GHA-222 Fix script injection vulnerabilities in create-integration-ticket action (#129)

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: nils-werner-sonarsource

create-integration-ticket/action.yml

@@ -62,17 +62,21 @@ runs:
     - name: Validate inputs and generate ticket summary
       id: validate_inputs
       shell: bash
+      env:
+        INPUT_TICKET_SUMMARY: ${{ inputs.ticket-summary }}
+        INPUT_PLUGIN_NAME: ${{ inputs.plugin-name }}
+        INPUT_RELEASE_VERSION: ${{ inputs.release-version || env.RELEASE_VERSION }}
       run: |
-        if [ -z "${{ inputs.ticket-summary }}" ]; then
-          if [ -z "${{ inputs.plugin-name }}" ] || [ -z "${{ inputs.release-version || env.RELEASE_VERSION }}" ]; then
+        if [ -z "$INPUT_TICKET_SUMMARY" ]; then
+          if [ -z "$INPUT_PLUGIN_NAME" ] || [ -z "$INPUT_RELEASE_VERSION" ]; then
             echo "Error: Either ticket-summary must be provided, or both plugin-name and release-version must be provided."
             exit 1
           fi
-          GENERATED_SUMMARY="Update ${{ inputs.plugin-name }} to ${{ inputs.release-version || env.RELEASE_VERSION }}"
+          GENERATED_SUMMARY="Update $INPUT_PLUGIN_NAME to $INPUT_RELEASE_VERSION"
           echo "Generated ticket summary: $GENERATED_SUMMARY"
           echo "ticket_summary=$GENERATED_SUMMARY" >> $GITHUB_OUTPUT
         else
-          echo "ticket_summary=${{ inputs.ticket-summary }}" >> $GITHUB_OUTPUT
+          echo "ticket_summary=$INPUT_TICKET_SUMMARY" >> $GITHUB_OUTPUT
         fi
 
     - name: Run Python script
@@ -87,11 +91,15 @@ runs:
           ${{ inputs.ticket-description }}${{ inputs.jira-release-url && inputs.ticket-description && '
 
           ' || '' }}${{ inputs.jira-release-url || '' }}
+        INPUT_TARGET_JIRA_PROJECT: ${{ inputs.target-jira-project }}
+        INPUT_RELEASE_TICKET_KEY: ${{ inputs.release-ticket-key }}
+        INPUT_LINK_TYPE: ${{ inputs.link-type }}
+        TICKET_SUMMARY: ${{ steps.validate_inputs.outputs.ticket_summary }}
       run: |
         python ${{ github.action_path }}/create_integration_ticket.py \
-          --ticket-summary "${{ steps.validate_inputs.outputs.ticket_summary }}" \
-          --target-jira-project "${{ inputs.target-jira-project }}" \
-          --release-ticket-key "${{ inputs.release-ticket-key }}" \
+          --ticket-summary "$TICKET_SUMMARY" \
+          --target-jira-project "$INPUT_TARGET_JIRA_PROJECT" \
+          --release-ticket-key "$INPUT_RELEASE_TICKET_KEY" \
           --jira-url="${{ ((inputs.use-jira-sandbox || env.USE_JIRA_SANDBOX) == 'true') && env.JIRA_SANDBOX_URL || env.JIRA_PROD_URL }}" \
-          --link-type "${{ inputs.link-type }}" \
+          --link-type "$INPUT_LINK_TYPE" \
           ${TICKET_DESCRIPTION:+--ticket-description "$TICKET_DESCRIPTION"} >> $GITHUB_OUTPUT