chore(ci): tidy up CI/CD (#4513)

Author: tothandras

.github/workflows/artifacts.yaml

@@ -105,7 +105,7 @@ jobs:
       - name: Retrieve pull token
         id: pull-token
         run: |
-          PULL_TOKEN="$(depot pull-token --project ${VARS_DEPOT_PROJECT})"
+          PULL_TOKEN="$(depot pull-token --project "${VARS_DEPOT_PROJECT}")"
           echo "token=$PULL_TOKEN" >> "$GITHUB_OUTPUT"
           echo "::add-mask::$PULL_TOKEN"
         env:
@@ -212,7 +212,7 @@ jobs:
       - name: Retrieve pull token
         id: pull-token
         run: |
-          PULL_TOKEN="$(depot pull-token --project ${VARS_DEPOT_PROJECT})"
+          PULL_TOKEN="$(depot pull-token --project "${VARS_DEPOT_PROJECT}")"
           echo "token=$PULL_TOKEN" >> "$GITHUB_OUTPUT"
           echo "::add-mask::$PULL_TOKEN"
         env:

.github/workflows/ci.yaml

@@ -375,7 +375,6 @@ jobs:
   migrations:
     name: Migration Checks
     runs-on: depot-ubuntu-latest-8
-    environment: dev
 
     steps:
       - name: Checkout repository
@@ -474,7 +473,7 @@ jobs:
           if [ -z "$BASE_COMMIT" ]; then
             BASE_COMMIT=$(git log -1 --format=%h)
           fi
-          echo "sha=${BASE_COMMIT}" >> $GITHUB_OUTPUT
+          echo "sha=${BASE_COMMIT}" >> "$GITHUB_OUTPUT"
 
           echo "sha=${BASE_COMMIT}"
 
@@ -542,7 +541,7 @@ jobs:
     if: ${{ always() }}
     uses: ./.github/workflows/workflow-result.yaml
     with:
-      result: ${{ contains(needs.*.result, 'failure') && 'fail' || 'pass' }}
+      result: ${{ (contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') || !contains(needs.*.result, 'success')) && 'fail' || 'pass' }}
 
   dependency-review:
     name: Dependency review

.github/workflows/pr-checks.yaml

@@ -27,7 +27,11 @@ jobs:
         run: python3 -m unittest discover -s .github/tools/migrate -p 'test_*.py'
 
       - name: Check atlas.sum is append-only
-        run: python3 .github/tools/migrate/check_atlas_sum_append_only.py "${{ github.event.pull_request.base.sha }}"
+        # base.sha is always a hex SHA, but route it via env for consistency
+        # with the repo-wide rule of never interpolating ${{ }} into run:.
+        run: python3 .github/tools/migrate/check_atlas_sum_append_only.py "$BASE_SHA"
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
 
   release-label:
     name: Release note label

.github/workflows/require-all-reviewers.yml

@@ -19,14 +19,12 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          ref: ${{ github.head_ref }}
           persist-credentials: false
 
       - name: Get short SHA
         id: get-short-sha
         run: |
-          id=$(echo ${{ github.sha }} | cut -c 1-12)
-          echo "id=${id}" >> $GITHUB_OUTPUT
+          echo "id=${GITHUB_SHA:0:12}" >> "$GITHUB_OUTPUT"
 
       # If you keep using Nix for your dev shell / tooling, retain these steps
       - name: Set up Nix