ci: Sanitize workflow inputs (#33073)

.github/workflows/docker-build-push.yml

@@ -62,11 +62,12 @@ jobs:
           N8N_VERSION: ${{ inputs.n8n_version }}
           RELEASE_TYPE: ${{ inputs.release_type }}
           PUSH_ENABLED: ${{ inputs.push_enabled }}
+          GITHUB_REF: ${{ github.ref_name }}
         run: |
           node .github/scripts/docker/docker-config.mjs \
             --event "${{ github.event_name }}" \
             --pr "${{ github.event.pull_request.number }}" \
-            --branch "${{ github.ref_name }}" \
+            --branch "$GITHUB_REF" \
             --version "$N8N_VERSION" \
             --release-type "$RELEASE_TYPE" \
             --push-enabled "$PUSH_ENABLED"
@@ -243,9 +244,11 @@ jobs:
 
       - name: Create Docker Hub manifests
         if: needs.determine-build-context.outputs.push_to_docker == 'true'
+        env:
+          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
         run: |
           VERSION="${{ needs.determine-build-context.outputs.n8n_version }}"
-          DOCKER_BASE="${{ secrets.DOCKER_USERNAME }}"
+          DOCKER_BASE="$DOCKER_USERNAME"
 
           # Create manifests for each image type
           declare -A images=(

.github/workflows/release-publish-new-package.yml

@@ -47,7 +47,9 @@ jobs:
           echo "Package '$PACKAGE_NAME' does not exist on NPM yet. Proceeding with publish."
 
       - name: Configure NPM token
-        run: echo "//registry.npmjs.org/:_authToken=${{ secrets.NPM_DIST_TAG_AND_INITIAL_PUBLISH_TOKEN }}" > ~/.npmrc
+        env:
+          NPM_TOKEN: ${{ secrets.NPM_DIST_TAG_AND_INITIAL_PUBLISH_TOKEN }}
+        run: echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" > ~/.npmrc
 
       - name: Publish package
         working-directory: ${{ github.event.inputs.package-path }}

.github/workflows/release-push-to-channel.yml

@@ -169,6 +169,8 @@ jobs:
     needs: [validate-inputs, release-to-npm, release-to-docker-hub]
     timeout-minutes: 2
     environment: release
+    env:
+      WEBHOOK_PASSWORD: ${{ secrets.N8N_WEBHOOK_DOCS_PASSWORD }}
     steps:
       - continue-on-error: true
-        run: curl --connect-timeout 10 --max-time 30 -u docsWorkflows:${{ secrets.N8N_WEBHOOK_DOCS_PASSWORD }} --request GET 'https://internal.users.n8n.cloud/webhook/update-latest-next'
+        run: curl --connect-timeout 10 --max-time 30 -u "docsWorkflows:$WEBHOOK_PASSWORD" --request GET 'https://internal.users.n8n.cloud/webhook/update-latest-next'

.github/workflows/test-evals-ai.yml

@@ -114,13 +114,14 @@ jobs:
           BRANCH: ${{ inputs.branch || 'master' }}
           SPEC_REPETITIONS: ${{ inputs.spec_repetitions || '1' }}
           SPEC_JUDGES: ${{ inputs.spec_judges || '1' }}
+          GITHUB_REF: ${{ github.ref_name }}
         run: |
           EVENT_NAME="${{ github.event_name }}"
 
           if [ "$EVENT_NAME" = "push" ]; then
             # Merge to master: spec evals use 1 rep, 1 judge
             {
-              echo "branch=${{ github.ref_name }}"
+              echo "branch=$GITHUB_REF"
               echo "spec_repetitions=1"
               echo "spec_judges=1"
               echo "experiment_prefix="

.github/workflows/util-sync-api-docs.yml

@@ -82,11 +82,12 @@ jobs:
         if: steps.verify_file.outputs.file_exists == 'true'
         env:
           GH_TOKEN: ${{ github.token }}
+          GITHUB_REF: ${{ github.ref_name }}
         run: |
           echo "Finding last successful workflow run..."
           LAST_SUCCESS_SHA=$(gh run list \
             --workflow "${{ github.workflow }}" \
-            --branch "${{ github.ref_name }}" \
+            --branch "$GITHUB_REF" \
             --status "success" \
             --json "headSha" \
             --jq '.[0].headSha // empty' \