ci: prevent script injection in workflow run steps

[devin-ai-integration]

Summary

• Remediates the Wiz finding "Workflow should not use untrusted input in a privileged context" on the diff job of the Skill Evals workflow (.github/workflows/eval-skills.yml). ${{ inputs.run_all }} was expanded straight into the run: body of the "Compute changed suites" step, so a dispatch value containing shell metacharacters would execute on a runner in a workflow with contents: write and access to ANTHROPIC_API_KEY / OPENAI_API_KEY. It now goes through a step-level env: block:

+        env:
+          RUN_ALL: ${{ inputs.run_all }}
         run: |
-          if [[ "${{ inputs.run_all }}" == "true" ]]; then
+          if [[ "$RUN_ALL" == "true" ]]; then

• Same hardening applied to two other run-step interpolations of untrusted context in the same repo: github.ref_name in the "Commit refreshed scores and badges" push (git push origin "HEAD:$BRANCH_NAME") and github.event.inputs.version in release.yml (echo "version=$INPUT_VERSION" >> $GITHUB_OUTPUT), which is the more directly exploitable of the two since it writes to GITHUB_OUTPUT.

Testing

• Not applicable
• Manual (describe below)

actionlint reports no new issues on either file (the pre-existing softprops/action-gh-release@v1 runner warning is unchanged). Behavior is identical — the same values are compared/echoed, just read from the environment instead of being pasted into the script text.

Notes

• Companion PRs for the same Wiz rule in other repos: ci: prevent script injection in manual-publish-docs workflow observability-sdk#694 and cpp-sdks (linked separately).

Link to Devin session: https://app.devin.ai/sessions/8c95fd39350c4c5aa16a2dcd1974e09e

---

Note

Overview
Hardens GitHub Actions Skill Evals and Release Skills workflows against shell script injection by routing workflow inputs and context through step-level env instead of embedding ${{ ... }} directly in run: scripts.

In eval-skills.yml, inputs.run_all is read as $RUN_ALL when deciding whether to run all eval suites, and github.ref_name is passed as $BRANCH_NAME for the scheduled/dispatch commit push. In release.yml, manual dispatch version and event name are set via INPUT_VERSION and EVENT_NAME before writing GITHUB_OUTPUT. Runtime behavior is unchanged; only how values reach the shell is safer.

^{Reviewed by Cursor Bugbot for commit 19438ee. Bugbot is set up for automated code reviews on this repo. Configure here.}

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[github-actions]

Skill eval results

Skill	Before	After	Δ
agentcontrol/configs-create	100/100 (4/4)	100/100 (4/4)	no change
agentcontrol/configs-update	80/100 (4/5)	80/100 (4/5)	no change
agentcontrol/configs-variations	80/100 (4/5)	80/100 (4/5)	no change
agentcontrol/tools	75/100 (3/4)	75/100 (3/4)	no change
feature-flags/flag-and-release-change	-	100/100 (4/4)	new
feature-flags/flag-release	-	100/100 (5/5)	new
feature-flags/launchdarkly-flag-command	-	100/100 (3/3)	new
feature-flags/launchdarkly-flag-create	100/100 (3/3)	100/100 (4/4)	no change
feature-flags/launchdarkly-flag-drift	-	100/100 (4/4)	new
feature-flags/should-flag-change	-	94/100 (16/17)	new
onboarding	-	75/100 (3/4)	new

Only suites whose source actually changed since their last recorded score were re-run. Soft-failing while we stabilise the baseline.