Fix script injection security issues in workflows

[martinohansen]

Summary

Move untrusted GitHub context values out of inline shell scripts into environment variables to prevent script injection attacks.

Security concern

Directly interpolating ${{ github.head_ref }} or ${{ github.event.pull_request.head.ref }} into run: scripts allows an attacker to inject arbitrary shell commands by naming a branch with a payload like x"; malicious command; echo ".

Fix

Each untrusted value is assigned to an environment variable in the step's env: block and referenced as $VAR_NAME in the script body.

See: https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions

[github-actions]

📖 Docs Preview

Preview URL: https://xata.io/next/preview-path?path=/docs-preview/xataio:fix/actionlint-script-injection/