Avoid shell template injection in workflows

Move values derived from GitHub expressions into step environment variables before using them in shell scripts. This prevents expression interpolation from becoming executable shell syntax.

Quote the Docker digest, Docker metadata tags, matrix distro, release ref name, and Twisted ref usages at the shell boundary while preserving the existing workflow behavior.

.github/workflows/docker.yml

@@ -112,8 +112,10 @@ jobs:
       - name: Export digest
         run: |
           mkdir -p ${{ runner.temp }}/digests
-          digest="${{ steps.build.outputs.digest }}"
+          digest="$BUILD_DIGEST"
           touch "${{ runner.temp }}/digests/${digest#sha256:}"
+        env:
+          BUILD_DIGEST: ${{ steps.build.outputs.digest }}
 
       - name: Upload digest
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

.github/workflows/docs.yaml

@@ -68,7 +68,9 @@ jobs:
           mdbook-version: '0.5.2'
 
       - name: Set version of docs
-        run: echo 'window.SYNAPSE_VERSION = "${{ needs.pre.outputs.branch-version }}";' > ./docs/website_files/version.js
+        run: echo 'window.SYNAPSE_VERSION = "${NEEDS_PRE_OUTPUTS_BRANCH_VERSION}";' > ./docs/website_files/version.js
+        env:
+          NEEDS_PRE_OUTPUTS_BRANCH_VERSION: ${{ needs.pre.outputs.branch-version }}
 
       - name: Setup python
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0

.github/workflows/push_complement_image.yml

@@ -74,9 +74,12 @@ jobs:
         run: scripts-dev/complement.sh --build-only
       - name: Tag and push generated image
         run: |
-          for TAG in ${{ join(fromJson(steps.meta.outputs.json).tags, ' ') }}; do 
+          while IFS= read -r TAG; do
+            [ -n "$TAG" ] || continue
             echo "tag and push $TAG"
             # `localhost/complement-synapse` should match the image created by `scripts-dev/complement.sh`
-            docker tag localhost/complement-synapse $TAG
-            docker push $TAG
-          done
+            docker tag localhost/complement-synapse "$TAG"
+            docker push "$TAG"
+          done <<< "$DOCKER_METADATA_OUTPUT_TAGS"
+        env:
+          DOCKER_METADATA_OUTPUT_TAGS: ${{ steps.meta.outputs.tags }}

.github/workflows/release-artifacts.yml

@@ -96,9 +96,11 @@ jobs:
             --docker-build-arg=--cache-to=type=local,mode=max,dest=/tmp/.buildx-cache-new \
             --docker-build-arg=--progress=plain \
             --docker-build-arg=--load \
-            "${{ matrix.distro }}"
+            "${MATRIX_DISTRO}"
           rm -rf /tmp/.buildx-cache
           mv /tmp/.buildx-cache-new /tmp/.buildx-cache
+        env:
+          MATRIX_DISTRO: ${{ matrix.distro }}
 
       - name: Artifact name
         id: artifact-name
@@ -217,7 +219,7 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          gh release upload "${{ github.ref_name }}" \
+          gh release upload "${GITHUB_REF_NAME}" \
             Sdist/* \
             Wheel*/* \
             debs.tar.xz \

.github/workflows/twisted_trunk.yml

@@ -63,8 +63,10 @@ jobs:
           poetry-version: "2.4.1"
       - run: |
           poetry remove twisted
-          poetry add --extras tls git+https://github.com/twisted/twisted.git#${{ inputs.twisted_ref || 'trunk' }}
+          poetry add --extras tls "git+https://github.com/twisted/twisted.git#${TWISTED_REF}"
           poetry install --no-interaction --extras "all test"
+        env:
+          TWISTED_REF: ${{ inputs.twisted_ref || 'trunk' }}
       - name: Remove unhelpful options from mypy config
         run: sed -e '/warn_unused_ignores = True/d' -e '/warn_redundant_casts = True/d' -i mypy.ini
       - run: poetry run mypy