Harden workflow output handling

plugins/qa-changes/action.yml

@@ -119,6 +119,8 @@ runs:
       env:
         LLM_API_KEY: ${{ inputs.llm-api-key }}
         GITHUB_TOKEN: ${{ inputs.github-token }}
+        GITHUB_EVENT_PULL_REQUEST_TITLE: ${{ github.event.pull_request.title }}
+        INPUTS_LLM_MODEL: ${{ inputs.llm-model }}
       run: |
         if [ -z "$LLM_API_KEY" ]; then
           echo "Error: llm-api-key is required."
@@ -130,9 +132,9 @@ runs:
         fi
 
         echo "PR Number: ${{ github.event.pull_request.number }}"
-        echo "PR Title: ${{ github.event.pull_request.title }}"
+        echo "PR Title: $GITHUB_EVENT_PULL_REQUEST_TITLE"
         echo "Repository: ${{ github.repository }}"
-        echo "LLM model: ${{ inputs.llm-model }}"
+        echo "LLM model: $INPUTS_LLM_MODEL"
 
     - name: Run QA validation
       if: steps.preflight.outputs.skip != 'true'

plugins/release-notes/action.yml

@@ -109,9 +109,10 @@ runs:
           shell: bash
           env:
               GITHUB_TOKEN: ${{ inputs.github-token }}
+              INPUTS_TAG: ${{ inputs.tag }}
           run: |
               if [ -f release_notes.md ]; then
-                echo "Updating release notes for tag ${{ inputs.tag }}"
-                gh release edit "${{ inputs.tag }}" --notes-file release_notes.md || \
+                echo "Updating release notes for tag $INPUTS_TAG"
+                gh release edit "$INPUTS_TAG" --notes-file release_notes.md || \
                   echo "Note: Could not update release. Release may not exist yet."
               fi

plugins/release-notes/workflows/release-notes.yml

@@ -38,11 +38,14 @@ jobs:
 
             - name: Determine tag
               id: get-tag
+              env:
+                GITHUB_EVENT_INPUTS_TAG: ${{ github.event.inputs.tag }}
+                GITHUB_REF_NAME: ${{ github.ref_name }}
               run: |
                   if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-                    echo "tag=${{ github.event.inputs.tag }}" >> $GITHUB_OUTPUT
+                    echo "tag=$GITHUB_EVENT_INPUTS_TAG" >> $GITHUB_OUTPUT
                   else
-                    echo "tag=${{ github.ref_name }}" >> $GITHUB_OUTPUT
+                    echo "tag=$GITHUB_REF_NAME" >> $GITHUB_OUTPUT
                   fi
 
             - name: Generate Release Notes
@@ -57,10 +60,13 @@ jobs:
                   github-token: ${{ secrets.GITHUB_TOKEN }}
 
             - name: Display generated notes
+              env:
+                TAG: ${{ steps.get-tag.outputs.tag }}
+                PREVIOUS_TAG: ${{ steps.release-notes.outputs.previous-tag }}
               run: |
-                  echo "## Release Notes for ${{ steps.get-tag.outputs.tag }}"
+                  echo "## Release Notes for $TAG"
                   echo ""
-                  echo "Previous tag: ${{ steps.release-notes.outputs.previous-tag }}"
+                  echo "Previous tag: $PREVIOUS_TAG"
                   echo "Commits: ${{ steps.release-notes.outputs.commit-count }}"
                   echo "Contributors: ${{ steps.release-notes.outputs.contributor-count }}"
                   echo "New contributors: ${{ steps.release-notes.outputs.new-contributor-count }}"

plugins/vulnerability-remediation/action.yml

@@ -96,6 +96,10 @@ runs:
           env:
               LLM_API_KEY: ${{ inputs.llm-api-key }}
               GITHUB_TOKEN: ${{ inputs.github-token }}
+              INPUTS_EXTENSIONS_VERSION: ${{ inputs.extensions-version }}
+              INPUTS_LLM_MODEL: ${{ inputs.llm-model }}
+              INPUTS_SEVERITY_THRESHOLD: ${{ inputs.severity-threshold }}
+              INPUTS_MAX_VULNERABILITIES: ${{ inputs.max-vulnerabilities }}
           run: |
               if [ -z "$LLM_API_KEY" ]; then
                 echo "Error: llm-api-key is required."
@@ -108,10 +112,10 @@ runs:
               fi
 
               echo "Repository: ${{ github.repository }}"
-              echo "Extensions Version: ${{ inputs.extensions-version }}"
-              echo "LLM Model: ${{ inputs.llm-model }}"
-              echo "Severity Threshold: ${{ inputs.severity-threshold }}"
-              echo "Max Vulnerabilities: ${{ inputs.max-vulnerabilities }}"
+              echo "Extensions Version: $INPUTS_EXTENSIONS_VERSION"
+              echo "LLM Model: $INPUTS_LLM_MODEL"
+              echo "Severity Threshold: $INPUTS_SEVERITY_THRESHOLD"
+              echo "Max Vulnerabilities: $INPUTS_MAX_VULNERABILITIES"
 
         - name: Run vulnerability scan
           id: scan