chore: mitigate potential template injection

See https://docs.zizmor.sh/audits/#template-injection

Author: ghostdevv

.github/workflows/publish.yml

@@ -28,10 +28,12 @@ jobs:
 
       - name: Get Version
         id: vars
-        run: echo ::set-output name=version::$(echo ${{github.ref_name}} | sed 's/^v//')
+        run: echo ::set-output name=version::$(echo ${GITHUB_REF_NAME} | sed 's/^v//')
 
       - name: Build JSR
-        run: deno task build:jsr ${{steps.vars.outputs.version}}
+        run: deno task build:jsr ${STEPS_VARS_OUTPUTS_VERSION}
+        env:
+          STEPS_VARS_OUTPUTS_VERSION: ${{steps.vars.outputs.version}}
 
       - name: dry run publish
         run: deno publish --dry-run --allow-dirty
@@ -55,7 +57,7 @@ jobs:
 
       - name: Get Version
         id: vars
-        run: echo ::set-output name=version::$(echo ${{github.ref_name}} | sed 's/^v//')
+        run: echo ::set-output name=version::$(echo ${GITHUB_REF_NAME} | sed 's/^v//')
 
       - name: Setup Node
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
@@ -65,7 +67,9 @@ jobs:
           cache: ''
 
       - name: Build NPM
-        run: deno task build:npm ${{steps.vars.outputs.version}}
+        run: deno task build:npm ${STEPS_VARS_OUTPUTS_VERSION}
+        env:
+          STEPS_VARS_OUTPUTS_VERSION: ${{steps.vars.outputs.version}}
 
       - name: dry run publish
         run: npm publish --dry-run --tag=verify
@@ -126,10 +130,12 @@ jobs:
 
       - name: Get Version
         id: vars
-        run: echo ::set-output name=version::$(echo ${{github.ref_name}} | sed 's/^v//')
+        run: echo ::set-output name=version::$(echo ${GITHUB_REF_NAME} | sed 's/^v//')
 
       - name: Build JSR
-        run: deno task build:jsr ${{steps.vars.outputs.version}}
+        run: deno task build:jsr ${STEPS_VARS_OUTPUTS_VERSION}
+        env:
+          STEPS_VARS_OUTPUTS_VERSION: ${{steps.vars.outputs.version}}
 
       - name: Publish JSR
         run: deno publish --allow-dirty --token=${{ secrets.JSR_TOKEN }}