Move release and tag version into env vars to prevent template injection

[adamtheturtle]

Moves steps.calver.outputs.release and steps.tag_version.outputs.new_tag into environment variables in run/command blocks to prevent template injection, following GitHub's recommended security pattern.

See: https://docs.github.com/en/actions/concepts/security/script-injections

---

Note

Medium Risk
Touches the release pipeline commands used for tagging, packaging, and publishing; while changes are mostly quoting/variable plumbing, mistakes could break releases across multiple targets.

Overview
Hardens the release GitHub Actions workflow by moving dynamic values (e.g., computed release and new_tag, plus modifiedFiles counts) into step env vars and then referencing them inside run/retry command blocks with shell quoting to reduce template/script injection risk.

This update is applied across changelog/version updates, tag checkouts, PyPI install checks, Homebrew formula generation, PyInstaller binary builds, Docker image tagging/build args, and release asset uploads.

Removes the template-injection rule override from zizmor.yml (no longer disabled).

^{Written by Cursor Bugbot for commit 8245c36. This will update automatically on new commits. Configure here.}

[cursor]

Windows steps use Bash env syntax

High Severity

In build-windows, run blocks reference NEW_TAG as $NEW_TAG, but default Windows shell is PowerShell. That syntax reads an undefined PowerShell variable, not the env var from env:. This makes requirements.txt version empty and causes gh release upload to run with an empty tag.

Additional Locations (1)

• .github/workflows/release.yml#L387-L395

 

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 2 total unresolved issues (including 1 from previous review).

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}