Prevent script injection in GitHub Actions workflows (#2355)

* fix(ci): Prevent script injection in GitHub Actions workflows

---------

Co-authored-by: Shubham Chaturvedi <scchatur@amazon.com>

Author: ShubhamChaturvedi7

.github/workflows/go-release.yml

@@ -68,10 +68,17 @@ jobs:
 
       - name: Get release directory name
         id: release-dir
+        env:
+          PROJECT_NAME: ${{ github.event.inputs.project-name }}
+          VERSION: ${{ github.event.inputs.version }}
         run: |
           chmod +x ./submodules/MaterialProviders/scripts/go-release-automation.sh
-          RELEASE_DIR_NAME=$(./submodules/MaterialProviders/scripts/go-release-automation.sh get_release_dir_name "${{ github.event.inputs.project-name }}" "${{ github.event.inputs.version }}")
-          echo "releaseDirName=$RELEASE_DIR_NAME" >> $GITHUB_OUTPUT
+          RELEASE_DIR_NAME=$(./submodules/MaterialProviders/scripts/go-release-automation.sh get_release_dir_name "$PROJECT_NAME" "$VERSION")
+          {
+            echo "releaseDirName<<__GH_OUTPUT_EOF__"
+            echo "$RELEASE_DIR_NAME"
+            echo "__GH_OUTPUT_EOF__"
+          } >> "$GITHUB_OUTPUT"
 
       - name: Generate a changelog
         uses: orhun/git-cliff-action@v4
@@ -80,13 +87,17 @@ jobs:
           args: --bump -u --prepend releases/go/${{ steps.release-dir.outputs.releaseDirName }}/CHANGELOG.md
 
       - name: Run Go release automation script
+        env:
+          PROJECT_NAME: ${{ github.event.inputs.project-name }}
+          VERSION: ${{ github.event.inputs.version }}
         run: |
           chmod +x ./submodules/MaterialProviders/scripts/go-release-automation.sh
-          ./submodules/MaterialProviders/scripts/go-release-automation.sh run_release_script ${{ github.event.inputs.project-name }} ${{ github.event.inputs.version }}
+          ./submodules/MaterialProviders/scripts/go-release-automation.sh run_release_script "$PROJECT_NAME" "$VERSION"
 
       - name: print diff between development and release directory
+        env:
+          PROJECT_NAME: ${{ github.event.inputs.project-name }}
+          RELEASE_DIR_NAME: ${{ steps.release-dir.outputs.releaseDirName }}
         run: |
-          RELEASE_DIR_NAME="${{ steps.release-dir.outputs.releaseDirName }}"
-          PROJECT_NAME="${{ github.event.inputs.project-name }}"
-          DIFF_FILES=$(diff -qr $PROJECT_NAME/runtimes/go/ImplementationFromDafny-go releases/go/$RELEASE_DIR_NAME || true)
-          echo $DIFF_FILES
+          DIFF_FILES=$(diff -qr "$PROJECT_NAME/runtimes/go/ImplementationFromDafny-go" "releases/go/$RELEASE_DIR_NAME" || true)
+          echo "$DIFF_FILES"

.github/workflows/smithy-diff.yml

@@ -33,9 +33,14 @@ jobs:
           PR_NUMBER: ${{ github.event.pull_request.number }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           FILES: ${{ steps.file-changes.outputs.FILES }}
+          PR_USER: ${{ github.event.pull_request.user.login }}
+          ACTOR: ${{ github.actor }}
+          REPO: ${{ github.repository }}
         if: ${{env.FILES != ''}}
         run: |
           # If https://github.com/smithy-lang/smithy-dafny/issues/491 is resolved, remove comment about this issue.
-          COMMENT="@${{github.event.pull_request.user.login}} and @${{github.actor}}, I noticed you are updating the smithy model files.\nDoes this update need new or updated javadoc trait documentation?\n Are you adding constraints inside list, map or union? Do you know about this issue: https://github.com/smithy-lang/smithy-dafny/issues/491?"
-          COMMENT_URL="https://api.github.com/repos/${{ github.repository }}/issues/${PR_NUMBER}/comments"
-          curl -s -H "Authorization: token ${GITHUB_TOKEN}" -X POST $COMMENT_URL -d "{\"body\":\"$COMMENT\"}"
+          COMMENT="@${PR_USER} and @${ACTOR}, I noticed you are updating the smithy model files.
+          Does this update need new or updated javadoc trait documentation?
+          Are you adding constraints inside list, map or union? Do you know about this issue: https://github.com/smithy-lang/smithy-dafny/issues/491?"
+          COMMENT_URL="https://api.github.com/repos/${REPO}/issues/${PR_NUMBER}/comments"
+          curl -s -H "Authorization: token ${GITHUB_TOKEN}" -X POST "$COMMENT_URL" -d "$(jq -nc --arg body "$COMMENT" '{body: $body}')"

DynamoDbEncryption/runtimes/rust/Cargo.toml

@@ -17,7 +17,7 @@ readme = "README.md"
 [dependencies]
 aws-config = "1.8.12"
 aws-lc-rs = {version = "1.17.0"}
-aws-lc-sys = { version = "0.42", optional = true }
+aws-lc-sys = { version = "0.43", optional = true }
 aws-lc-fips-sys = { version = "0.13.1", optional = true }
 aws-sdk-dynamodb = "1.103.0"
 aws-sdk-kms = "1.98.0"