Fix: Env-mediate expressions in run blocks

[ModeSevenIndustrialSolutions]

Why

zizmor's template-injection audit reports GitHub expressions that expand directly inside run: blocks. The expansion happens before the shell sees the script, so a value carrying shell syntax becomes code rather than data.

Each expression now reaches the shell through the step environment instead. These findings predate the change to the organisation zizmor floor (low → informational); they were simply below the old threshold.

Please review the diff carefully

The transformation is not purely mechanical. Swapping ${{ expr }} for ${VAR} changes the quoting rules, because the original was substituted by GitHub before the shell ran and the replacement is an ordinary shell variable. Three contexts silently stop working:

Context	Before	After
var='${{ expr }}'	substituted by GitHub	literal string
echo 'text ${{ expr }}'	substituted by GitHub	literal string
cat <<'EOF' … ${{ expr }}	substituted by GitHub	literal string

shellcheck catches the first two. It does not catch the heredoc case. That one was found in url-validity-action, where 27 references would have rendered the job summary as variable names instead of results.

What was verified before raising this

• zizmor --persona auditor --min-severity informational — no findings
• actionlint (including shellcheck) — clean
• yamllint — clean
• A purpose-built audit for generated variables landing in single quotes or quoted heredocs — clean. It was validated by confirming it detects 33 such problems in the unrepaired output for url-validity-action.
• Diff restricted to workflow and action definitions; no dependabot.yml or version-pin comment changes rode along

Note on the generated names

Where zizmor's names push a line past the length limit, the line carries a yamllint disable-line directive. Shortening them was rejected: the short forms are unique only within one env: block, so a global rewrite merges distinct variables and leaves dangling references — verified by observing exactly that failure.

[Copilot]

Pull request overview

This PR mitigates zizmor template-injection findings by removing direct ${{ ... }} GitHub expression expansions from run: blocks and instead passing those values into the shell via step env: variables, so the shell only sees data (shell variables) rather than pre-expanded script content.

Changes:

• Added step-level env: entries that map step outputs to environment variables (with targeted yamllint line-length suppressions where needed).
• Updated bash validation logic to reference the new environment variables instead of ${{ steps.*.outputs.* }} inside run: scripts.
• Applied the same pattern to cache-key validation and artifact-path verification steps.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

[tykeal]

🤖 Dependamerge
Approved this pull request ✅