diff --git a/.changeset/fix-ci-command-injection.md b/.changeset/fix-ci-command-injection.md
new file mode 100644
index 0000000000..a845151cc8
--- /dev/null
+++ b/.changeset/fix-ci-command-injection.md
@@ -0,0 +1,2 @@
+---
+---
diff --git a/.github/actions/prepare-workbench-path/action.yml b/.github/actions/prepare-workbench-path/action.yml
index 61aa6392ff..d3092be806 100644
--- a/.github/actions/prepare-workbench-path/action.yml
+++ b/.github/actions/prepare-workbench-path/action.yml
@@ -16,18 +16,24 @@ runs:
   steps:
     - id: prepare
       shell: bash
+      env:
+        APP_NAME: ${{ inputs.app-name }}
       run: |
-        if [[ "${{ inputs.app-name }}" == "nextjs-turbopack" || "${{ inputs.app-name }}" == "nextjs-webpack" ]]; then
+        if [[ ! "$APP_NAME" =~ ^[a-zA-Z0-9][a-zA-Z0-9_-]*$ ]]; then
+          echo "Invalid app-name: $APP_NAME" >&2
+          exit 1
+        fi
+        if [[ "$APP_NAME" == "nextjs-turbopack" || "$APP_NAME" == "nextjs-webpack" ]]; then
           STAGE_LOG="$(mktemp)"
-          node scripts/stage-workbench-with-tarballs.mjs "workbench/${{ inputs.app-name }}" | tee "$STAGE_LOG"
+          node scripts/stage-workbench-with-tarballs.mjs "workbench/$APP_NAME" | tee "$STAGE_LOG"
           WORKBENCH_APP_PATH="$(sed -n 's/^Staged workbench: //p' "$STAGE_LOG" | tail -n 1)"
           if [ -z "$WORKBENCH_APP_PATH" ]; then
             echo "Failed to parse staged workbench path from stage-workbench-with-tarballs output"
             exit 1
           fi
         else
-          ./scripts/resolve-symlinks.sh "workbench/${{ inputs.app-name }}"
-          WORKBENCH_APP_PATH="$GITHUB_WORKSPACE/workbench/${{ inputs.app-name }}"
+          ./scripts/resolve-symlinks.sh "workbench/$APP_NAME"
+          WORKBENCH_APP_PATH="$GITHUB_WORKSPACE/workbench/$APP_NAME"
         fi
 
         echo "workbench_app_path=$WORKBENCH_APP_PATH" >> "$GITHUB_OUTPUT"
diff --git a/.github/workflows/benchmark-community-world.yml b/.github/workflows/benchmark-community-world.yml
index 8dbd003dc0..59ea72b424 100644
--- a/.github/workflows/benchmark-community-world.yml
+++ b/.github/workflows/benchmark-community-world.yml
@@ -91,37 +91,70 @@ jobs:
         with:
           build-packages: 'true'
 
+      - name: Validate inputs
+        env:
+          APP_NAME: ${{ inputs.app-name }}
+          WORLD_ID: ${{ inputs.world-id }}
+          WORLD_PACKAGE: ${{ inputs.world-package }}
+        run: |
+          if [[ ! "$APP_NAME" =~ ^[a-zA-Z0-9][a-zA-Z0-9_-]*$ ]]; then
+            echo "Invalid app-name: $APP_NAME" >&2
+            exit 1
+          fi
+          if [[ ! "$WORLD_ID" =~ ^[a-zA-Z0-9][a-zA-Z0-9_-]*$ ]]; then
+            echo "Invalid world-id: $WORLD_ID" >&2
+            exit 1
+          fi
+          if [[ ! "$WORLD_PACKAGE" =~ ^(@[a-zA-Z0-9][a-zA-Z0-9_.-]*/)?[a-zA-Z0-9][a-zA-Z0-9_.-]*(@[a-zA-Z0-9][a-zA-Z0-9_.+-]*)?$ ]]; then
+            echo "Invalid world-package: $WORLD_PACKAGE" >&2
+            exit 1
+          fi
+
       - name: Install ${{ inputs.world-name }} World
-        run: pnpm --filter ${{ inputs.app-name }} add ${{ inputs.world-package }}
+        env:
+          APP_NAME: ${{ inputs.app-name }}
+          WORLD_PACKAGE: ${{ inputs.world-package }}
+        run: pnpm --filter "$APP_NAME" add "$WORLD_PACKAGE"
 
       - name: Run setup command
         if: ${{ inputs.setup-command != '' }}
-        run: ${{ inputs.setup-command }}
-        working-directory: workbench/${{ inputs.app-name }}
+        env:
+          APP_NAME: ${{ inputs.app-name }}
+          SETUP_COMMAND: ${{ inputs.setup-command }}
+        run: |
+          cd "workbench/$APP_NAME"
+          eval "$SETUP_COMMAND"
 
       - name: Resolve symlinks
-        run: ./scripts/resolve-symlinks.sh workbench/${{ inputs.app-name }}
+        env:
+          APP_NAME: ${{ inputs.app-name }}
+        run: ./scripts/resolve-symlinks.sh "workbench/$APP_NAME"
 
       - name: Set environment variables
+        env:
+          ENV_VARS_JSON: ${{ inputs.env-vars }}
         run: |
-          echo '${{ inputs.env-vars }}' | jq -r 'to_entries[] | "\(.key)=\(.value)"' >> $GITHUB_ENV
+          printf '%s' "$ENV_VARS_JSON" | jq -r 'to_entries[] | "\(.key)=\(.value)"' >> "$GITHUB_ENV"
 
       - name: Build workbench
-        run: pnpm turbo run build --filter='./workbench/${{ inputs.app-name }}'
+        env:
+          APP_NAME: ${{ inputs.app-name }}
+        run: pnpm turbo run build --filter="./workbench/$APP_NAME"
 
       - name: Run benchmarks
         env:
           DEPLOYMENT_URL: "http://localhost:3000"
           APP_NAME: ${{ inputs.app-name }}
+          WORLD_ID: ${{ inputs.world-id }}
           WORKFLOW_BENCH_BACKEND: ${{ inputs.world-id }}
           BENCHMARK_FULL_SUITE: ${{ inputs.full-suite }}
         run: |
-          cd workbench/${{ inputs.app-name }}
+          cd "workbench/$APP_NAME"
           pnpm start &
           echo "Waiting for server to start..."
           sleep 15
-          cd ../..
-          pnpm vitest bench packages/core/e2e/bench.bench.ts --run --outputJson=bench-results-${{ inputs.app-name }}-${{ inputs.world-id }}.json
+          cd "$GITHUB_WORKSPACE"
+          pnpm vitest bench packages/core/e2e/bench.bench.ts --run "--outputJson=bench-results-$APP_NAME-$WORLD_ID.json"
 
       - name: Render benchmark results
         uses: ./.github/actions/render-benchmarks
diff --git a/.github/workflows/benchmarks.yml b/.github/workflows/benchmarks.yml
index eb098e093c..0514692c72 100644
--- a/.github/workflows/benchmarks.yml
+++ b/.github/workflows/benchmarks.yml
@@ -194,7 +194,9 @@ jobs:
           if_no_artifact_found: warn
 
       - name: Build workbench
-        run: pnpm turbo run build --filter='./workbench/${{ matrix.app }}'
+        env:
+          APP_NAME: ${{ matrix.app }}
+        run: pnpm turbo run build --filter="./workbench/$APP_NAME"
 
       - name: Run benchmarks
         env:
@@ -203,12 +205,12 @@ jobs:
           # Run full suite on nextjs-turbopack only (stress tests are too slow to run on all apps)
           BENCHMARK_FULL_SUITE: ${{ matrix.app == 'nextjs-turbopack' && ((github.event_name == 'workflow_dispatch' && inputs.full_suite) || contains(github.event.pull_request.labels.*.name, 'stress-test')) }}
         run: |
-          cd workbench/${{ matrix.app }}
+          cd "workbench/$APP_NAME"
           pnpm start &
           echo "Waiting for server to start..."
           sleep 15
-          cd ../..
-          pnpm vitest bench packages/core/e2e/bench.bench.ts --run --outputJson=bench-results-${{ matrix.app }}-local.json
+          cd "$GITHUB_WORKSPACE"
+          pnpm vitest bench packages/core/e2e/bench.bench.ts --run "--outputJson=bench-results-$APP_NAME-local.json"
 
       - name: Render benchmark results
         uses: ./.github/actions/render-benchmarks
@@ -296,7 +298,9 @@ jobs:
 
       # Build workbench with postgres world (build output differs based on target world)
       - name: Build workbench for postgres
-        run: pnpm turbo run build --filter='./workbench/${{ matrix.app }}'
+        env:
+          APP_NAME: ${{ matrix.app }}
+        run: pnpm turbo run build --filter="./workbench/$APP_NAME"
 
       - name: Run benchmarks
         env:
@@ -305,12 +309,12 @@ jobs:
           # Run full suite on nextjs-turbopack only (stress tests are too slow to run on all apps)
           BENCHMARK_FULL_SUITE: ${{ matrix.app == 'nextjs-turbopack' && ((github.event_name == 'workflow_dispatch' && inputs.full_suite) || contains(github.event.pull_request.labels.*.name, 'stress-test')) }}
         run: |
-          cd workbench/${{ matrix.app }}
+          cd "workbench/$APP_NAME"
           pnpm start &
           echo "Waiting for server to start..."
           sleep 15
-          cd ../..
-          pnpm vitest bench packages/core/e2e/bench.bench.ts --run --outputJson=bench-results-${{ matrix.app }}-postgres.json
+          cd "$GITHUB_WORKSPACE"
+          pnpm vitest bench packages/core/e2e/bench.bench.ts --run "--outputJson=bench-results-$APP_NAME-postgres.json"
 
       - name: Render benchmark results
         uses: ./.github/actions/render-benchmarks
@@ -404,7 +408,7 @@ jobs:
           # Run full suite on nextjs-turbopack only (stress tests are too slow to run on all apps)
           BENCHMARK_FULL_SUITE: ${{ matrix.app.name == 'nextjs-turbopack' && ((github.event_name == 'workflow_dispatch' && inputs.full_suite) || contains(github.event.pull_request.labels.*.name, 'stress-test')) }}
         run: |
-          pnpm vitest bench packages/core/e2e/bench.bench.ts --run --outputJson=bench-results-${{ matrix.app.name }}-vercel.json
+          pnpm vitest bench packages/core/e2e/bench.bench.ts --run "--outputJson=bench-results-$APP_NAME-vercel.json"
 
       - name: Render benchmark results
         uses: ./.github/actions/render-benchmarks
@@ -439,7 +443,9 @@ jobs:
           build-packages: 'false'
 
       - id: set-matrix
-        run: echo "matrix=$(node ./scripts/create-community-worlds-matrix.mjs)" >> $GITHUB_OUTPUT
+        run: |
+          MATRIX_JSON="$(node ./scripts/create-community-worlds-matrix.mjs | jq -c .)"
+          echo "matrix=$MATRIX_JSON" >> "$GITHUB_OUTPUT"
 
   benchmark-community:
     name: Benchmark Community World (${{ matrix.world.name }})
diff --git a/.github/workflows/e2e-community-world.yml b/.github/workflows/e2e-community-world.yml
index 0048eed477..8a70b934a0 100644
--- a/.github/workflows/e2e-community-world.yml
+++ b/.github/workflows/e2e-community-world.yml
@@ -87,37 +87,72 @@ jobs:
         with:
           build-packages: 'true'
 
+      - name: Validate inputs
+        env:
+          APP_NAME: ${{ inputs.app-name }}
+          WORLD_ID: ${{ inputs.world-id }}
+          WORLD_PACKAGE: ${{ inputs.world-package }}
+        run: |
+          if [[ ! "$APP_NAME" =~ ^[a-zA-Z0-9][a-zA-Z0-9_-]*$ ]]; then
+            echo "Invalid app-name: $APP_NAME" >&2
+            exit 1
+          fi
+          if [[ ! "$WORLD_ID" =~ ^[a-zA-Z0-9][a-zA-Z0-9_-]*$ ]]; then
+            echo "Invalid world-id: $WORLD_ID" >&2
+            exit 1
+          fi
+          if [[ ! "$WORLD_PACKAGE" =~ ^(@[a-zA-Z0-9][a-zA-Z0-9_.-]*/)?[a-zA-Z0-9][a-zA-Z0-9_.-]*(@[a-zA-Z0-9][a-zA-Z0-9_.+-]*)?$ ]]; then
+            echo "Invalid world-package: $WORLD_PACKAGE" >&2
+            exit 1
+          fi
+
       - name: Install ${{ inputs.world-name }} World
-        run: pnpm --filter ${{ inputs.app-name }} add ${{ inputs.world-package }}
+        env:
+          APP_NAME: ${{ inputs.app-name }}
+          WORLD_PACKAGE: ${{ inputs.world-package }}
+        run: pnpm --filter "$APP_NAME" add "$WORLD_PACKAGE"
 
       - name: Run setup command
         if: ${{ inputs.setup-command != '' }}
-        run: ${{ inputs.setup-command }}
-        working-directory: workbench/${{ inputs.app-name }}
+        env:
+          APP_NAME: ${{ inputs.app-name }}
+          SETUP_COMMAND: ${{ inputs.setup-command }}
+        run: |
+          cd "workbench/$APP_NAME"
+          eval "$SETUP_COMMAND"
 
       - name: Resolve symlinks
-        run: ./scripts/resolve-symlinks.sh workbench/${{ inputs.app-name }}
+        env:
+          APP_NAME: ${{ inputs.app-name }}
+        run: ./scripts/resolve-symlinks.sh "workbench/$APP_NAME"
 
       - name: Set environment variables
+        env:
+          ENV_VARS_JSON: ${{ inputs.env-vars }}
         run: |
-          echo '${{ inputs.env-vars }}' | jq -r 'to_entries[] | "\(.key)=\(.value)"' >> $GITHUB_ENV
+          printf '%s' "$ENV_VARS_JSON" | jq -r 'to_entries[] | "\(.key)=\(.value)"' >> "$GITHUB_ENV"
 
       - name: Run E2E Tests
-        run: |
-          cd workbench/${{ inputs.app-name }} && pnpm dev &
-          echo "Waiting for dev server to start..." && sleep 15
-          pnpm vitest run packages/core/e2e/dev.test.ts --reporter=default --reporter=json --reporter=./packages/core/e2e/github-reporter.ts --outputFile=e2e-community-${{ inputs.world-id }}-dev.json || true
-          sleep 10
-          pnpm vitest run packages/core/e2e/e2e.test.ts --reporter=default --reporter=json --reporter=./packages/core/e2e/github-reporter.ts --outputFile=e2e-community-${{ inputs.world-id }}.json || true
         env:
           NODE_OPTIONS: "--enable-source-maps"
           APP_NAME: ${{ inputs.app-name }}
+          WORLD_ID: ${{ inputs.world-id }}
           DEPLOYMENT_URL: "http://localhost:3000"
-          DEV_TEST_CONFIG: '{"name":"${{ inputs.app-name }}","project":"workbench-${{ inputs.app-name }}-workflow","generatedStepPath":"app/.well-known/workflow/v1/step/route.js","generatedWorkflowPath":"app/.well-known/workflow/v1/flow/route.js","apiFilePath":"app/api/chat/route.ts","apiFileImportPath":"../../.."}'
+        run: |
+          DEV_TEST_CONFIG="$(jq -nc --arg name "$APP_NAME" '{name:$name,project:"workbench-\($name)-workflow",generatedStepPath:"app/.well-known/workflow/v1/step/route.js",generatedWorkflowPath:"app/.well-known/workflow/v1/flow/route.js",apiFilePath:"app/api/chat/route.ts",apiFileImportPath:"../../.."}')"
+          export DEV_TEST_CONFIG
+          cd "workbench/$APP_NAME" && pnpm dev &
+          cd "$GITHUB_WORKSPACE"
+          echo "Waiting for dev server to start..." && sleep 15
+          pnpm vitest run packages/core/e2e/dev.test.ts --reporter=default --reporter=json --reporter=./packages/core/e2e/github-reporter.ts "--outputFile=e2e-community-$WORLD_ID-dev.json" || true
+          sleep 10
+          pnpm vitest run packages/core/e2e/e2e.test.ts --reporter=default --reporter=json --reporter=./packages/core/e2e/github-reporter.ts "--outputFile=e2e-community-$WORLD_ID.json" || true
 
       - name: Generate E2E summary
         if: always()
-        run: node .github/scripts/aggregate-e2e-results.js . --job-name "E2E Tests (${{ inputs.world-name }})" >> $GITHUB_STEP_SUMMARY || true
+        env:
+          WORLD_NAME: ${{ inputs.world-name }}
+        run: node .github/scripts/aggregate-e2e-results.js . --job-name "E2E Tests ($WORLD_NAME)" >> $GITHUB_STEP_SUMMARY || true
 
       - name: Upload E2E results
         uses: actions/upload-artifact@v4
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 36438509b0..041fd1762a 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -277,7 +277,7 @@ jobs:
           environment: ${{ github.ref == 'refs/heads/main' && 'production' || 'preview' }}
 
       - name: Run E2E Tests
-        run: pnpm run test:e2e --reporter=default --reporter=json --reporter=./packages/core/e2e/github-reporter.ts --outputFile=e2e-vercel-prod-${{ matrix.app.name }}.json
+        run: pnpm run test:e2e --reporter=default --reporter=json --reporter=./packages/core/e2e/github-reporter.ts "--outputFile=e2e-vercel-prod-$APP_NAME.json"
         env:
           NODE_OPTIONS: "--enable-source-maps"
           DEPLOYMENT_URL: ${{ steps.waitForDeployment.outputs.deployment-url }}
@@ -296,7 +296,9 @@ jobs:
 
       - name: Generate E2E summary
         if: always()
-        run: node .github/scripts/aggregate-e2e-results.js . --job-name "E2E Vercel Prod (${{ matrix.app.name }})" >> $GITHUB_STEP_SUMMARY || true
+        env:
+          APP_NAME: ${{ matrix.app.name }}
+        run: node .github/scripts/aggregate-e2e-results.js . --job-name "E2E Vercel Prod ($APP_NAME)" >> $GITHUB_STEP_SUMMARY || true
 
       - name: Upload E2E results
         if: always()
@@ -331,7 +333,9 @@ jobs:
           build-packages: 'false'
 
       - id: set-matrix
-        run: echo "matrix=$(node ./scripts/create-test-matrix.mjs)" >> $GITHUB_OUTPUT
+        run: |
+          MATRIX_JSON="$(node ./scripts/create-test-matrix.mjs | jq -c .)"
+          echo "matrix=$MATRIX_JSON" >> "$GITHUB_OUTPUT"
 
   e2e-local-dev:
     name: E2E Local Dev Tests (${{ matrix.app.name }} - ${{ matrix.app.canary && 'canary' || 'stable' }})
@@ -362,9 +366,11 @@ jobs:
 
       - name: Setup canary
         if: ${{ matrix.app.canary }}
+        env:
+          APP_NAME: ${{ matrix.app.name }}
         run: |
           cat packages/next/package.json | jq '.dependencies.next|="canary"' > packages/next/package.json.new && mv packages/next/package.json.new packages/next/package.json
-          cat workbench/${{ matrix.app.name }}/package.json | jq '.dependencies.next|="canary"' > workbench/${{ matrix.app.name }}/package.json.new && mv workbench/${{ matrix.app.name }}/package.json.new workbench/${{ matrix.app.name }}/package.json
+          cat "workbench/$APP_NAME/package.json" | jq '.dependencies.next|="canary"' > "workbench/$APP_NAME/package.json.new" && mv "workbench/$APP_NAME/package.json.new" "workbench/$APP_NAME/package.json"
           pnpm install --no-frozen-lockfile
 
       - name: Install Dependencies
@@ -381,13 +387,14 @@ jobs:
 
       - name: Run E2E Tests
         run: |
-          cd "${{ steps.prepare-workbench.outputs.workbench_app_path }}" && pnpm dev &
+          cd "$WORKBENCH_APP_PATH" && pnpm dev &
           echo "starting tests in 10 seconds" && sleep 10
           pnpm vitest run packages/core/e2e/dev.test.ts; sleep 10
-          pnpm run test:e2e --reporter=default --reporter=json --reporter=./packages/core/e2e/github-reporter.ts --outputFile=e2e-local-dev-${{ matrix.app.name }}-${{ matrix.app.canary && 'canary' || 'stable' }}.json
+          pnpm run test:e2e --reporter=default --reporter=json --reporter=./packages/core/e2e/github-reporter.ts "--outputFile=e2e-local-dev-$APP_NAME-$CANARY_SUFFIX.json"
         env:
           NODE_OPTIONS: "--enable-source-maps"
           APP_NAME: ${{ matrix.app.name }}
+          CANARY_SUFFIX: ${{ matrix.app.canary && 'canary' || 'stable' }}
           WORKBENCH_APP_PATH: ${{ steps.prepare-workbench.outputs.workbench_app_path }}
           DEPLOYMENT_URL: "http://localhost:${{ matrix.app.name == 'sveltekit' && '5173' || (matrix.app.name == 'astro' && '4321' || '3000') }}"
           DEV_TEST_CONFIG: ${{ toJSON(matrix.app) }}
@@ -395,7 +402,9 @@ jobs:
 
       - name: Generate E2E summary
         if: always()
-        run: node .github/scripts/aggregate-e2e-results.js . --job-name "E2E Local Dev (${{ matrix.app.name }})" >> $GITHUB_STEP_SUMMARY || true
+        env:
+          APP_NAME: ${{ matrix.app.name }}
+        run: node .github/scripts/aggregate-e2e-results.js . --job-name "E2E Local Dev ($APP_NAME)" >> $GITHUB_STEP_SUMMARY || true
 
       - name: Upload E2E results
         if: always()
@@ -435,9 +444,11 @@ jobs:
 
       - name: Setup canary
         if: ${{ matrix.app.canary }}
+        env:
+          APP_NAME: ${{ matrix.app.name }}
         run: |
           cat packages/next/package.json | jq '.dependencies.next|="canary"' > packages/next/package.json.new && mv packages/next/package.json.new packages/next/package.json
-          cat workbench/${{ matrix.app.name }}/package.json | jq '.dependencies.next|="canary"' > workbench/${{ matrix.app.name }}/package.json.new && mv workbench/${{ matrix.app.name }}/package.json.new workbench/${{ matrix.app.name }}/package.json
+          cat "workbench/$APP_NAME/package.json" | jq '.dependencies.next|="canary"' > "workbench/$APP_NAME/package.json.new" && mv "workbench/$APP_NAME/package.json.new" "workbench/$APP_NAME/package.json"
           pnpm install --no-frozen-lockfile
 
       - name: Install Dependencies
@@ -460,19 +471,22 @@ jobs:
 
       - name: Run E2E Tests
         run: |
-          cd "${{ steps.prepare-workbench.outputs.workbench_app_path }}" && pnpm start &
+          cd "$WORKBENCH_APP_PATH" && pnpm start &
           echo "starting tests in 10 seconds" && sleep 10
-          pnpm run test:e2e --reporter=default --reporter=json --reporter=./packages/core/e2e/github-reporter.ts --outputFile=e2e-local-prod-${{ matrix.app.name }}-${{ matrix.app.canary && 'canary' || 'stable' }}.json
+          pnpm run test:e2e --reporter=default --reporter=json --reporter=./packages/core/e2e/github-reporter.ts "--outputFile=e2e-local-prod-$APP_NAME-$CANARY_SUFFIX.json"
         env:
           NODE_OPTIONS: "--enable-source-maps"
           APP_NAME: ${{ matrix.app.name }}
+          CANARY_SUFFIX: ${{ matrix.app.canary && 'canary' || 'stable' }}
           WORKBENCH_APP_PATH: ${{ steps.prepare-workbench.outputs.workbench_app_path }}
           DEPLOYMENT_URL: "http://localhost:${{ matrix.app.name == 'sveltekit' && '4173' || (matrix.app.name == 'astro' && '4321' || '3000') }}"
           NEXT_CANARY: ${{ matrix.app.canary && '1' || '' }}
 
       - name: Generate E2E summary
         if: always()
-        run: node .github/scripts/aggregate-e2e-results.js . --job-name "E2E Local Prod (${{ matrix.app.name }})" >> $GITHUB_STEP_SUMMARY || true
+        env:
+          APP_NAME: ${{ matrix.app.name }}
+        run: node .github/scripts/aggregate-e2e-results.js . --job-name "E2E Local Prod ($APP_NAME)" >> $GITHUB_STEP_SUMMARY || true
 
       - name: Upload E2E results
         if: always()
@@ -529,9 +543,11 @@ jobs:
 
       - name: Setup canary
         if: ${{ matrix.app.canary }}
+        env:
+          APP_NAME: ${{ matrix.app.name }}
         run: |
           cat packages/next/package.json | jq '.dependencies.next|="canary"' > packages/next/package.json.new && mv packages/next/package.json.new packages/next/package.json
-          cat workbench/${{ matrix.app.name }}/package.json | jq '.dependencies.next|="canary"' > workbench/${{ matrix.app.name }}/package.json.new && mv workbench/${{ matrix.app.name }}/package.json.new workbench/${{ matrix.app.name }}/package.json
+          cat "workbench/$APP_NAME/package.json" | jq '.dependencies.next|="canary"' > "workbench/$APP_NAME/package.json.new" && mv "workbench/$APP_NAME/package.json.new" "workbench/$APP_NAME/package.json"
           pnpm install --no-frozen-lockfile
 
       - name: Install Dependencies
@@ -557,19 +573,22 @@ jobs:
 
       - name: Run E2E Tests
         run: |
-          cd "${{ steps.prepare-workbench.outputs.workbench_app_path }}" && pnpm start &
+          cd "$WORKBENCH_APP_PATH" && pnpm start &
           echo "starting tests in 10 seconds" && sleep 10
-          pnpm run test:e2e --reporter=default --reporter=json --reporter=./packages/core/e2e/github-reporter.ts --outputFile=e2e-local-postgres-${{ matrix.app.name }}-${{ matrix.app.canary && 'canary' || 'stable' }}.json
+          pnpm run test:e2e --reporter=default --reporter=json --reporter=./packages/core/e2e/github-reporter.ts "--outputFile=e2e-local-postgres-$APP_NAME-$CANARY_SUFFIX.json"
         env:
           NODE_OPTIONS: "--enable-source-maps"
           APP_NAME: ${{ matrix.app.name }}
+          CANARY_SUFFIX: ${{ matrix.app.canary && 'canary' || 'stable' }}
           WORKBENCH_APP_PATH: ${{ steps.prepare-workbench.outputs.workbench_app_path }}
           DEPLOYMENT_URL: "http://localhost:${{ matrix.app.name == 'sveltekit' && '4173' || (matrix.app.name == 'astro' && '4321' || '3000') }}"
           NEXT_CANARY: ${{ matrix.app.canary && '1' || '' }}
 
       - name: Generate E2E summary
         if: always()
-        run: node .github/scripts/aggregate-e2e-results.js . --job-name "E2E Local Postgres (${{ matrix.app.name }})" >> $GITHUB_STEP_SUMMARY || true
+        env:
+          APP_NAME: ${{ matrix.app.name }}
+        run: node .github/scripts/aggregate-e2e-results.js . --job-name "E2E Local Postgres ($APP_NAME)" >> $GITHUB_STEP_SUMMARY || true
 
       - name: Upload E2E results
         if: always()
@@ -694,7 +713,9 @@ jobs:
           build-packages: 'false'
 
       - id: set-matrix
-        run: echo "matrix=$(node ./scripts/create-community-worlds-matrix.mjs)" >> $GITHUB_OUTPUT
+        run: |
+          MATRIX_JSON="$(node ./scripts/create-community-worlds-matrix.mjs | jq -c .)"
+          echo "matrix=$MATRIX_JSON" >> "$GITHUB_OUTPUT"
 
   e2e-community:
     name: E2E Community World (${{ matrix.world.name }})