From fa08175d2c4a5c563c0b1b78246643decb711981 Mon Sep 17 00:00:00 2001
From: Stephen Crowe <6042774+crowecawcaw@users.noreply.github.com>
Date: Mon, 6 Jul 2026 19:43:18 -0700
Subject: [PATCH] fix: pass GitHub event context via env vars in reusable
 workflow

Move github.event.* interpolations (pull_request.number, event.action)
out of the inline run: script and into an env: block so they are
referenced as shell variables rather than templated into script text.

These values are GitHub-controlled and structurally constrained, so this
is a defense-in-depth cleanup that also keeps CI/scanner patterns happy.

Signed-off-by: Stephen Crowe <6042774+crowecawcaw@users.noreply.github.com>
---
 .github/workflows/reusable_record_pr_details.yml | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/reusable_record_pr_details.yml b/.github/workflows/reusable_record_pr_details.yml
index f9eeb0b..a3630f2 100644
--- a/.github/workflows/reusable_record_pr_details.yml
+++ b/.github/workflows/reusable_record_pr_details.yml
@@ -15,10 +15,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Create PR info artifact
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          PR_ACTION: ${{ github.event.action }}
         run: |
           mkdir -p ./pr-info
-          echo "${{ github.event.pull_request.number }}" > ./pr-info/pr-number.txt
-          echo "${{ github.event.action }}" > ./pr-info/pr-action.txt
+          echo "$PR_NUMBER" > ./pr-info/pr-number.txt
+          echo "$PR_ACTION" > ./pr-info/pr-action.txt
       
       - name: Upload PR info artifact
         uses: actions/upload-artifact@v4