Update GitHub Actions workflows as per security guidelines

FreeRTOS · Nov 18, 2024 · c1d607a · c1d607a
1 parent 27edcd5
commit c1d607a
Showing 1 changed file with 15 additions and 8 deletions.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -36,15 +36,20 @@ jobs:
           git commit -m 'Update SBOM'
           git push -u origin ${{ github.event.inputs.version_number }}
       - name: Tag Commit and Push to remote
+        env:
+          VERSION_NUMBER: ${{ github.event.inputs.version_number }}
         run: |
-          git tag ${{ github.event.inputs.version_number }} -a -m "coreJSON Library ${{ github.event.inputs.version_number }}"
+          git tag "$VERSION_NUMBER" -a -m "coreJSON Library $VERSION_NUMBER"
           git push origin --tags
       - name: Verify tag on remote
+        env:
+          VERSION_NUMBER: ${{ github.event.inputs.version_number }}
+          COMMIT_ID: ${{ github.event.inputs.commit_id }}
         run: |
-          git tag -d ${{ github.event.inputs.version_number }}
+          git tag -d "$VERSION_NUMBER"
           git remote update
-          git checkout tags/${{ github.event.inputs.version_number }}
-          git diff ${{ github.event.inputs.commit_id }} tags/${{ github.event.inputs.version_number }}
+          git checkout tags/"$VERSION_NUMBER"
+          git diff "$COMMIT_ID" tags/"$VERSION_NUMBER"
   create-zip:
     needs: tag-commit
     name: Create ZIP and verify package for release asset.
@@ -67,13 +72,15 @@ jobs:
           zip -r coreJSON-${{ github.event.inputs.version_number }}.zip coreJSON -x "*.git*"
           ls ./
       - name: Validate created ZIP
+        env:
+          VERSION_NUMBER: ${{ github.event.inputs.version_number }}
         run: |
           mkdir zip-check
-          mv coreJSON-${{ github.event.inputs.version_number }}.zip zip-check
+          mv coreJSON-"$VERSION_NUMBER".zip zip-check
           cd zip-check
-          unzip coreJSON-${{ github.event.inputs.version_number }}.zip -d coreJSON-${{ github.event.inputs.version_number }}
-          ls coreJSON-${{ github.event.inputs.version_number }}
-          diff -r -x "*.git*" coreJSON-${{ github.event.inputs.version_number }}/coreJSON/ ../coreJSON/
+          unzip coreJSON-"$VERSION_NUMBER".zip -d coreJSON-"$VERSION_NUMBER"
+          ls coreJSON-"$VERSION_NUMBER"
+          diff -r -x "*.git*" coreJSON-"$VERSION_NUMBER"/coreJSON/ ../coreJSON/
           cd ../
       - name: Build
         run: |