From 2cb747ad7ce4ef7bc2ac5ac0d4b3864d92babd6a Mon Sep 17 00:00:00 2001
From: Hafiar <289389248+0xABCD01@users.noreply.github.com>
Date: Sun, 1 Nov 2026 11:35:09 +0000
Subject: [PATCH] Pass workflow values via env in release workflows

Move the remaining expression values that were interpolated directly into run: scripts (inputs.tag, github.repository, step outputs, repository owner/name) into env: variables, matching the pattern already used elsewhere in these workflows and GitHub's script-injection guidance. Behavior is unchanged.

Fixes https://github.com/WordPress/sqlite-database-integration/issues/602
---
 .github/workflows/release-publish.yml |  7 +++++--
 .github/workflows/release-wporg.yml   | 11 ++++++++---
 2 files changed, 13 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/release-publish.yml b/.github/workflows/release-publish.yml
index 1a43e068e..b8cdabae6 100644
--- a/.github/workflows/release-publish.yml
+++ b/.github/workflows/release-publish.yml
@@ -84,6 +84,8 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           CHANGELOG: ${{ steps.changelog.outputs.body }}
+          REPO_OWNER: ${{ github.repository_owner }}
+          REPO_NAME: ${{ github.event.repository.name }}
         run: |
           # Extract PR numbers from changelog links like [#123](...).
           # A changelog without matching links has no contributors to fetch.
@@ -92,7 +94,7 @@ jobs:
           CONTRIBUTORS=""
           if [ -n "$PR_NUMBERS" ]; then
             # Build a single GraphQL query to fetch all PR authors.
-            QUERY='{ repository(owner: "${{ github.repository_owner }}", name: "${{ github.event.repository.name }}") {'
+            QUERY="{ repository(owner: \"$REPO_OWNER\", name: \"$REPO_NAME\") {"
             while IFS= read -r PR; do
               [ -n "$PR" ] && QUERY="$QUERY pr$PR: pullRequest(number: $PR) { author { login } }"
             done <<< "$PR_NUMBERS"
@@ -110,9 +112,10 @@ jobs:
           MERGE_SHA: ${{ github.event.pull_request.merge_commit_sha }}
           BODY: ${{ steps.changelog.outputs.body }}
           CONTRIBUTORS: ${{ steps.contributors.outputs.list }}
+          PRERELEASE: ${{ steps.version.outputs.prerelease }}
         run: |
           PRERELEASE_FLAG=""
-          if [[ "${{ steps.version.outputs.prerelease }}" == "true" ]]; then
+          if [[ "$PRERELEASE" == "true" ]]; then
             PRERELEASE_FLAG="--prerelease"
           fi
 
diff --git a/.github/workflows/release-wporg.yml b/.github/workflows/release-wporg.yml
index a44ee372d..ed9f7b169 100644
--- a/.github/workflows/release-wporg.yml
+++ b/.github/workflows/release-wporg.yml
@@ -39,8 +39,10 @@ jobs:
 
       - name: Resolve tag
         id: resolve
+        env:
+          INPUT_TAG: ${{ inputs.tag }}
         run: |
-          TAG="${{ inputs.tag }}"
+          TAG="$INPUT_TAG"
           # Ensure the tag has a "v" prefix.
           [[ "$TAG" == v* ]] || TAG="v$TAG"
           echo "tag=$TAG" >> $GITHUB_OUTPUT
@@ -50,16 +52,19 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TAG: ${{ steps.resolve.outputs.tag }}
+          REPO: ${{ github.repository }}
         run: |
           gh release download "$TAG" \
-            --repo "${{ github.repository }}" \
+            --repo "$REPO" \
             --pattern "plugin-sqlite-database-integration.zip" \
             --dir .
           unzip plugin-sqlite-database-integration.zip
 
       - name: Verify release metadata
+        env:
+          VERSION: ${{ steps.resolve.outputs.version }}
         run: |
-          bash bin/verify-release-metadata.sh plugin-sqlite-database-integration "${{ steps.resolve.outputs.version }}"
+          bash bin/verify-release-metadata.sh plugin-sqlite-database-integration "$VERSION"
 
       - name: Deploy to WordPress.org
         uses: 10up/action-wordpress-plugin-deploy@2.3.0