Fix code injection vulnerability in workflow_run.head_branch

[Copilot]

CodeQL identified unprivileged code injection in github.event.workflow_run.head_branch allowing arbitrary code execution via malicious branch names.

Changes

• Use environment variable instead of direct GitHub Actions expression interpolation in bash script
• Prevents shell expansion of untrusted input while preserving existing validation logic

Technical Details

Before (vulnerable):

- name: Extract version from tag
  id: extract_version
  run: |
    TAG_NAME="${{ github.event.workflow_run.head_branch }}"

An attacker could create a branch named $(malicious command) which would execute during interpolation.

After (secure):

- name: Extract version from tag
  id: extract_version
  env:
    HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
  run: |
    TAG_NAME="$HEAD_BRANCH"

Environment variables are not subject to shell expansion, treating malicious input as literal strings.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.