Pass event values through the environment, never into the script

Both run blocks interpolated ${{ }} straight into the shell, which is the
pattern GitHub's script injection guidance warns about: the expression is
expanded before the shell sees it, so the value becomes part of the command
rather than an argument to it. The two values here are a SHA and a number, so
there is nothing to inject today, but the shape is the finding

FIX_SHA and PR_NUMBER now arrive as environment variables and the scripts
quote them, matching what the rest of the repository does

Raised by AppSec against the backport-stack/ci branch, V2265233159

Author: tianyiy-tim

.github/workflows/backport-bot.yml

@@ -59,9 +59,13 @@ jobs:
       - name: Install the AI client
         run: pip3 install --user anthropic boto3
       - name: Work out which branches need the fix
+        # The SHA goes through the environment rather than into the script, so nothing
+        # from the event is expanded by the shell. GitHub's script injection guidance:
+        # https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#good-practices-for-mitigating-script-injection-attacks
+        env:
+          FIX_SHA: ${{ github.event.pull_request.merge_commit_sha }}
         run: |
-          util/backport/backport analyze \
-            --commit "${{ github.event.pull_request.merge_commit_sha }}" --skip
+          util/backport/backport analyze --commit "$FIX_SHA" --skip
       - name: Keep the verdict for the publish job
         uses: actions/upload-artifact@v4
         with:
@@ -92,8 +96,11 @@ jobs:
           name: backport-run
           path: util/backport/.backport-runs
       - name: Cherry-pick and open the pull requests
+        # PR_NUMBER through the environment, not inlined into the script, same as in
+        # analyze above
         env:
           GH_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
         run: |
           # cherry-pick needs an author, and a runner has no git identity
           git config user.name "aws-lc-backport-bot"
@@ -102,5 +109,4 @@ jobs:
           # so the backport branches have nowhere else to go
           util/backport/backport apply --yes
           util/backport/backport publish \
-            --pr "${{ github.event.pull_request.number }}" \
-            --push-to-aws-lc --yes
+            --pr "$PR_NUMBER" --push-to-aws-lc --yes