ci: fix zizmor findings

Author: gcl-sekoia

.github/actions/cargo-build-macos-binary/action.yml

@@ -13,8 +13,11 @@ inputs:
 runs:
   using: "composite"
   steps:
-    - run: echo "ASSET_FULL_NAME=quickwit-${{ inputs.version }}-${{ inputs.target }}" >> $GITHUB_ENV
+    - run: echo "ASSET_FULL_NAME=quickwit-${INPUTS_VERSION}-${INPUTS_TARGET}" >> $GITHUB_ENV
       shell: bash
+      env:
+        INPUTS_VERSION: ${{ inputs.version }}
+        INPUTS_TARGET: ${{ inputs.target }}
     - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
       with:
         node-version: 20
@@ -31,9 +34,11 @@ runs:
       shell: bash
       run: curl https://sh.rustup.rs -sSf | sh -s -- --default-toolchain none -y
     - name: Add target ${{ inputs.target }}
-      run: rustup target add ${{ inputs.target }}
+      run: rustup target add ${INPUTS_TARGET}
       shell: bash
       working-directory: ./quickwit
+      env:
+        INPUTS_TARGET: ${{ inputs.target }}
     - name: Retrieve and export commit date, hash, and tags
       run: |
           echo "QW_COMMIT_DATE=$(TZ=UTC0 git log -1 --format=%cd --date=format-local:%Y-%m-%dT%H:%M:%SZ)" >> $GITHUB_ENV
@@ -50,9 +55,12 @@ runs:
         QW_COMMIT_TAGS: ${{ env.QW_COMMIT_TAGS }}
     - name: Bundle archive
       run: |
-        make archive BINARY_FILE=quickwit/target/${{ inputs.target }}/release/quickwit \
-          BINARY_VERSION=${{ inputs.version }} ARCHIVE_NAME=${{ env.ASSET_FULL_NAME }}
+        make archive BINARY_FILE=quickwit/target/${INPUTS_TARGET}/release/quickwit \
+          BINARY_VERSION=${INPUTS_VERSION} ARCHIVE_NAME=${ASSET_FULL_NAME}
       shell: bash
+      env:
+        INPUTS_TARGET: ${{ inputs.target }}
+        INPUTS_VERSION: ${{ inputs.version }}
     - name: Save binary archive for three days
       uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
       with:

.github/actions/cross-build-binary/action.yml

@@ -13,8 +13,11 @@ inputs:
 runs:
   using: "composite"
   steps:
-    - run: echo "ASSET_FULL_NAME=quickwit-${{ inputs.version }}-${{ inputs.target }}" >> $GITHUB_ENV
+    - run: echo "ASSET_FULL_NAME=quickwit-${INPUTS_VERSION}-${INPUTS_TARGET}" >> $GITHUB_ENV
       shell: bash
+      env:
+        INPUTS_VERSION: ${{ inputs.version }}
+        INPUTS_TARGET: ${{ inputs.target }}
     - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
       with:
         node-version: 20
@@ -37,18 +40,22 @@ runs:
           echo "QW_COMMIT_TAGS=$(git tag --points-at HEAD | tr '\n' ',')" >> $GITHUB_ENV
       shell: bash
     - name: Build Quickwit
-      run: cross build --release --features release-feature-vendored-set --target ${{ inputs.target }} --bin quickwit
+      run: cross build --release --features release-feature-vendored-set --target ${INPUTS_TARGET} --bin quickwit
       shell: bash
       env:
         QW_COMMIT_DATE: ${{ env.QW_COMMIT_DATE }}
         QW_COMMIT_HASH: ${{ env.QW_COMMIT_HASH }}
         QW_COMMIT_TAGS: ${{ env.QW_COMMIT_TAGS }}
+        INPUTS_TARGET: ${{ inputs.target }}
       working-directory: ./quickwit
     - name: Bundle archive
       run: |
-        make archive BINARY_FILE=quickwit/target/${{ inputs.target }}/release/quickwit \
-          BINARY_VERSION=${{ inputs.version }} ARCHIVE_NAME=${{ env.ASSET_FULL_NAME }}
+        make archive BINARY_FILE=quickwit/target/${INPUTS_TARGET}/release/quickwit \
+          BINARY_VERSION=${INPUTS_VERSION} ARCHIVE_NAME=${ASSET_FULL_NAME}
       shell: bash
+      env:
+        INPUTS_TARGET: ${{ inputs.target }}
+        INPUTS_VERSION: ${{ inputs.version }}
     - name: Save binary archive for three days
       uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
       with:

.github/workflows/publish_docker_images.yml

@@ -79,11 +79,14 @@ jobs:
           echo "QW_COMMIT_DATE=$(TZ=UTC0 git log -1 --format=%cd --date=format-local:%Y-%m-%dT%H:%M:%SZ)" >> $GITHUB_ENV
           echo "QW_COMMIT_HASH=$(git rev-parse HEAD)" >> $GITHUB_ENV
           echo "QW_COMMIT_TAGS=$(git tag --points-at HEAD | tr '\n' ',')" >> $GITHUB_ENV
-          if [[ "${{ github.event_name }}" == "push" && "${{ github.ref_type }}" == "tag" && "${GITHUB_REF#refs/tags/}" == *"jemprof"* ]]; then
+          if [[ "${EVENT_NAME}" == "push" && "${REF_TYPE}" == "tag" && "${GITHUB_REF#refs/tags/}" == *"jemprof"* ]]; then
             echo "CARGO_FEATURES=release-jemalloc-profiled" >> $GITHUB_ENV
           else
             echo "CARGO_FEATURES=release-feature-set" >> $GITHUB_ENV
           fi
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          REF_TYPE: ${{ github.ref_type }}
 
       - name: Build and push image
         uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
@@ -157,4 +160,6 @@ jobs:
             $(printf '${{ env.REGISTRY_IMAGE }}@sha256:%s ' *)
       - name: Inspect image
         run: |
-          docker buildx imagetools inspect ${{ env.REGISTRY_IMAGE }}:${{ steps.meta.outputs.version }}
+          docker buildx imagetools inspect ${{ env.REGISTRY_IMAGE }}:${STEPS_META_OUTPUTS_VERSION}
+        env:
+          STEPS_META_OUTPUTS_VERSION: ${{ steps.meta.outputs.version }}