Pass free-text workflow inputs through env, not shell interpolation

`inputs.message` (deprecate-npm.yml) and `inputs.version` (release-all.yml)
are free-text workflow_dispatch inputs that were interpolated directly into
run: scripts. Two problems:

- Correctness: a message containing an apostrophe broke the script, since the
  value landed inside single quotes.
- Safety: the value is substituted before bash parses the line, so a crafted
  input could run commands. workflow_dispatch needs write access, so this is
  not remotely exploitable, but it is the pattern GitHub explicitly warns
  against.

Both now arrive as environment variables and are referenced as "$VERSION" /
"$MESSAGE", which bash treats as data.

Boolean and choice inputs are left inline: GitHub constrains those to their
declared values, so they cannot carry arbitrary text.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: maheshvaikri-code

.github/workflows/deprecate-npm.yml

@@ -47,9 +47,13 @@ jobs:
           node-version: '20'
           registry-url: 'https://registry.npmjs.org'
 
+      # Inputs are passed through env rather than interpolated into the script.
+      # `message` is free text: interpolating it directly would let an
+      # apostrophe break the script, and a crafted value run commands.
       - name: Show current state
+        env:
+          PKG: ${{ inputs.package }}
         run: |
-          PKG='${{ inputs.package }}'
           echo "Package:  $PKG"
           echo "Versions: $(npm view "$PKG" versions --json 2>/dev/null | tr -d '\n[] "')"
           CURRENT="$(npm view "$PKG" deprecated 2>/dev/null || true)"
@@ -63,15 +67,17 @@ jobs:
         if: ${{ inputs.dry_run != true }}
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          PKG: ${{ inputs.package }}
+          UNDO: ${{ inputs.undo }}
+          MESSAGE: ${{ inputs.message }}
         run: |
           set -uo pipefail
-          PKG='${{ inputs.package }}'
 
           # An empty message is how npm clears a deprecation.
-          if [ '${{ inputs.undo }}' = 'true' ]; then
+          if [ "$UNDO" = 'true' ]; then
             MSG=''
           else
-            MSG='${{ inputs.message }}'
+            MSG="$MESSAGE"
             if [ -z "$MSG" ]; then
               echo "::error::A message is required unless undo=true"
               exit 1
@@ -80,15 +86,18 @@ jobs:
 
           # @"*" covers every published version, present and future.
           if ! npm deprecate "$PKG@*" "$MSG"; then
-            echo "::error::npm deprecate failed. The NPM_TOKEN must be an automation token \
+            echo "::error::npm deprecate failed. NPM_TOKEN must be an automation token \
           belonging to an account with publish rights on $PKG (a 2FA-required publish token \
           will not work unattended)."
             exit 1
           fi
 
       - name: Verify
+        env:
+          PKG: ${{ inputs.package }}
+          DRY_RUN: ${{ inputs.dry_run }}
+          UNDO: ${{ inputs.undo }}
         run: |
-          PKG='${{ inputs.package }}'
           # npm's CDN can lag a few seconds behind a write.
           sleep 10
           RESULT="$(npm view "$PKG" deprecated 2>/dev/null || true)"
@@ -98,11 +107,11 @@ jobs:
             echo ""
             echo "| Package | Dry run | Deprecation notice |"
             echo "|---|---|---|"
-            echo "| \`$PKG\` | ${{ inputs.dry_run }} | ${RESULT:-（none）} |"
+            echo "| \`$PKG\` | $DRY_RUN | ${RESULT:-(none)} |"
             echo ""
-            if [ "${{ inputs.dry_run }}" = "true" ]; then
+            if [ "$DRY_RUN" = 'true' ]; then
               echo "Dry run — nothing was changed."
-            elif [ '${{ inputs.undo }}' = 'true' ]; then
+            elif [ "$UNDO" = 'true' ]; then
               echo "Deprecation cleared."
             else
               echo "Deprecated. \`npm install $PKG\` now prints the notice."

.github/workflows/release-all.yml

@@ -48,10 +48,14 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
 
+      # `version` is free text, so it goes through env rather than being
+      # interpolated into the script.
       - name: Validate umbrella tag format
+        env:
+          VERSION: ${{ inputs.version }}
         run: |
-          if ! [[ "${{ inputs.version }}" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?$ ]]; then
-            echo "::error::Invalid version format: ${{ inputs.version }} (expected X.Y.Z or X.Y.Z-prerelease)"
+          if ! [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z0-9.]+)?$ ]]; then
+            echo "::error::Invalid version format: $VERSION (expected X.Y.Z or X.Y.Z-prerelease)"
             exit 1
           fi
 
@@ -378,11 +382,13 @@ jobs:
     if: always()
     steps:
       - name: Summary
+        env:
+          VERSION: ${{ inputs.version }}
         run: |
           {
             echo "## Release Summary"
             echo ""
-            echo "**Umbrella tag:** v${{ inputs.version }}"
+            echo "**Umbrella tag:** v$VERSION"
             echo "**Dry run:** ${{ inputs.dry_run }}"
             echo ""
             echo "| Package | Preflight action |"