fix(ci): prevent script injection in GitHub Actions workflows

[aidandaly24]

Description

Hardens our GitHub Actions workflows against script injection (the AppSec/ACAT "Script Injection in GitHub Actions workflows" finding class).

Several run: and actions/github-script steps interpolated GitHub context values directly into the script body via ${{ … }}. Because the Actions runner performs that substitution before the shell/JS sees the line, any attacker-controlled event data lands as executable code. The most sensitive cases here run under pull_request_target (so they execute with repo secrets + a write token against untrusted PR content).

The fix follows GitHub's recommended pattern: bind each expression to an env: variable and reference the shell/JS variable instead. env: assignments are not an injection vector. No behavior changes.

Files & what changed

• pr-ai-review.yml — Determine PR URL / Extract PR number steps now read inputs.pr_url, github.event.pull_request.html_url, github.event_name from env:; both github-script steps read the PR number via process.env.PR_NUMBER.
• e2e-tests.yml — authorization check (github.actor, secrets.AUTHORIZED_USERS), CDK clone branch (inputs.cdk_branch), changed-file detection (github.event.pull_request.base.sha), and both vitest runs (diff-derived *_extra test-file lists) now flow through env:. The *_EXTRA vars are intentionally left unquoted so they still word-split into vitest args.
• pr-tarball.yml — authorization check and the release step's github.event.pull_request.head.sha / github.repository now flow through env:.
• release.yml — Determine release metadata (github.ref_name, github.event.inputs.bump_type) and Verify we have the merged code (needs.*.outputs.base_branch) now flow through env:.

Type of Change

• Bug fix (security hardening)

Testing

These are CI workflow files; changes are mechanical (context → env: var) and preserve existing behavior. Validated by:

• YAML parses cleanly for all four workflows
• Verified no ${{ }} expressions remain inside any run:/script: body across the four files

Checklist

• My changes generate no new warnings
• No source/asset changes (workflow-only), so no snapshot updates needed

[github-actions]

Package Tarball

aws-agentcore-0.21.1.tgz

How to install

gh release download pr-1669-tarball --repo aws/agentcore-cli --pattern "*.tgz" --dir /tmp/pr-tarball
npm install -g /tmp/pr-tarball/aws-agentcore-0.21.1.tgz

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-cli-automation]

Looks good to merge.

The mechanical context → env: translation is applied consistently across all four workflows. Verified that no ${{ … }} expressions remain inside any run: or script: body in the modified files (and the same holds for the other pull_request_target workflows in the repo — codeql.yml, pr-security-review.yml, pr-size.yml, pr-title.yml — so scope is appropriate).

A few details I checked and was happy with:

• e2e-tests.yml unquoted $GA_EXTRA / $HARNESS_EXTRA: the inline comment correctly flags this as intentional. The values are derived from git diff --name-only -- 'e2e-tests/*.test.ts', then funneled through tr '\n' ' ', so word-splitting is the desired behavior. The unquoted form will undergo pathname expansion and word splitting but not command/process substitution, and the step is gated by AUTHORIZED_USERS, so the residual risk (a maintainer-authored test file with shell-meaningful characters in its name) is acceptable.
• pr-ai-review.yml PR URL → number flow: PR_NUM="${PR_URL##*/}" is pure parameter expansion, and the downstream JS only does parseInt(process.env.PR_NUMBER), so untrusted content can't escape.
• release.yml: only workflow_dispatch-triggered, but the env-var pattern is still the right hygiene.

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	38.02%	14088 / 37050
🔵	Statements	37.31%	15003 / 40209
🔵	Functions	32.66%	2423 / 7417
🔵	Branches	31.9%	9374 / 29379

Generated in workflow #3925 for commit a982547 by the Vitest Coverage Report Action