fix: prevent template injection in run: steps (VULN-1652)

[thomasrockhu-codecov]

Summary

Fixes the template injection vulnerability.

Three run: steps in action.yml were directly interpolating ${{ inputs.xxx }} template expressions inside shell scripts. Because GitHub Actions resolves these expressions before the shell sees the script, a consumer workflow that passes user-controlled data into skip_validation, use_oidc, or token could achieve arbitrary command execution on the runner.

Changes

Step	Vulnerable expression	Fix
Check system dependencies	"${{ inputs.skip_validation }}" in if condition	Moved to env: INPUT_SKIP_VALIDATION, referenced as $INPUT_SKIP_VALIDATION
Get and set token	"${{ inputs.use_oidc }}" in if condition	Moved to env: INPUT_USE_OIDC, referenced as $INPUT_USE_OIDC
Get and set token	"${{ inputs.token }}" in if condition and command substitution	Moved to env: INPUT_TOKEN, referenced as $INPUT_TOKEN
Get and set token	"${{ env.CODECOV_TOKEN }}" in elif condition and echo	Moved to env: INPUT_CODECOV_TOKEN, referenced as $INPUT_CODECOV_TOKEN

The env-var indirection pattern is already used consistently in other steps in this file (e.g., the "Set fork" and "Override branch for forks" steps). This change makes the three affected steps consistent with that existing safe pattern.

[linear]

VULN-1652

[sentry]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.14%. Comparing base (57e3a13) to head (8bf0238).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1947   +/-   ##
=======================================
  Coverage   97.14%   97.14%           
=======================================
  Files           2        2           
  Lines          35       35           
=======================================
  Hits           34       34           
  Misses          1        1           

Flag	Coverage Δ
demo-macos-latest	97.14% <ø> (ø)
demo-macos-latest-xlarge	97.14% <ø> (?)
demo-ubuntu-latest	97.14% <ø> (ø)
demo-windows-latest	97.14% <ø> (ø)
script-	97.14% <ø> (?)
script-macos-latest	97.14% <ø> (ø)
script-macos-latest-xlarge	97.14% <ø> (?)
script-ubuntu-latest	97.14% <ø> (ø)
script-windows-latest	97.14% <ø> (ø)
version-macos-latest	97.14% <ø> (ø)
version-maxos-latest-xlarge	97.14% <ø> (?)
version-ubuntu-latest	97.14% <ø> (ø)
version-windows-latest	97.14% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[mpkorstanje]

If you haven't considered it already, I would recommend using https://docs.zizmor.sh/ to scan your Github actions