fix(ci): harden release-pr workflow against expression injection

.github/workflows/build-binaries.yml

@@ -29,9 +29,11 @@ jobs:
       - name: Resolve tag
         id: tag
         shell: bash
+        env:
+          INPUT_TAG: ${{ inputs.tag }}
         run: |
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            TAG="${{ inputs.tag }}"
+          if [ "${GITHUB_EVENT_NAME}" = "workflow_dispatch" ]; then
+            TAG="$INPUT_TAG"
           else
             TAG="${GITHUB_REF_NAME}"
           fi
@@ -46,8 +48,9 @@ jobs:
 
       - name: Package
         shell: bash
+        env:
+          VERSION: ${{ steps.tag.outputs.version }}
         run: |
-          VERSION="${{ steps.tag.outputs.version }}"
           NAME="openab-${VERSION}-${{ matrix.os }}-${{ matrix.arch }}"
           mkdir -p dist
           cp target/${{ matrix.target }}/release/openab${{ matrix.ext }} dist/
@@ -63,14 +66,15 @@ jobs:
         if: github.event_name == 'push'
         env:
           GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ steps.tag.outputs.version }}
+          TAG: ${{ steps.tag.outputs.tag }}
         shell: bash
         run: |
-          VERSION="${{ steps.tag.outputs.version }}"
           NAME="openab-${VERSION}-${{ matrix.os }}-${{ matrix.arch }}.${{ matrix.archive }}"
           # Helm release uses openab-X.Y.Z tag, binary release uses vX.Y.Z tag
           # Try both — one will exist
           gh release upload "openab-${VERSION}" "$NAME" --clobber 2>/dev/null \
-            || gh release upload "${{ steps.tag.outputs.tag }}" "$NAME" --clobber \
+            || gh release upload "$TAG" "$NAME" --clobber \
             || true
 
       - name: Upload artifact

.github/workflows/build-gateway.yml

@@ -35,9 +35,11 @@ jobs:
 
       - name: Resolve tag
         id: tag
+        env:
+          INPUT_TAG: ${{ inputs.tag }}
         run: |
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            TAG="${{ inputs.tag }}"
+          if [ "${GITHUB_EVENT_NAME}" = "workflow_dispatch" ]; then
+            TAG="$INPUT_TAG"
           else
             TAG="${GITHUB_REF_NAME}"
           fi
@@ -66,10 +68,11 @@ jobs:
 
       - name: Export digest
         if: inputs.dry_run != true
+        env:
+          DIGEST: ${{ steps.build.outputs.digest }}
         run: |
           mkdir -p /tmp/digests
-          digest="${{ steps.build.outputs.digest }}"
-          touch "/tmp/digests/${digest#sha256:}"
+          touch "/tmp/digests/${DIGEST#sha256:}"
 
       - name: Upload digest
         if: inputs.dry_run != true
@@ -89,9 +92,11 @@ jobs:
     steps:
       - name: Resolve tag
         id: tag
+        env:
+          INPUT_TAG: ${{ inputs.tag }}
         run: |
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            TAG="${{ inputs.tag }}"
+          if [ "${GITHUB_EVENT_NAME}" = "workflow_dispatch" ]; then
+            TAG="$INPUT_TAG"
           else
             TAG="${GITHUB_REF_NAME}"
           fi
@@ -111,13 +116,15 @@ jobs:
           merge-multiple: true
 
       - name: Create multi-arch manifest
+        env:
+          VERSION: ${{ steps.tag.outputs.version }}
         run: |
           cd /tmp/digests
           docker buildx imagetools create \
-            -t ${{ env.IMAGE_NAME }}:${{ steps.tag.outputs.version }} \
-            -t ${{ env.IMAGE_NAME }}:v${{ steps.tag.outputs.version }} \
-            -t ${{ env.IMAGE_NAME }}:latest \
-            $(printf '${{ env.IMAGE_NAME }}@sha256:%s ' *)
+            -t "${IMAGE_NAME}:${VERSION}" \
+            -t "${IMAGE_NAME}:v${VERSION}" \
+            -t "${IMAGE_NAME}:latest" \
+            $(printf "${IMAGE_NAME}@sha256:%s " *)
 
   release:
     needs: [build, merge]
@@ -130,9 +137,11 @@ jobs:
 
       - name: Resolve version
         id: tag
+        env:
+          INPUT_TAG: ${{ inputs.tag }}
         run: |
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            TAG="${{ inputs.tag }}"
+          if [ "${GITHUB_EVENT_NAME}" = "workflow_dispatch" ]; then
+            TAG="$INPUT_TAG"
           else
             TAG="${GITHUB_REF_NAME}"
           fi
@@ -142,9 +151,9 @@ jobs:
       - name: Create GitHub Release
         env:
           GH_TOKEN: ${{ github.token }}
+          TAG: ${{ steps.tag.outputs.tag }}
+          VERSION: ${{ steps.tag.outputs.version }}
         run: |
-          TAG="${{ steps.tag.outputs.tag }}"
-          VERSION="${{ steps.tag.outputs.version }}"
           cat > /tmp/release-notes.md << EOF
           ## OpenAB Gateway v${VERSION}
 

.github/workflows/build-images.yml

@@ -170,10 +170,11 @@ jobs:
           outputs: type=image,name=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }},push-by-digest=true,name-canonical=true,push=true
 
       - name: Export digest
+        env:
+          DIGEST: ${{ steps.build.outputs.digest }}
         run: |
           mkdir -p /tmp/digests
-          digest="${{ steps.build.outputs.digest }}"
-          touch "/tmp/digests/${digest#sha256:}"
+          touch "/tmp/digests/${DIGEST#sha256:}"
 
       - name: Upload digest
         uses: actions/upload-artifact@v4
@@ -228,10 +229,10 @@ jobs:
       - name: Create manifest list
         env:
           BRANCH_INPUT: ${{ inputs.branch }}
+          TAG: ${{ needs.matrix.outputs.tag }}
+          VARIANT: ${{ matrix.variant }}
         run: |
-          IMAGE="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}"
-          TAG="${{ needs.matrix.outputs.tag }}"
-          VARIANT="${{ matrix.variant }}"
+          IMAGE="${REGISTRY}/${IMAGE_NAME}"
 
           # Tag: <version>-<agent>
           docker buildx imagetools create \
@@ -254,10 +255,10 @@ jobs:
       - name: Summary
         env:
           BRANCH_INPUT: ${{ inputs.branch }}
+          TAG: ${{ needs.matrix.outputs.tag }}
+          VARIANT: ${{ matrix.variant }}
         run: |
-          IMAGE="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}"
-          TAG="${{ needs.matrix.outputs.tag }}"
-          VARIANT="${{ matrix.variant }}"
+          IMAGE="${REGISTRY}/${IMAGE_NAME}"
           echo "### 📦 \`${IMAGE}:${TAG}-${VARIANT}\`" >> "$GITHUB_STEP_SUMMARY"
           if [ "${VARIANT}" = "kiro" ]; then
             echo "### 📦 \`${IMAGE}:${TAG}\` (default)" >> "$GITHUB_STEP_SUMMARY"

.github/workflows/build-oabctl.yml

@@ -38,12 +38,14 @@ jobs:
 
       - name: Resolve version and target matrix
         id: version
+        env:
+          INPUT_TARGET: ${{ inputs.target }}
         run: |
           VERSION=$(grep '^version:' charts/openab/Chart.yaml | awk '{print $2}')
           echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
 
-          if [ -n "${{ inputs.target }}" ]; then
-            TARGETS="[\"${{ inputs.target }}\"]"
+          if [ -n "$INPUT_TARGET" ]; then
+            TARGETS="[\"$INPUT_TARGET\"]"
           else
             TARGETS='["linux-x86_64","linux-aarch64","macos-arm64"]'
           fi
@@ -91,10 +93,11 @@ jobs:
         if: github.event_name == 'push'
         env:
           GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ needs.resolve.outputs.version }}
         working-directory: operator
         run: |
-          TAG="openab-${{ needs.resolve.outputs.version }}"
-          NAME="oabctl-${{ needs.resolve.outputs.version }}-${{ matrix.target }}.tar.gz"
+          TAG="openab-${VERSION}"
+          NAME="oabctl-${VERSION}-${{ matrix.target }}.tar.gz"
           # Release is created by chart-releaser (release.yml) on the same
           # push — wait for it to exist before uploading.
           for i in $(seq 1 20); do

.github/workflows/build-operator.yml

@@ -45,9 +45,11 @@ jobs:
     steps:
       - name: Resolve and validate tag
         id: resolve
+        env:
+          INPUT_TAG: ${{ inputs.tag }}
         run: |
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            TAG="${{ inputs.tag }}"
+          if [ "${GITHUB_EVENT_NAME}" = "workflow_dispatch" ]; then
+            TAG="$INPUT_TAG"
           else
             TAG="${GITHUB_REF_NAME}"
           fi
@@ -159,10 +161,11 @@ jobs:
 
       - name: Export digest
         if: inputs.dry_run != true
+        env:
+          DIGEST: ${{ steps.build.outputs.digest }}
         run: |
           mkdir -p /tmp/digests
-          digest="${{ steps.build.outputs.digest }}"
-          touch "/tmp/digests/${digest#sha256:}"
+          touch "/tmp/digests/${DIGEST#sha256:}"
 
       - name: Upload digest
         if: inputs.dry_run != true
@@ -214,12 +217,12 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Create manifest list
+        env:
+          VERSION: ${{ needs.resolve-tag.outputs.chart_version }}
+          AGENT: ${{ matrix.agent }}
         run: |
-          IMAGE="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}"
-          VERSION="${{ needs.resolve-tag.outputs.chart_version }}"
-          AGENT="${{ matrix.agent }}"
-          SHA="${{ github.sha }}"
-          SHORT_SHA="${SHA:0:7}"
+          IMAGE="${REGISTRY}/${IMAGE_NAME}"
+          SHORT_SHA="${GITHUB_SHA:0:7}"
 
           DIGESTS=$(printf "${IMAGE}@sha256:%s " $(ls /tmp/digests/))
 
@@ -232,10 +235,11 @@ jobs:
             ${DIGESTS}
 
       - name: Summary
+        env:
+          VERSION: ${{ needs.resolve-tag.outputs.chart_version }}
+          AGENT: ${{ matrix.agent }}
         run: |
-          IMAGE="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}"
-          VERSION="${{ needs.resolve-tag.outputs.chart_version }}"
-          AGENT="${{ matrix.agent }}"
+          IMAGE="${REGISTRY}/${IMAGE_NAME}"
           echo "### 📦 \`${IMAGE}:${VERSION}-${AGENT}\`" >> "$GITHUB_STEP_SUMMARY"
           echo "### 📦 \`${IMAGE}:beta-${AGENT}\`" >> "$GITHUB_STEP_SUMMARY"
 
@@ -266,8 +270,9 @@ jobs:
 
       - name: Find pre-release image
         id: find-prerelease
+        env:
+          CHART_VERSION: ${{ needs.resolve-tag.outputs.chart_version }}
         run: |
-          CHART_VERSION="${{ needs.resolve-tag.outputs.chart_version }}"
           PRERELEASE_TAG=$(git tag -l "v${CHART_VERSION}-*" --sort=-v:refname | head -1)
           if [ -z "$PRERELEASE_TAG" ]; then
             echo "::error::No pre-release tag found for v${CHART_VERSION}-*. Run a pre-release build first."
@@ -278,10 +283,11 @@ jobs:
           echo "prerelease_version=${PRERELEASE_VERSION}" >> "$GITHUB_OUTPUT"
 
       - name: Verify and promote to stable tags
+        env:
+          PRERELEASE_VERSION: ${{ steps.find-prerelease.outputs.prerelease_version }}
+          CHART_VERSION: ${{ needs.resolve-tag.outputs.chart_version }}
         run: |
-          IMAGE="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}"
-          PRERELEASE_VERSION="${{ steps.find-prerelease.outputs.prerelease_version }}"
-          CHART_VERSION="${{ needs.resolve-tag.outputs.chart_version }}"
+          IMAGE="${REGISTRY}/${IMAGE_NAME}"
           MAJOR_MINOR="${CHART_VERSION%.*}"
           AGENT="${{ matrix.agent }}"
 
@@ -298,10 +304,11 @@ jobs:
             "${IMAGE}:${PRERELEASE_VERSION}-${AGENT}"
 
       - name: Summary
+        env:
+          CHART_VERSION: ${{ needs.resolve-tag.outputs.chart_version }}
+          AGENT: ${{ matrix.agent }}
         run: |
-          IMAGE="${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}"
-          CHART_VERSION="${{ needs.resolve-tag.outputs.chart_version }}"
-          AGENT="${{ matrix.agent }}"
+          IMAGE="${REGISTRY}/${IMAGE_NAME}"
           echo "### 📦 Promoted \`${IMAGE}:${CHART_VERSION}-${AGENT}\`" >> "$GITHUB_STEP_SUMMARY"
           echo "### 📦 Promoted \`${IMAGE}:stable-${AGENT}\`" >> "$GITHUB_STEP_SUMMARY"
 
@@ -330,7 +337,8 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push chart to OCI
+        env:
+          CHART_VERSION: ${{ needs.resolve-tag.outputs.chart_version }}
         run: |
-          CHART_VERSION="${{ needs.resolve-tag.outputs.chart_version }}"
           helm package charts/openab
           helm push openab-${CHART_VERSION}.tgz oci://ghcr.io/${{ github.repository_owner }}/charts