Zizmor: fix violations of "template-injection"

https://docs.zizmor.sh/audits/#template-injection

Closes #232

Author: bblanchon

.github/workflows/build-all.yml

@@ -646,16 +646,16 @@ jobs:
       - name: Define properties
         shell: bash
         run: |
-          VERSION="$VERSION"
           BRANCH="${GITHUB_REF#refs/heads/}"
           COMMIT="${GITHUB_SHA}"
-          RELEASE_NOTES="${{github.server_url}}/${{github.repository}}/releases"
+          RELEASE_NOTES="$RELEASES_URL"
           $RELEASE && RELEASE_NOTES+="/tag/$BRANCH"
           echo "NUSPEC_PROPERTIES=version=$VERSION;branch=$BRANCH;commit=$COMMIT;releaseNotes=$RELEASE_NOTES" >> "$GITHUB_ENV"
         env:
           VERSION: ${{ github.event.inputs.version || '0.0.0.0' }}
           RELEASE: ${{ github.event.inputs.release }}
           BRANCH: ${{ github.event.inputs.branch }}
+          RELEASES_URL: ${{ format('{0}/{1}/releases', github.server_url, github.repository) }}
       - name: Pack
         shell: bash
         run: |
@@ -671,9 +671,9 @@ jobs:
           path: '*.nupkg'
       - name: Push to nuget.org
         if: env.NUGET_API_KEY && startsWith(github.event.inputs.branch, 'chromium/') && github.event.inputs.version && github.event.inputs.nuget == 'true'
-        run: nuget push -Source nuget.org -ApiKey ${{ secrets.NUGET_API_KEY }} *.nupkg
+        run: nuget push -Source nuget.org -ApiKey "$NUGET_API_KEY" *.nupkg
         env:
-          NUGET_API_KEY: ${{ secrets.NUGET_API_KEY  }}
+          NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}
 
   conda:
     name: Conda packages
@@ -817,7 +817,7 @@ jobs:
         continue-on-error: true
         run: |
           CURRENT_REV=$BRANCH
-          PREVIOUS_REV=$(curl --silent "https://api.github.com/repos/${{ github.repository }}/releases/latest" | jq -r ".tag_name")
+          PREVIOUS_REV=$(curl --silent "$LATEST_RELEASE_URL" | jq -r ".tag_name")
           git clone -b "$BRANCH" https://pdfium.googlesource.com/pdfium.git
           cat <<END >> RELEASE.md
           ### Changes
@@ -826,6 +826,7 @@ jobs:
           git -C "pdfium" log origin/${PREVIOUS_REV}.. --pretty=format:'* [%s](https://pdfium.googlesource.com/pdfium/+/%H)' >> RELEASE.md
         env:
           BRANCH: ${{ github.event.inputs.branch }}
+          LATEST_RELEASE_URL: ${{ format('{0}/{1}/releases/latest', github.server_url, github.repository) }}
       - name: Generate artifacts checksums
         id: hash
         run: echo "hashes=$(sha256sum pdfium-*.tgz | base64 -w0)" >> "$GITHUB_OUTPUT"
@@ -835,7 +836,9 @@ jobs:
         with:
           subject-path: pdfium-*.tgz
       - name: Rename provenance file
-        run: mv "${{ steps.provenance.outputs.bundle-path }}" pdfium-attestation.json
+        run: mv "$BUNDLE_PATH" pdfium-attestation.json
+        env:
+          BUNDLE_PATH: ${{ steps.provenance.outputs.bundle-path }}
       - name: Publish Release
         uses: ncipollo/release-action@v1
         with:

.github/workflows/build.yml

@@ -76,8 +76,10 @@ jobs:
           [ "$PDFium_TARGET_OS" != "emscripten" ] && ARTIFACT="$ARTIFACT-$PDFium_TARGET_OS"
           [ "$PDFium_TARGET_ENVIRONMENT" != "" ] && ARTIFACT="$ARTIFACT-$PDFium_TARGET_ENVIRONMENT"
           ARTIFACT="$ARTIFACT-$PDFium_TARGET_CPU"
-          [ "${{inputs.is_debug}}" == "true" ] && ARTIFACT="$ARTIFACT-debug"
+          [ "$IS_DEBUG" == "true" ] && ARTIFACT="$ARTIFACT-debug"
           echo "artifact=$ARTIFACT" >> $GITHUB_OUTPUT
+        env:
+          IS_DEBUG: ${{ inputs.is_debug }}
       - name: Checkout this repo
         uses: actions/checkout@v6
         with:

.github/workflows/patch.yml

@@ -90,10 +90,15 @@ jobs:
         run: |
           {
             echo "## Rejected patches";
-            echo "The following patches for the configuration ${{ matrix.os }} ${{ matrix.cpu }} ${{ matrix.v8 && 'v8' || '' }} ${{ matrix.environment || '' }} were rejected:";
+            echo "The following patches for the configuration $TARGET_OS $TARGET_CPU $ENABLE_V8 $TARGET_ENVIRONMENT were rejected:";
             find pdfium -name '*.rej' -type f \
               -printf '### `%P`\n```patch\n' \
               -exec cat {} \; \
               -printf '```\n' || \
               echo 'No .rej files found';
           } >> $GITHUB_STEP_SUMMARY
+        env:
+          TARGET_OS: ${{ matrix.os }}
+          TARGET_CPU: ${{ matrix.cpu }}
+          ENABLE_V8: ${{ matrix.v8 && 'v8' || '' }}
+          TARGET_ENVIRONMENT: ${{ matrix.environment || '' }}