fix: prevent script injection in workflow

Author: dgraeber

.github/workflows/generate-module-metadata.yml

@@ -28,8 +28,10 @@ jobs:
         with:
           fetch-depth: 0
       - name: Set Version ➕
+        env:
+          INPUT_VERSION: ${{ github.event.inputs.version }}
         run: |
-          if [ -z ${{ github.event.inputs.version }} ]; then echo "RELEASE_VERSION=${GITHUB_REF#refs/*/}" >> $GITHUB_ENV; else echo "RELEASE_VERSION=${{ github.event.inputs.version }}" >> $GITHUB_ENV; fi
+          if [ -z "${INPUT_VERSION}" ]; then echo "RELEASE_VERSION=${GITHUB_REF#refs/*/}" >> "$GITHUB_ENV"; else echo "RELEASE_VERSION=${INPUT_VERSION}" >> "$GITHUB_ENV"; fi
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v5
         with:
@@ -41,7 +43,10 @@ jobs:
           role-session-name: GitHub_to_AWS_via_FederatedOIDC
           aws-region: us-west-2
       - name: Generate Metadata
+        env:
+          REPO_NAME: ${{ github.event.repository.name }}
+          BUCKET_NAME: ${{ secrets.BUCKET_NAME }}
         run: |
           python -m pip install --upgrade pip
           pip install argparse boto3
-          python scripts/generate-module-metadata.py -v ${RELEASE_VERSION} -n ${{ github.event.repository.name }} -b ${{ secrets.BUCKET_NAME }}
+          python scripts/generate-module-metadata.py -v "${RELEASE_VERSION}" -n "${REPO_NAME}" -b "${BUCKET_NAME}"