diff --git a/.github/actions/bash/action.yml b/.github/actions/bash/action.yml
index d105a44f10bc3..293d1e9777a65 100644
--- a/.github/actions/bash/action.yml
+++ b/.github/actions/bash/action.yml
@@ -24,4 +24,6 @@ runs:
 
     - name: Run
       shell: bash
-      run: ${{ inputs.command }}
+      run: ${INPUTS_COMMAND}
+      env:
+        INPUTS_COMMAND: ${{ inputs.command }}
diff --git a/.github/actions/bazel-docker/action.yml b/.github/actions/bazel-docker/action.yml
index af1104e23df83..39b976e10fa09 100644
--- a/.github/actions/bazel-docker/action.yml
+++ b/.github/actions/bazel-docker/action.yml
@@ -47,7 +47,7 @@ runs:
 
     - name: Hook up repository Cache
       shell: bash
-      run: echo "BAZEL_FLAGS=$BAZEL_FLAGS --repository_cache='/workspace/${{ env.REPOSITORY_CACHE_PATH }}'" >> $GITHUB_ENV
+      run: echo "BAZEL_FLAGS=$BAZEL_FLAGS --repository_cache='/workspace/${REPOSITORY_CACHE_PATH}'" >> $GITHUB_ENV
 
     - name: Validate inputs
       if: ${{ (inputs.bash && inputs.bazel) || (!inputs.bash && !inputs.bazel) }}
diff --git a/.github/actions/bazel/action.yml b/.github/actions/bazel/action.yml
index 952dfad09d1a0..0a74accda9819 100644
--- a/.github/actions/bazel/action.yml
+++ b/.github/actions/bazel/action.yml
@@ -78,7 +78,7 @@ runs:
 
     - name: Hook up repository Cache
       shell: bash
-      run: echo "BAZEL_FLAGS=$BAZEL_FLAGS --repository_cache=$(pwd)/${{ env.REPOSITORY_CACHE_PATH }}" >> $GITHUB_ENV
+      run: echo "BAZEL_FLAGS=$BAZEL_FLAGS --repository_cache=$(pwd)/${REPOSITORY_CACHE_PATH}" >> $GITHUB_ENV
 
     - name: Validate inputs
       if: ${{ (inputs.bash && inputs.bazel) || (!inputs.bash && !inputs.bazel) }}
@@ -87,7 +87,9 @@ runs:
 
     - name: Pin Bazel version
       shell: bash
-      run: echo "USE_BAZEL_VERSION=${{ inputs.version }}" >> $GITHUB_ENV
+      run: echo "USE_BAZEL_VERSION=${INPUTS_VERSION}" >> $GITHUB_ENV
+      env:
+        INPUTS_VERSION: ${{ inputs.version }}
 
     - name: Output Bazel version
       shell: bash
@@ -106,7 +108,7 @@ runs:
       shell: bash
       run: |
         mkdir -p mac_bazel_workaround
-        bazelisk ${{ steps.bazel.outputs.bazel-startup-flags }} build @bazel_tools//tools/osx:xcode_locator.m $BAZEL_FLAGS
+        bazelisk ${STEPS_BAZEL_OUTPUTS_BAZEL_STARTUP_FLAGS} build @bazel_tools//tools/osx:xcode_locator.m $BAZEL_FLAGS
         XCODE_LOCATOR_FLAGS="--sdk macosx clang -mmacosx-version-min=10.9 -fobjc-arc -framework CoreServices -framework Foundation"
         SINGLE_ARCH_COMPILE_FLAGS="--sdk macosx clang -mmacosx-version-min=10.9 -std=c++11 -lc++ -O3"
         COMPILE_FLAGS="$SINGLE_ARCH_COMPILE_FLAGS -arch arm64 -arch x86_64 -Wl,-no_adhoc_codesign -Wl,-no_uuid -O3"
@@ -115,18 +117,25 @@ runs:
         time env -i DEVELOPER_DIR=$DEVELOPER_DIR xcrun $COMPILE_FLAGS -o mac_bazel_workaround/libtool_check_unique $(bazel info output_base)/external/bazel_tools/tools/objc/libtool_check_unique.cc
         time env -i DEVELOPER_DIR=$DEVELOPER_DIR xcrun $SINGLE_ARCH_COMPILE_FLAGS -o mac_bazel_workaround/wrapped_clang $(bazel info output_base)/external/bazel_tools/tools/osx/crosstool/wrapped_clang.cc
         time env -i DEVELOPER_DIR=$DEVELOPER_DIR xcrun $COMPILE_FLAGS -o mac_bazel_workaround/wrapped_clang $(bazel info output_base)/external/bazel_tools/tools/osx/crosstool/wrapped_clang.cc
+      env:
+        STEPS_BAZEL_OUTPUTS_BAZEL_STARTUP_FLAGS: ${{ steps.bazel.outputs.bazel-startup-flags }}
 
     - name: Run Bash
       if: ${{ inputs.bash }}
-      run: ${{ inputs.bash }}
+      run: ${INPUTS_BASH}
       shell: bash
+      env:
+        INPUTS_BASH: ${{ inputs.bash }}
 
     - name: Run Bazel
       if: ${{ !inputs.bash }}
       run: >-
-        bazelisk ${{ steps.bazel.outputs.bazel-startup-flags }}
-        ${{ inputs.bazel }} $BAZEL_FLAGS
+        bazelisk ${STEPS_BAZEL_OUTPUTS_BAZEL_STARTUP_FLAGS}
+        ${INPUTS_BAZEL} $BAZEL_FLAGS
       shell: bash
+      env:
+        STEPS_BAZEL_OUTPUTS_BAZEL_STARTUP_FLAGS: ${{ steps.bazel.outputs.bazel-startup-flags }}
+        INPUTS_BAZEL: ${{ inputs.bazel }}
 
     - name: Save Bazel repository cache
       # Only allow repository cache updates during post-submits.
diff --git a/.github/actions/cross-compile-protoc/action.yml b/.github/actions/cross-compile-protoc/action.yml
index 23660af705ce7..a91cc753bfcb1 100644
--- a/.github/actions/cross-compile-protoc/action.yml
+++ b/.github/actions/cross-compile-protoc/action.yml
@@ -28,7 +28,9 @@ runs:
 
     - name: Set protoc environment variable
       shell: bash
-      run: echo "PROTOC=protoc-${{ inputs.architecture }}" >> $GITHUB_ENV
+      run: echo "PROTOC=protoc-${INPUTS_ARCHITECTURE}" >> $GITHUB_ENV
+      env:
+        INPUTS_ARCHITECTURE: ${{ inputs.architecture }}
 
     - name: Extract binary
       id: output
diff --git a/.github/actions/docker/action.yml b/.github/actions/docker/action.yml
index 54de3f908ec78..a6e5d230fca4b 100644
--- a/.github/actions/docker/action.yml
+++ b/.github/actions/docker/action.yml
@@ -40,7 +40,9 @@ runs:
     - name: Generate docker flags
       if: inputs.platform
       shell: bash
-      run: echo "DOCKER_RUN_FLAGS=--platform ${{inputs.platform}}" >> $GITHUB_ENV
+      run: echo "DOCKER_RUN_FLAGS=--platform ${INPUTS_PLATFORM}" >> $GITHUB_ENV
+      env:
+        INPUTS_PLATFORM: ${{inputs.platform}}
 
     - name: Run Docker
       uses: ./.github/actions/internal/docker-run
diff --git a/.github/actions/internal/bazel-setup/action.yml b/.github/actions/internal/bazel-setup/action.yml
index 0ef5d5a2266ac..da995df265bf5 100644
--- a/.github/actions/internal/bazel-setup/action.yml
+++ b/.github/actions/internal/bazel-setup/action.yml
@@ -53,8 +53,11 @@ runs:
       shell: bash
       run: >-
         echo "BAZEL_FLAGS=$BAZEL_FLAGS
-        --google_credentials=${{ inputs.credentials-file }}
-        --remote_cache=https://storage.googleapis.com/protobuf-bazel-cache/protobuf/gha/${{ inputs.bazel-cache }}" >> $GITHUB_ENV
+        --google_credentials=${INPUTS_CREDENTIALS_FILE}
+        --remote_cache=https://storage.googleapis.com/protobuf-bazel-cache/protobuf/gha/${INPUTS_BAZEL_CACHE}" >> $GITHUB_ENV
+      env:
+        INPUTS_CREDENTIALS_FILE: ${{ inputs.credentials-file }}
+        INPUTS_BAZEL_CACHE: ${{ inputs.bazel-cache }}
 
     - name: Configure Bazel cache writing
       # External runs should never write to our caches.
diff --git a/.github/actions/internal/ccache-setup-windows/action.yml b/.github/actions/internal/ccache-setup-windows/action.yml
index 7b9f9925b35dd..1c2fd9a1572f6 100644
--- a/.github/actions/internal/ccache-setup-windows/action.yml
+++ b/.github/actions/internal/ccache-setup-windows/action.yml
@@ -19,12 +19,16 @@ runs:
     - name: Setup ccache path
       shell: bash
       run: |
-        echo "CCACHE_EXE_PATH=$LOCALAPPDATA\ccache-${{ inputs.ccache-version }}-windows-x86_64" >> $GITHUB_ENV
-        echo "$LOCALAPPDATA\ccache-${{ inputs.ccache-version }}-windows-x86_64" >> $GITHUB_PATH
+        echo "CCACHE_EXE_PATH=$LOCALAPPDATA\ccache-${INPUTS_CCACHE_VERSION}-windows-x86_64" >> $GITHUB_ENV
+        echo "$LOCALAPPDATA\ccache-${INPUTS_CCACHE_VERSION}-windows-x86_64" >> $GITHUB_PATH
+      env:
+        INPUTS_CCACHE_VERSION: ${{ inputs.ccache-version }}
 
     - name: Add ccache to Powershell path
       shell: pwsh
-      run: echo "%LOCALAPPDATA%\ccache-${{ inputs.ccache-version }}-windows-x86_64" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
+      run: echo "%LOCALAPPDATA%\ccache-$env:INPUTS_CCACHE_VERSION-windows-x86_64" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
+      env:
+        INPUTS_CCACHE_VERSION: ${{ inputs.ccache-version }}
 
     - name: Setup caching of ccache download
       if: ${{ github.event_name != 'pull_request' && github.event_name != 'pull_request_target' }}
@@ -47,10 +51,12 @@ runs:
       if: ${{ steps.ccache-cache.outputs.cache-hit != 'true' && steps.ccache-restore.outputs.cache-hit != 'true'}}
       run: |
         cd $LOCALAPPDATA
-        curl -kLSs "https://github.com/ccache/ccache/releases/download/v${{ inputs.ccache-version }}/ccache-${{ inputs.ccache-version }}-windows-x86_64.zip" -o ccache.zip
+        curl -kLSs "https://github.com/ccache/ccache/releases/download/v${INPUTS_CCACHE_VERSION}/ccache-${INPUTS_CCACHE_VERSION}-windows-x86_64.zip" -o ccache.zip
         unzip ccache.zip
         rm ccache.zip
         ccache --version
+      env:
+        INPUTS_CCACHE_VERSION: ${{ inputs.ccache-version }}
 
     - name: Configure ccache environment variables
       shell: pwsh
diff --git a/.github/actions/internal/docker-run/action.yml b/.github/actions/internal/docker-run/action.yml
index 1cc14894d83b8..60c72d28c415c 100644
--- a/.github/actions/internal/docker-run/action.yml
+++ b/.github/actions/internal/docker-run/action.yml
@@ -41,22 +41,32 @@ runs:
       shell: bash
       if: ${{ inputs.docker-cache && steps.check-docker-cache.outputs.cache-hit != 'true' }}
       run: >
-        time docker pull -q ${{ inputs.image }} &&
-        mkdir -p ci/docker/$(dirname ${{ inputs.image }}) &&
-        time docker image save ${{ inputs.image }} --output ./ci/docker/${{ inputs.image }}.tar
+        time docker pull -q ${INPUTS_IMAGE} &&
+        mkdir -p ci/docker/$(dirname ${INPUTS_IMAGE}) &&
+        time docker image save ${INPUTS_IMAGE} --output ./ci/docker/${INPUTS_IMAGE}.tar
+      env:
+        INPUTS_IMAGE: ${{ inputs.image }}
 
     - name: Use the cached image on cache hit
       shell: bash
       if: ${{ inputs.docker-cache && steps.check-docker-cache.outputs.cache-hit == 'true' }}
-      run: time docker image load --input ./ci/docker/${{ inputs.image }}.tar
+      run: time docker image load --input ./ci/docker/${INPUTS_IMAGE}.tar
+      env:
+        INPUTS_IMAGE: ${{ inputs.image }}
 
     - name: Pull fresh docker image
       shell: bash
       if: ${{ !inputs.docker-cache }}
-      run: time docker pull -q ${{ inputs.image }}
+      run: time docker pull -q ${INPUTS_IMAGE}
+      env:
+        INPUTS_IMAGE: ${{ inputs.image }}
 
     - name: Run docker
       shell: bash
       run: >
-        time docker run ${{ inputs.run-flags}} -v${{ github.workspace }}:/workspace
-        ${{ inputs.image }} ${{ inputs.command }}
+        time docker run ${INPUTS_RUN_FLAGS} -v${{ github.workspace }}:/workspace
+        ${INPUTS_IMAGE} ${INPUTS_COMMAND}
+      env:
+        INPUTS_RUN_FLAGS: ${{ inputs.run-flags}}
+        INPUTS_IMAGE: ${{ inputs.image }}
+        INPUTS_COMMAND: ${{ inputs.command }}
diff --git a/.github/actions/internal/gcloud-auth/action.yml b/.github/actions/internal/gcloud-auth/action.yml
index 189619ddba3ce..9c94096badb86 100644
--- a/.github/actions/internal/gcloud-auth/action.yml
+++ b/.github/actions/internal/gcloud-auth/action.yml
@@ -27,7 +27,9 @@ runs:
 
     - name: Store credentials path
       shell: bash
-      run: echo "CREDENTIALS_FILE=${{ steps.auth.outputs.credentials_file_path }}" >> $GITHUB_ENV
+      run: echo "CREDENTIALS_FILE=${STEPS_AUTH_OUTPUTS_CREDENTIALS_FILE_PATH}" >> $GITHUB_ENV
+      env:
+        STEPS_AUTH_OUTPUTS_CREDENTIALS_FILE_PATH: ${{ steps.auth.outputs.credentials_file_path }}
 
     - name: Fix credentials path (Windows)
       if: ${{ runner.os == 'Windows' }}
@@ -39,4 +41,4 @@ runs:
     - name: Output credentials file
       id: output
       shell: bash
-      run: echo "credentials-file=${{ env.CREDENTIALS_FILE }}" >> $GITHUB_OUTPUT
+      run: echo "credentials-file=${CREDENTIALS_FILE}" >> $GITHUB_OUTPUT
diff --git a/.github/actions/internal/repository-cache-restore/action.yml b/.github/actions/internal/repository-cache-restore/action.yml
index a5b4a0a924d8e..c9797d43ec589 100644
--- a/.github/actions/internal/repository-cache-restore/action.yml
+++ b/.github/actions/internal/repository-cache-restore/action.yml
@@ -24,8 +24,10 @@ runs:
       run: |
         REPOSITORY_CACHE_BASE=repository-cache-${{ github.base_ref || github.ref_name }}-${{ runner.os }}
         echo "REPOSITORY_CACHE_BASE=$REPOSITORY_CACHE_BASE" >> $GITHUB_ENV
-        echo "REPOSITORY_CACHE_NAME=$REPOSITORY_CACHE_BASE-${{ inputs.bazel-cache}}-${{ github.sha }}" >> $GITHUB_ENV
+        echo "REPOSITORY_CACHE_NAME=$REPOSITORY_CACHE_BASE-${INPUTS_BAZEL_CACHE}-${{ github.sha }}" >> $GITHUB_ENV
         echo "REPOSITORY_CACHE_PATH=.repository-cache" >> $GITHUB_ENV
+      env:
+        INPUTS_BAZEL_CACHE: ${{ inputs.bazel-cache}}
 
     - name: Restore Bazel repository cache
       id: restore-cache
diff --git a/.github/workflows/forked_pr_workflow_check.yml b/.github/workflows/forked_pr_workflow_check.yml
index f1dd9b55168f3..e85347e1426d1 100644
--- a/.github/workflows/forked_pr_workflow_check.yml
+++ b/.github/workflows/forked_pr_workflow_check.yml
@@ -24,4 +24,6 @@ jobs:
     steps:
       - run: >
           ${{ github.event.pull_request.head.repo.full_name == 'protocolbuffers/protobuf' }} ||
-          (echo "This pull request is from an unsafe fork (${{ github.event.pull_request.head.repo.full_name }}) and isn't allowed to modify workflow files!" && exit 1)
+          (echo "This pull request is from an unsafe fork (${GITHUB_EVENT_PULL_REQUEST_HEAD_REPO_FULL_NAME}) and isn't allowed to modify workflow files!" && exit 1)
+        env:
+          GITHUB_EVENT_PULL_REQUEST_HEAD_REPO_FULL_NAME: ${{ github.event.pull_request.head.repo.full_name }}
diff --git a/.github/workflows/update_php_repo.yml b/.github/workflows/update_php_repo.yml
index cb3383ad019d0..51b14e6104b13 100644
--- a/.github/workflows/update_php_repo.yml
+++ b/.github/workflows/update_php_repo.yml
@@ -43,7 +43,7 @@ jobs:
       - name: Push Changes
         run: |
           git add --all
-          git commit --allow-empty -m "${{ env.VERSION }} sync"
+          git commit --allow-empty -m "${VERSION} sync"
           git push --force origin master
-          git tag -a ${{ env.VERSION_TAG }} -m "Tag release ${{ env.VERSION_TAG }}"
-          git push origin ${{ env.VERSION_TAG }}
+          git tag -a ${VERSION_TAG} -m "Tag release ${VERSION_TAG}"
+          git push origin ${VERSION_TAG}