Harden validation-run against branch-name script injection

[arpitjain099]

Jira ticket

External contribution, no DIGITAL ticket. Happy to file one if the team prefers to track it.

Purpose

.github/workflows/validation-run.yml passes github.head_ref, github.base_ref, and the extracted branch output into the RoboValidate steps by interpolating ${{ }} directly into the run: script, for example:

ROBO_VALIDATE_BRANCH_NAME=${{ steps.extract_branch.outputs.branch }} ROBO_VALIDATE_TARGET_BRANCH="${{ github.base_ref }}" ROBO_VALIDATE_CURRENT_BRANCH="${{ github.head_ref }}" vendor/bin/robo validate:all

The runner substitutes those expressions into the shell command before bash runs, and the branch name on a pull request is contributor-controlled. A branch named with shell metacharacters could therefore execute arbitrary commands in the validation job. The extract_branch output is derived from the head ref, so it carries the same risk.

This change binds each of those values to step env: entries and references them as quoted shell variables ("$CURRENT_BRANCH"). Environment variables are not re-parsed by the shell, which closes the injection path. This is the mitigation in GitHub's security-hardening guidance: https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#understanding-the-risk-of-script-injections

The same pattern is what CodeQL (actions/expression-injection) and zizmor report on these lines.

Deployment and testing

No behavior change. The robo validate:all invocations receive the same ROBO_VALIDATE_* values as before, just sourced from the step environment instead of inlined into the script. YAML parses cleanly.

Checklist for the Developer

• No merge conflicts exist with the target branch.
• Commit is signed (per CONTRIBUTING git configuration requirement).