Fix potential security issues in GitHub actions

[juliette-derancourt]

I ran zizmor static analysis tool as suggested in #4558 and found several warnings/errors.

Some of them are addressed in this PR:

• https://docs.zizmor.sh/audits/#artipacked
• https://docs.zizmor.sh/audits/#template-injection

---

I hereby agree to the terms of the JUnit Contributor License Agreement.

[marcphilipp]

Thanks for taking care of this! 👍

Is there a way of running this check continuously, e.g. as a GitHub Actions workflow?

[juliette-derancourt]

This usage is also found as an error, but given the nature of the input (an optional string with \ characters), it does not work with this "naive" replacement:

      env:
        ARGUMENTS: ${{ inputs.arguments }}
      run: |
        ./gradlew \
        ... \
        ${ARGUMENTS}

Since the input value comes from a workflow, I think we can leave it as it is?

[juliette-derancourt]

Is there a way of running this check continuously, e.g. as a GitHub Actions workflow?

@marcphilipp I was wondering about that as well, but I guess we would need some mechanism to say "this is ignored intentionally" for that to be possible (I haven't checked that yet, will do)

[juliette-derancourt]

I guess we would need some mechanism to say "this is ignored intentionally" for that to be possible

Seems like there is a way, and a github action as well. I'll add that to #4558 deliverables and set that up in another PR.