Fix shell injection in GitHub Actions workflows

.github/workflows/docker-build.yml

@@ -72,25 +72,31 @@ jobs:
 
       - name: Compute cargo version
         id: version
+        env:
+          INPUT_CARGO_VERSION: ${{ inputs.cargo-version }}
         run: |
           set -eu
-          if [[ -n "${{ inputs.cargo-version }}" ]]; then
-            echo "cargo_version=${{ inputs.cargo-version }}" >> "$GITHUB_OUTPUT"
+          if [[ -n "$INPUT_CARGO_VERSION" ]]; then
+            echo "cargo_version=$INPUT_CARGO_VERSION" >> "$GITHUB_OUTPUT"
           else
             echo "cargo_version=$(uv run python tasks/scripts/release.py get-version --cargo)" >> "$GITHUB_OUTPUT"
           fi
 
       - name: Log in to GHCR
-        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_ACTOR: ${{ github.actor }}
+        run: echo "$GH_TOKEN" | docker login ghcr.io -u "$GH_ACTOR" --password-stdin
 
       - name: Set up Docker Buildx
         uses: ./.github/actions/setup-buildx
 
-      - name: Build ${{ inputs.component }} image
+      - name: Build image
         env:
           DOCKER_BUILDER: openshell
           OPENSHELL_CARGO_VERSION: ${{ steps.version.outputs.cargo_version }}
           # Enable dev-settings feature for test settings (dummy_bool, dummy_int)
           # used by e2e tests.
           EXTRA_CARGO_FEATURES: openshell-core/dev-settings
-        run: mise run --no-prepare docker:build:${{ inputs.component }}
+          BUILD_COMPONENT: ${{ inputs.component }}
+        run: mise run --no-prepare "docker:build:$BUILD_COMPONENT"

.github/workflows/e2e-test.yml

@@ -42,10 +42,15 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Log in to GHCR
-        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_ACTOR: ${{ github.actor }}
+        run: echo "$GH_TOKEN" | docker login ghcr.io -u "$GH_ACTOR" --password-stdin
 
       - name: Pull cluster image
-        run: docker pull ghcr.io/nvidia/openshell/cluster:${{ inputs.image-tag }}
+        env:
+          IMAGE_TAG: ${{ inputs.image-tag }}
+        run: docker pull "ghcr.io/nvidia/openshell/cluster:$IMAGE_TAG"
 
       - name: Install Python dependencies and generate protobuf stubs
         run: uv sync --frozen && mise run --no-prepare python:proto

.github/workflows/release-canary.yml

@@ -50,14 +50,16 @@ jobs:
           curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | sh
 
       - name: Verify CLI installation
+        env:
+          HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
         run: |
           set -euo pipefail
           command -v openshell
           ACTUAL="$(openshell --version)"
           echo "Installed: $ACTUAL"
           # This job only runs after Release Tag, so the triggering tag
           # should match the latest release the default installer resolves to.
-          TAG="${{ github.event.workflow_run.head_branch }}"
+          TAG="$HEAD_BRANCH"
           if [[ "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
             EXPECTED="${TAG#v}"
             if [[ "$ACTUAL" != *"$EXPECTED"* ]]; then
@@ -108,39 +110,46 @@ jobs:
 
       - name: Determine release tag
         id: release
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          INPUT_TAG: ${{ inputs.tag }}
+          WORKFLOW_NAME: ${{ github.event.workflow_run.name }}
+          HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
         run: |
           set -euo pipefail
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            echo "tag=${{ inputs.tag }}" >> "$GITHUB_OUTPUT"
+          if [ "$EVENT_NAME" = "workflow_dispatch" ]; then
+            echo "tag=$INPUT_TAG" >> "$GITHUB_OUTPUT"
           else
-            WORKFLOW_NAME="${{ github.event.workflow_run.name }}"
             if [ "$WORKFLOW_NAME" = "Release Dev" ]; then
               echo "tag=dev" >> "$GITHUB_OUTPUT"
             elif [ "$WORKFLOW_NAME" = "Release Tag" ]; then
-              TAG="${{ github.event.workflow_run.head_branch }}"
-              if [ -z "$TAG" ]; then
+              if [ -z "$HEAD_BRANCH" ]; then
                 echo "::error::Could not determine release tag from workflow_run"
                 exit 1
               fi
-              echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
+              echo "tag=${HEAD_BRANCH}" >> "$GITHUB_OUTPUT"
             else
               echo "::error::Unexpected triggering workflow: ${WORKFLOW_NAME}"
               exit 1
             fi
           fi
 
       - name: Install CLI from published install script
+        env:
+          RELEASE_TAG: ${{ steps.release.outputs.tag }}
         run: |
           set -euo pipefail
-          curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION=${{ steps.release.outputs.tag }} OPENSHELL_INSTALL_DIR=/usr/local/bin sh
+          curl -LsSf https://raw.githubusercontent.com/NVIDIA/OpenShell/main/install.sh | OPENSHELL_VERSION="$RELEASE_TAG" OPENSHELL_INSTALL_DIR=/usr/local/bin sh
 
       - name: Verify CLI installation
+        env:
+          RELEASE_TAG: ${{ steps.release.outputs.tag }}
         run: |
           set -euo pipefail
           command -v openshell
           ACTUAL="$(openshell --version)"
           echo "Installed: $ACTUAL"
-          TAG="${{ steps.release.outputs.tag }}"
+          TAG="$RELEASE_TAG"
           # For tagged releases (v1.2.3), verify the semver appears in the version string
           if [[ "$TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
             EXPECTED="${TAG#v}"