Harden CI against script injection in GitHub Actions

Bind untrusted github.* and inputs.* context values to env variables and
reference them as shell variables in run: blocks, instead of interpolating
them directly into the script text. Prevents the script-injection class
flagged by AppSec (Talos). Follows GitHub's security-hardening guidance and
the approach of awslabs#787.

Author: Sbozzolo

.github/workflows/docs.yml

@@ -53,8 +53,11 @@ jobs:
               - '.github/workflows/docs.yml'
       - name: Decide whether to build
         id: decide
+        env:
+          GITHUB_REF: ${{ github.ref }}
+          EVENT_NAME: ${{ github.event_name }}
         run: |
-          if [[ "${{ github.ref }}" == refs/tags/* ]] || [[ "${{ github.event_name }}" == "workflow_dispatch" ]]; then
+          if [[ "${GITHUB_REF}" == refs/tags/* ]] || [[ "${EVENT_NAME}" == "workflow_dispatch" ]]; then
             echo "should_build=true" >> "$GITHUB_OUTPUT"
           else
             echo "should_build=${{ steps.filter.outputs.test }}" >> "$GITHUB_OUTPUT"
@@ -198,15 +201,16 @@ jobs:
       - name: Build and deploy
         if: needs.filter.outputs.should_build == 'true'
         env:
+          DEPLOY_TAG: ${{ inputs.deploy_tag }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           # For workflow_dispatch with deploy_tag, override the runner's immutable
           # GITHUB_* env vars so Documenter.jl sees a tag push.
-          if [[ -n "${{ inputs.deploy_tag }}" ]]; then
+          if [[ -n "${DEPLOY_TAG}" ]]; then
             export GITHUB_EVENT_NAME=push
-            export GITHUB_REF=refs/tags/${{ inputs.deploy_tag }}
+            export GITHUB_REF=refs/tags/"${DEPLOY_TAG}"
             export GITHUB_REF_TYPE=tag
-            export GITHUB_REF_NAME=${{ inputs.deploy_tag }}
+            export GITHUB_REF_NAME="${DEPLOY_TAG}"
           fi
           eval $(spack -e . load --sh palace)
           julia --project=docs -e 'using Pkg; Pkg.instantiate()'
@@ -216,8 +220,10 @@ jobs:
         if: >-
           needs.filter.outputs.should_build == 'true' &&
           (startsWith(github.ref, 'refs/tags/') || inputs.deploy_tag != '')
+        env:
+          TAG_REF: ${{ inputs.deploy_tag || github.ref_name }}
         run: |
-          TAG="${{ inputs.deploy_tag || github.ref_name }}"
+          TAG="${TAG_REF}"
           VERSION="${TAG#v}"
           git fetch origin gh-pages --depth=1
           STABLE=$(git show origin/gh-pages:stable)

.github/workflows/ghcr-cleanup.yml

@@ -62,10 +62,11 @@ jobs:
       - name: Print buildcache version count before cleanup
         continue-on-error: true
         env:
+          REPO_OWNER: ${{ github.repository_owner }}
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         shell: bash
         run: |
-          gh api /orgs/${{ github.repository_owner }}/packages/container/palace-develop-testing \
+          gh api /orgs/"${REPO_OWNER}"/packages/container/palace-develop-testing \
             --jq '"palace-develop-testing versions before cleanup: \(.version_count)"'
 
       # Each Spack spec is a tagged version in the container package. We keep
@@ -91,8 +92,9 @@ jobs:
         if: always()
         continue-on-error: true
         env:
+          REPO_OWNER: ${{ github.repository_owner }}
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         shell: bash
         run: |
-          gh api /orgs/${{ github.repository_owner }}/packages/container/palace-develop-testing \
+          gh api /orgs/"${REPO_OWNER}"/packages/container/palace-develop-testing \
             --jq '"palace-develop-testing versions after cleanup: \(.version_count)"'