: Install jest-junit reporter
+        env:
+          RUNNER_TEMP: ${{ runner.temp }}
+          WORKSPACE: ${{ matrix.workspace }}
         run: |
-          npm install jest-junit@17.0.0 --ignore-scripts --prefix ${{ runner.temp }}/jest-junit
-          mkdir -p ${{ runner.temp }}/test-results/${{ matrix.workspace }}
+          npm install jest-junit@17.0.0 --ignore-scripts --prefix "$RUNNER_TEMP/jest-junit"
+          mkdir -p "$RUNNER_TEMP/test-results/$WORKSPACE"
 
       - name: Run tests with coverage
         id: tests
         env:
           JEST_JUNIT_OUTPUT_DIR: ${{ runner.temp }}/test-results/${{ matrix.workspace }}
           JEST_JUNIT_CLASSNAME: '{filepath}'
           JEST_JUNIT_UNIQUE_OUTPUT_NAME: 'true'
-        run: yarn test:all --maxWorkers=3 --reporters=default --reporters=${{ runner.temp }}/jest-junit/node_modules/jest-junit
+          RUNNER_TEMP: ${{ runner.temp }}
+        run: yarn test:all --maxWorkers=3 --reporters=default --reporters="$RUNNER_TEMP/jest-junit/node_modules/jest-junit"
 
       - name: Upload coverage to Codecov
         if: ${{ !cancelled() && steps.tests.outcome != 'skipped' }}

.github/workflows/detect-new-workspace.yml

@@ -75,7 +75,9 @@ jobs:
 
       - name: Apply changes for workspace
         id: apply
-        run: node scripts/ci/detect-new-workspaces.js --apply "${{ matrix.workspace }}"
+        env:
+          WORKSPACE: ${{ matrix.workspace }}
+        run: node scripts/ci/detect-new-workspaces.js --apply "$WORKSPACE"
 
       - name: Create Pull Request
         uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c # v6.1.0

.github/workflows/release.yml

@@ -23,7 +23,9 @@ jobs:
           registry-url: https://registry.npmjs.org/ # Needed for auth
 
       - name: Fetch previous commit for check
-        run: git fetch origin '${{ github.event.before }}'
+        run: git fetch origin "$COMMIT_SHA_BEFORE"
+        env:
+          COMMIT_SHA_BEFORE: ${{ github.event.before }}
 
       - name: Find changed workspaces
         id: find-changed-workspaces

.github/workflows/release_workspace.yml

@@ -74,10 +74,14 @@ jobs:
         run: yarn install --immutable
 
       - name: Fetch previous commit for release check
-        run: git fetch origin '${{ github.event.before }}'
+        env:
+          COMMIT_SHA_BEFORE: ${{ github.event.before }}
+        run: git fetch origin "$COMMIT_SHA_BEFORE"
 
       - name: Fetch the commit that triggered the workflow (used by backstage/changesets-action)
-        run: git fetch origin ${{ github.sha }}
+        env:
+          COMMIT_SHA: ${{ github.sha }}
+        run: git fetch origin "$COMMIT_SHA"
         continue-on-error: true
 
       - name: Check if release

.github/workflows/validate-codeowners.yml

@@ -30,8 +30,10 @@ jobs:
 
       - name: Get CODEOWNERS from PR
         if: github.event_name == 'pull_request_target'
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number }}
         run: |
-          git fetch origin pull/${{ github.event.pull_request.number }}/head:pr-head
+          git fetch origin "pull/$PR_NUMBER/head:pr-head"
           git checkout pr-head -- .github/CODEOWNERS
 
       - name: Generate GitHub App Token
@@ -57,15 +59,17 @@ jobs:
       - name: Comment on PR if validation failed
         if: steps.validate.outcome == 'failure' && github.event_name == 'pull_request_target' && steps.validate.outputs.missing_users != ''
         run: |
-          gh pr comment ${{ github.event.pull_request.number }} --body "## ⚠️ CODEOWNERS Validation Failed
+          gh pr comment "$PR_NUMBER" --body "## ⚠️ CODEOWNERS Validation Failed
 
           The following users are listed in CODEOWNERS but are not members of the [\`rhdh-plugins-codeowners\`](https://github.com/orgs/redhat-developer/teams/rhdh-plugins-codeowners) team:
 
-          \`${{ steps.validate.outputs.missing_users }}\`
+          \`$MISSING_USERS\`
 
           An org admin needs to [add the missing members to the team](https://github.com/orgs/redhat-developer/teams/rhdh-plugins-codeowners/members) before this PR can be merged."
         env:
           GH_TOKEN: ${{ steps.generate-token.outputs.token }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          MISSING_USERS: ${{ steps.validate.outputs.missing_users }}
 
       - name: Fail workflow if validation failed
         if: steps.validate.outcome == 'failure'

.github/workflows/version-bump.yml

@@ -60,7 +60,7 @@ jobs:
       - name: find location of global yarn cache
         id: yarn-cache
         if: steps.cache-modules.outputs.cache-hit != 'true'
-        run: echo "::set-output name=dir::$(yarn config get cacheFolder)"
+        run: echo "dir=$(yarn config get cacheFolder)" >> "$GITHUB_OUTPUT"
       - name: cache global yarn cache
         uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         if: steps.cache-modules.outputs.cache-hit != 'true'
@@ -78,24 +78,32 @@ jobs:
 
       - name: 'Set release name'
         id: set_release_name
-        run: node scripts/ci/set-release-name.js ${{ matrix.workspace }} ${{ inputs.release_line || 'main' }}
+        env:
+          WORKSPACE: ${{ matrix.workspace }}
+          RELEASE_LINE: ${{ inputs.release_line || 'main' }}
+        run: node scripts/ci/set-release-name.js "$WORKSPACE" "$RELEASE_LINE"
       - name: 'Configure git'
         run: |
           git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
           git config --global user.name "github-actions[bot]"
       - name: 'Create workspace branch'
+        env:
+          WORKSPACE: ${{ matrix.workspace }}
+          RELEASE_VERSION: ${{ steps.set_release_name.outputs.release_version }}
         run: |
           git config --global --add safe.directory "$GITHUB_WORKSPACE"
-          BRANCH=$(git branch --list ${{ matrix.workspace }}/v${{ steps.set_release_name.outputs.release_version }})
+          BRANCH_NAME="${WORKSPACE}/v${RELEASE_VERSION}"
+          BRANCH=$(git branch --list "$BRANCH_NAME")
           if [ ! -z "$BRANCH" ]; then
-              git branch -D ${{ matrix.workspace }}/v${{ steps.set_release_name.outputs.release_version }}
+              git branch -D "$BRANCH_NAME"
           fi
-          git checkout -b ${{ matrix.workspace }}/v${{ steps.set_release_name.outputs.release_version }}
+          git checkout -b "$BRANCH_NAME"
       - name: Run backstage-cli versions:bump --release ${{ inputs.release_line || 'main' }} command
         working-directory: ./workspaces/${{ matrix.workspace }}
-        run: yarn backstage-cli versions:bump --release ${{ inputs.release_line || 'main' }}
         env:
           YARN_ENABLE_IMMUTABLE_INSTALLS: false
+          RELEASE_LINE: ${{ inputs.release_line || 'main' }}
+        run: yarn backstage-cli versions:bump --release "$RELEASE_LINE"
       - name: Run dedupe
         working-directory: ./workspaces/${{ matrix.workspace }}
         run: yarn dedupe
@@ -113,14 +121,20 @@ jobs:
       - name: 'Add changeset'
         if: ${{ steps.check_for_changes.outputs.HAS_CHANGES == 1 }}
         working-directory: ./workspaces/${{ matrix.workspace }}
-        run: node ../../scripts/ci/generate-version-bump-changeset.js ${{ steps.set_release_name.outputs.release_version }} ${{ inputs.version-bump-type || 'minor' }}
+        env:
+          RELEASE_VERSION: ${{ steps.set_release_name.outputs.release_version }}
+          BUMP_TYPE: ${{ inputs.version-bump-type || 'minor' }}
+        run: node ../../scripts/ci/generate-version-bump-changeset.js "$RELEASE_VERSION" "$BUMP_TYPE"
       - name: 'Commit changes'
         if: ${{ steps.check_for_changes.outputs.HAS_CHANGES == 1 }}
+        env:
+          WORKSPACE: ${{ matrix.workspace }}
+          RELEASE_VERSION: ${{ steps.set_release_name.outputs.release_version }}
         run: |
           git status
           git add -A -- :!.npmrc
-          git commit -m "v${{ steps.set_release_name.outputs.release_version }} version bump"
-          git push origin ${{ matrix.workspace }}/v${{ steps.set_release_name.outputs.release_version }}
+          git commit -m "v${RELEASE_VERSION} version bump"
+          git push origin "${WORKSPACE}/v${RELEASE_VERSION}"
       - name: 'Create Pull Request'
         if: ${{ steps.check_for_changes.outputs.HAS_CHANGES == 1 }}
         uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7