Harden release workflow shell inputs (#86)

Pass resolved and verified release tags to shell steps through step-scoped environment variables instead of interpolating GitHub expressions directly into generated shell source.

This addresses the two reproducible template-injection findings in the release workflow while retaining existing shell quoting. Release behavior, permissions, trusted-publishing provenance, server compatibility, MSRV, dependencies, and public APIs are unchanged.

Record the workflow hardening in the Unreleased security changelog.

Author: terjekv

.github/workflows/release.yml

@@ -56,7 +56,9 @@ jobs:
           fi
 
       - name: Check Release Metadata
-        run: ./scripts/check-release.sh "${{ steps.release.outputs.release_tag }}"
+        run: ./scripts/check-release.sh "${RELEASE_TAG}"
+        env:
+          RELEASE_TAG: ${{ steps.release.outputs.release_tag }}
 
       - name: List hubuum_client Package Contents
         run: cargo package --list -p hubuum_client
@@ -158,9 +160,10 @@ jobs:
 
       - name: Create or Update GitHub Release
         if: github.event_name == 'push'
-        run: ./scripts/publish-github-release.sh "${{ needs.verify.outputs.release_tag }}" --latest
+        run: ./scripts/publish-github-release.sh "${RELEASE_TAG}" --latest
         env:
           GH_TOKEN: ${{ github.token }}
+          RELEASE_TAG: ${{ needs.verify.outputs.release_tag }}
 
       - name: Create or Update Stable GitHub Releases
         if: github.event_name == 'workflow_dispatch'

CHANGELOG.md

@@ -42,6 +42,8 @@ The format is based on Keep a Changelog, and this project aims to follow Semanti
 
 ### Security
 
+- Pass release tags to workflow shell steps through environment variables instead
+  of interpolating expressions into generated shell commands.
 - Update `h2` to 0.4.19 (including the fix released in 0.4.16) to address
   RUSTSEC-2026-0258, which could allow an
   HTTP/2 peer to cause unbounded processing of empty DATA frames.