fix(security): harden GitHub Actions workflows against expression injection (#823)

Move ${{ }} expressions from run: blocks into step-level env: blocks,
then reference them as properly-quoted shell variables.


Signed-off-by: Marco Nenciarini <marco.nenciarini@enterprisedb.com>
Signed-off-by: Jonathan Gonzalez V. <jonathan.abdiel@gmail.com>
Co-authored-by: Jonathan Gonzalez V. <jonathan.abdiel@gmail.com>

Author: mnencia

.github/workflows/release-pr.yml

@@ -22,11 +22,12 @@ jobs:
         id: create-pr
         env:
           GH_TOKEN: ${{ secrets.REPO_GHA_PAT }}
+          ACTOR: ${{ github.actor }}
         run: |
           TAG="${GITHUB_REF##*/}"
           TITLE="Release ${TAG}"
           BODY="Automated PR. Will trigger the ${TAG} release when approved."
           LABEL=release
-          ASSIGNEE=${{ github.actor }}
+          ASSIGNEE="${ACTOR}"
           gh pr create --title "${TITLE}" --body "${BODY}" --label "${LABEL}" --assignee "${ASSIGNEE}" ||
           gh pr edit --title "${TITLE}" --body "${BODY}" --add-label "${LABEL}"

.github/workflows/tests-cluster-chainsaw.yaml

@@ -70,4 +70,6 @@ jobs:
             tenant minio-operator/tenant
 
       - name: Run Kyverno/Chainsaw
-        run: chainsaw test charts/cluster/test/${{matrix.test}}
+        env:
+          MATRIX_TEST: ${{ matrix.test }}
+        run: chainsaw test "charts/cluster/test/${MATRIX_TEST}"

.github/workflows/tests-plugin-barman-cloud.yaml

@@ -26,7 +26,9 @@ jobs:
     strategy:
       fail-fast: false
       matrix: ${{ fromJson(needs.test-list.outputs.tests) }}
-    name: ${{matrix.test}}
+    env:
+      MATRIX_TEST: ${{ matrix.test }}
+    name: ${{ env.MATRIX_TEST }}
     steps:
       - name: Checkout
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
@@ -73,4 +75,4 @@ jobs:
             tenant minio-operator/tenant
 
       - name: Run Kyverno/Chainsaw
-        run: chainsaw test charts/plugin-barman-cloud/test/${{matrix.test}}
+        run: chainsaw test "charts/plugin-barman-cloud/test/${MATRIX_TEST}"