fix(repo): prevent script injection in release-docker workflow

[kopernic-pl]

Summary

• Fixes 4 high-severity Wiz IaC Scanner alerts (Should we have a special result for handling rules that don't exist? #9–Break out OASv2 JSON schema oddities into separate rules #12) in .github/workflows/release-docker.yml
• Replaces direct ${{ expression }} interpolation inside run: blocks with env: variable bindings, eliminating the shell script injection attack surface
• Affected steps: tag validation (lines 15, 21), ghr publish (line 159), docker push (line 180)

Details

Using ${{ inputs.tag }} directly inside a run: block causes GitHub Actions to string-interpolate the value into the shell script before the shell parses it. A value containing shell metacharacters could execute arbitrary commands. The fix passes all context/input values through env: so the shell receives them as variable bindings rather than as part of the parsed command string.

${{ expression }} usage in with: ref: fields is intentionally left unchanged — those are YAML values passed to actions, not shell scripts, so they are not subject to this vulnerability.

Test plan

• Verify Wiz IaC Scanner alerts Should we have a special result for handling rules that don't exist? #9–Break out OASv2 JSON schema oddities into separate rules #12 are resolved after merge
• Trigger Release Docker Images workflow with a valid tag to confirm the workflow still functions correctly

🤖 Generated with Claude Code