Security fix: avoid using ${{ }} variable interpolation in run: steps

[orbisai0security]

Summary

Fix high severity security issue in .github/workflows/release.yml.

Vulnerability

Field	Value
ID	yaml.github-actions.security.run-shell-injection.run-shell-injection
Severity	HIGH
Scanner	semgrep
Rule	yaml.github-actions.security.run-shell-injection.run-shell-injection
File	.github/workflows/release.yml:113

Description: Using variable interpolation ${{...}} with github context data in a run: step could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code. github context data can have arbitrary user input and should be treated as untrusted. Instead, use an intermediate environment variable with env: to store the data and use the environment variable in the run: script. Be sure to use double-quotes the environment variable, like this: "$ENVVAR".

Changes

• .github/workflows/release.yml

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{TIP This summary will be updated as you push new changes. Give us feedback}

[stefanhaller]

Thanks. I disagree that this is a high severity security issue, because an attacker would need push access to exploit it. Still good practice to fix it of course. Merging.