tools: avoid workflow shell interpolation

Pass input, output, and version values through environment variables
instead of expanding them into shell source. Split benchmark
categories and PR numbers into arrays to retain separate arguments.

Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: #66013
Reviewed-By: Antoine du Hamel <duhamelantoine1995@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Xuguang Mei <meixuguang@gmail.com>
Reviewed-By: Ulises Gascón <ulisesgascongonzalez@gmail.com>

Author: panva

.github/workflows/auto-start-ci.yml

@@ -72,7 +72,9 @@ jobs:
 
       - name: Start the CI
         run: |
+          read -r -a numbers <<< "$PULL_REQUESTS"
           curl -fsSL "https://github.com/${GITHUB_REPOSITORY}/raw/${GITHUB_SHA}/tools/actions/start-ci.sh" \
-          | sh -s -- ${{ needs.get-prs-for-ci.outputs.numbers }}
+          | sh -s -- "${numbers[@]}"
         env:
           GH_TOKEN: ${{ github.token }}
+          PULL_REQUESTS: ${{ needs.get-prs-for-ci.outputs.numbers }}

.github/workflows/benchmark.yml

@@ -47,7 +47,9 @@ jobs:
     steps:
       - name: Mark token input as sensitive
         if: inputs.token != ''
-        run: echo "::add-mask::${{ inputs.token }}"
+        run: printf '::add-mask::%s\n' "$COMMENT_TOKEN"
+        env:
+          COMMENT_TOKEN: ${{ inputs.token }}
       - name: Add link to the current run
         id: comment
         run: |
@@ -155,19 +157,20 @@ jobs:
         run: |
           nix-shell \
             -I nixpkgs=./tools/nix/pkgs.nix \
-            --pure --keep FILTER --keep LC_ALL --keep LANG \
+            --pure --keep CATEGORIES --keep FILTER --keep RUNS --keep LC_ALL --keep LANG \
             --arg loadJSBuiltinsDynamically false \
             --arg ccache 'null' \
             --arg icu 'null' \
             --arg sharedLibDeps '{}' \
             --arg devTools '[]' \
             --run '
                 set -o pipefail
+                read -r -a categories <<< "$CATEGORIES"
                 ./base_node benchmark/compare.js \
                   --filter "$FILTER" \
-                  --runs ${{ inputs.runs }} \
+                  --runs "$RUNS" \
                   --old ./base_node --new ./node \
-                  -- ${{ inputs.category }} \
+                  -- "${categories[@]}" \
                 | tee /dev/stderr \
                 > ${{ matrix.system }}.csv
                 echo "> [!WARNING] "
@@ -185,7 +188,9 @@ jobs:
                 echo "> using a dedicated machine, e.g. Jenkins CI."
             ' | tee /dev/stderr >> "$GITHUB_STEP_SUMMARY"
         env:
+          CATEGORIES: ${{ inputs.category }}
           FILTER: ${{ inputs.filter }}
+          RUNS: ${{ inputs.runs }}
 
       - name: Upload raw benchmark results
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
@@ -246,7 +251,9 @@ jobs:
             ' | tee /dev/stderr ${{ inputs.post-comment && 'body.txt' || '' }} >> "$GITHUB_STEP_SUMMARY"
       - name: Mark token input as sensitive
         if: inputs.token != ''
-        run: echo "::add-mask::${{ inputs.token }}"
+        run: printf '::add-mask::%s\n' "$COMMENT_TOKEN"
+        env:
+          COMMENT_TOKEN: ${{ inputs.token }}
       - name: Edit comment
         if: inputs.post-comment
         run: |

.github/workflows/commit-queue.yml

@@ -196,6 +196,8 @@ jobs:
           git config --local user.email "github-bot@iojs.org"
           git config --local user.name "Node.js GitHub Bot"
           ncu-config set token "$GH_TOKEN"
-          ./tools/actions/commit-queue.sh ${{ steps.get_mergeable_prs.outputs.numbers }}
+          read -r -a numbers <<< "$PULL_REQUESTS"
+          ./tools/actions/commit-queue.sh "${numbers[@]}"
         env:
           GH_TOKEN: ${{ secrets.GH_USER_TOKEN }}
+          PULL_REQUESTS: ${{ steps.get_mergeable_prs.outputs.numbers }}

.github/workflows/daily-wpt-fyi.yml

@@ -122,7 +122,9 @@ jobs:
       - name: Clone report for upload
         if: ${{ env.WPT_REPORT != '' }}
         working-directory: out/wpt
-        run: cp wptreport.json wptreport-${{ steps.setup-node.outputs.node-version }}.json
+        run: cp wptreport.json "wptreport-$NODE_VERSION.json"
+        env:
+          NODE_VERSION: ${{ steps.setup-node.outputs.node-version }}
       - name: Upload GitHub Actions artifact
         if: ${{ env.WPT_REPORT != '' }}
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
@@ -133,12 +135,13 @@ jobs:
       - name: Upload WPT Report to wpt.fyi API
         if: ${{ env.WPT_REPORT != '' }}
         env:
+          NODE_VERSION: ${{ steps.setup-node.outputs.node-version }}
           WPT_FYI_USERNAME: ${{ vars.WPT_FYI_USERNAME }}
           WPT_FYI_PASSWORD: ${{ secrets.WPT_FYI_PASSWORD }}
         working-directory: out/wpt
         run: |
           gzip wptreport.json
-          echo "## Node.js ${{ steps.setup-node.outputs.node-version }}" >> $GITHUB_STEP_SUMMARY
+          echo "## Node.js $NODE_VERSION" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
           echo "WPT Revision: [\`${WPT_REVISION:0:7}\`](https://github.com/web-platform-tests/wpt/commits/$WPT_REVISION)" >> $GITHUB_STEP_SUMMARY
           for WPT_FYI_ENDPOINT in "https://wpt.fyi/api/results/upload" "https://staging.wpt.fyi/api/results/upload"

.github/workflows/timezone-update.yml

@@ -40,14 +40,14 @@ jobs:
 
       - name: Compare versions
         run: |
-          echo "Comparing current version ${{ env.current_version }} to new version ${{ env.new_version }}"
+          echo "Comparing current version $current_version to new version $new_version"
 
       - run: ./tools/dep_updaters/update-timezone.mjs
         if: ${{ env.new_version != env.current_version }}
 
       - name: Update the expected timezone version in test
         if: ${{ env.new_version != env.current_version }}
-        run: echo "${{ env.new_version }}" > test/fixtures/tz-version.txt
+        run: printf '%s\n' "$new_version" > test/fixtures/tz-version.txt
 
       - name: Open Pull Request
         if: ${{ env.new_version != env.current_version }}

.github/workflows/tools.yml

@@ -329,7 +329,7 @@ jobs:
       - name: Generate commit message if not set
         if: env.COMMIT_MSG == '' && (github.event_name == 'schedule' || inputs.id == 'all' || inputs.id == matrix.id)
         run: |
-          echo "COMMIT_MSG=${{ matrix.subsystem }}: update ${{ matrix.id }} to ${{ env.NEW_VERSION }}" >> "$GITHUB_ENV"
+          echo "COMMIT_MSG=${{ matrix.subsystem }}: update ${{ matrix.id }} to $NEW_VERSION" >> "$GITHUB_ENV"
       - uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1  # v8.1.1
         if: github.event_name == 'schedule' || inputs.id == 'all' || inputs.id == matrix.id
         # Creates a PR or update the Action's existing PR, or