chore: prevent script injection

Author: olivermeyer

.github/workflows/merge-release.yml

@@ -36,8 +36,9 @@ jobs:
 
       - name: Resolve release branch
         id: branch
+        env:
+          INPUT: ${{ inputs.branch }}
         run: |
-          INPUT="${{ inputs.branch }}"
           if [ -n "$INPUT" ]; then
             BRANCH="$INPUT"
           else

.github/workflows/prepare-release.yml

@@ -43,9 +43,9 @@ jobs:
 
       - name: Validate version
         id: version
+        env:
+          INPUT: ${{ inputs.version }}
         run: |
-          INPUT="${{ inputs.version }}"
-
           # Must be an explicit x.y.z semver
           if ! echo "$INPUT" | grep -qE '^\d+\.\d+\.\d+$'; then
             echo "❌ Invalid version: '$INPUT'. Must be an explicit semver like '1.3.0'."

.github/workflows/publish-release.yml

@@ -35,8 +35,9 @@ jobs:
 
       - name: Resolve release branch
         id: branch
+        env:
+          INPUT: ${{ inputs.branch }}
         run: |
-          INPUT="${{ inputs.branch }}"
           if [ -n "$INPUT" ]; then
             BRANCH="$INPUT"
           else