Pass inputs through env to avoid template injection

zizmor flags inline `${{ inputs.X }}` expansions inside run scripts as
template-injection errors. Reusable workflow inputs come from the
in-repo caller and are trusted, but routing them through env avoids the
class of mistake entirely and silences the audit without per-line
ignores.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.github/actions/make-snapshot/action.yml

@@ -34,11 +34,14 @@ runs:
       shell: bash
     - name: Fetch branches and notes (clone mode)
       if: inputs.srcdir == ''
+      env:
+        SHALLOW_SINCE: ${{ inputs.shallow-since }}
+        FETCH_BRANCH: ${{ inputs.fetch-branch }}
       run: |
         set -x
         cd ruby
-        git fetch --shallow-since='${{ inputs.shallow-since }}'
-        [ -n "${{ inputs.fetch-branch }}" ] && git fetch origin '+${{ inputs.fetch-branch }}:${{ inputs.fetch-branch }}'
+        git fetch --shallow-since="$SHALLOW_SINCE"
+        [ -n "$FETCH_BRANCH" ] && git fetch origin "+$FETCH_BRANCH:$FETCH_BRANCH"
         git fetch origin '+refs/notes/commits:refs/notes/commits'
         git fetch origin '+refs/notes/log-fix:refs/notes/log-fix'
       shell: bash
@@ -50,13 +53,16 @@ runs:
         git fetch origin '+refs/notes/log-fix:refs/notes/log-fix' || :
       shell: bash
     - name: Make snapshot
+      env:
+        SRCDIR: ${{ inputs.srcdir }}
+        GENERATE_TAR_BZ2: ${{ inputs.generate-tar-bz2 }}
+        VERSION: ${{ inputs.version }}
       run: |
-        SRCDIR="${{ inputs.srcdir }}"
         [ -z "$SRCDIR" ] && SRCDIR=ruby
-        if [ -n "${{ inputs.generate-tar-bz2 }}" ]; then
-          ruby "$SRCDIR/tool/make-snapshot" -archname=$archname -srcdir="$SRCDIR" pkg ${{ inputs.version }}
+        if [ -n "$GENERATE_TAR_BZ2" ]; then
+          ruby "$SRCDIR/tool/make-snapshot" -archname=$archname -srcdir="$SRCDIR" pkg $VERSION
         else
-          ruby "$SRCDIR/tool/make-snapshot" -archname=$archname -srcdir="$SRCDIR" -packages=gzip,xz,zip pkg ${{ inputs.version }}
+          ruby "$SRCDIR/tool/make-snapshot" -archname=$archname -srcdir="$SRCDIR" -packages=gzip,xz,zip pkg $VERSION
         fi
       shell: bash
     - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1

.github/workflows/tarball-ubuntu.yml

@@ -236,7 +236,9 @@ jobs:
         run: cd snapshot-*/ && sudo make $JOBS install
         if: matrix.test_task == 'check'
       - name: ruby -v
-        run: ${{ inputs.ruby-bin }} -v
+        env:
+          RUBY_BIN: ${{ inputs.ruby-bin }}
+        run: '"$RUBY_BIN" -v'
         if: matrix.test_task == 'check'
       - name: Show .local
         run: find $HOME/.local -ls

.github/workflows/tarball-windows.yml

@@ -80,11 +80,12 @@ jobs:
         run: |
           set -x
           curl -sSL "${RUBY_PATCH_URL}" -o ruby.patch
-          cd ${{ inputs.archname }}/
+          cd "$ARCHNAME"
           git apply ../ruby.patch
         shell: bash
         env:
           RUBY_PATCH_URL: ${{ inputs.patch-url }}
+          ARCHNAME: ${{ inputs.archname }}
         if: inputs.patch-url != ''
         working-directory:
 
@@ -96,9 +97,11 @@ jobs:
       - name: setup env (modern)
         # %TEMP% is inconsistent with %TMP% and test-all expects they are consistent.
         # https://github.com/actions/virtual-environments/issues/712#issuecomment-613004302
+        env:
+          ARCHNAME: ${{ inputs.archname }}
         run: |
           set > old.env
-          call ..\${{ inputs.archname }}\win32\vssetup.cmd
+          call ..\%ARCHNAME%\win32\vssetup.cmd
           set TMP=%USERPROFILE%\AppData\Local\Temp
           set TEMP=%USERPROFILE%\AppData\Local\Temp
           set /a TEST_JOBS=(15 * %NUMBER_OF_PROCESSORS% / 10) > nul
@@ -133,8 +136,10 @@ jobs:
             if not %%~nI == readline mklink %%~nxI %%I
           )
       - name: Configure
+        env:
+          ARCHNAME: ${{ inputs.archname }}
         run: >-
-          ../${{ inputs.archname }}/win32/configure.bat --disable-install-doc
+          ../%ARCHNAME%/win32/configure.bat --disable-install-doc
           --with-opt-dir=C:/vcpkg/installed/x64-windows
       - run: nmake incs
       - run: nmake extract-extlibs