ci: prevent script injection in workflow run steps

[devin-ai-integration]

Summary

• Remediates the Wiz finding "Workflow should not use untrusted input in a privileged context" on the diff job of the Skill Evals workflow (.github/workflows/eval-skills.yml). ${{ inputs.run_all }} was expanded straight into the run: body of the "Compute changed suites" step, so a dispatch value containing shell metacharacters would execute on a runner in a workflow with contents: write and access to ANTHROPIC_API_KEY / OPENAI_API_KEY. It now goes through a step-level env: block:

+        env:
+          RUN_ALL: ${{ inputs.run_all }}
         run: |
-          if [[ "${{ inputs.run_all }}" == "true" ]]; then
+          if [[ "$RUN_ALL" == "true" ]]; then

• Same hardening applied to two other run-step interpolations of untrusted context in the same repo: github.ref_name in the "Commit refreshed scores and badges" push (git push origin "HEAD:$BRANCH_NAME") and github.event.inputs.version in release.yml (echo "version=$INPUT_VERSION" >> $GITHUB_OUTPUT), which is the more directly exploitable of the two since it writes to GITHUB_OUTPUT.

Testing

• Not applicable
• Manual (describe below)

actionlint reports no new issues on either file (the pre-existing softprops/action-gh-release@v1 runner warning is unchanged). Behavior is identical — the same values are compared/echoed, just read from the environment instead of being pasted into the script text.

Notes

• Companion PRs for the same Wiz rule in other repos: ci: prevent script injection in manual-publish-docs workflow observability-sdk#694 and cpp-sdks (linked separately).

Link to Devin session: https://app.devin.ai/sessions/8c95fd39350c4c5aa16a2dcd1974e09e

---

Note

Low Risk
CI workflow-only changes with equivalent logic; no application, auth, or data-path changes.

Overview
Hardens GitHub Actions run scripts so untrusted workflow context is not expanded directly into shell, addressing Wiz “untrusted input in a privileged context” findings.

In Skill Evals (eval-skills.yml), inputs.run_all is passed via RUN_ALL env and compared as "$RUN_ALL" instead of embedding ${{ inputs.run_all }} in the script. The scheduled/dispatch commit and push step reads github.ref_name from BRANCH_NAME for git push instead of interpolating it into the command line.

In Release Skills (release.yml), manual dispatch version selection uses EVENT_NAME and INPUT_VERSION from env when writing to GITHUB_OUTPUT, instead of inlining github.event_name and github.event.inputs.version in the script (the dispatch path is the more sensitive case because it feeds step outputs).

Runtime behavior is unchanged; only how values reach the shell changes.

^{Reviewed by Cursor Bugbot for commit 59c97ca. Bugbot is set up for automated code reviews on this repo. Configure here.}

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[github-actions]

Skill eval results

Skill	Before	After	Δ
agentcontrol/configs-create	100/100 (4/4)	100/100 (4/4)	no change
agentcontrol/configs-update	80/100 (4/5)	80/100 (4/5)	no change
agentcontrol/configs-variations	80/100 (4/5)	80/100 (4/5)	no change
agentcontrol/tools	75/100 (3/4)	75/100 (3/4)	no change
feature-flags/flag-and-release-change	-	100/100 (4/4)	new
feature-flags/flag-release	-	80/100 (4/5)	new
feature-flags/launchdarkly-flag-command	-	100/100 (3/3)	new
feature-flags/launchdarkly-flag-create	100/100 (3/3)	100/100 (4/4)	no change
feature-flags/launchdarkly-flag-drift	-	100/100 (4/4)	new
feature-flags/should-flag-change	-	100/100 (10/10)	new

Only suites whose source actually changed since their last recorded score were re-run. Soft-failing while we stabilise the baseline.