ci: pass matrix values to shell scripts through the environment

zizmor's `pedantic` persona reports six `template-injection`
findings, where `${{ matrix.project }}` and `${{ matrix.backend }}` are
expanded directly into `run:` scripts: three steps of the `test` job
in `dependencies.yml`, and the test step in `downstream.yml`.

These values are constants defined in the workflows' own matrices, so
nothing here is attacker-controllable. But template expansion inserts
text into the script before the shell parses it, so quotation marks
around a `${{ }}` expression do not neutralize quotation marks or
other shell syntax inside its value. A shell expansion of an
environment variable is not reparsed that way, so when it is double
quoted it is always a single word. Changing the style is also
preferable to turning off or suppressing the diagnostic, which would
then no longer catch an expansion that does carry untrusted data.

Pass each value through an environment variable named for its matrix
key in upper case (`PROJECT`, `BACKEND`), and expand it double quoted,
since neither word splitting nor pathname expansion is intended. Scope
each variable by how many steps use it: a value used by more than one
step goes in a job-level `env:` just before `steps:`, and a value used
by one step goes in that step's `env:`, just before `run:`. So
`PROJECT` is set for the whole `test` job in `dependencies.yml`, where
three steps use it, while `PROJECT` and `BACKEND` are set only for the
one step in `downstream.yml` that uses them. These are the naming,
quoting, and scoping conventions gitoxide adopted for the same
diagnostic.

The commands receive the same arguments as before. No file in this
repository reads `PROJECT` or `BACKEND`. `test/downstream/run.py`
passes most of its environment through to the downstream projects'
test suites, so they will also see these two variables, along with
the other variables already set in CI.

zizmor 1.31.1 at the `pedantic` level no longer reports any
`template-injection` findings. The only remaining finding is the
known `unpinned-images` finding for `alpine:latest`. `actionlint`
reports no problems with either workflow.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: EliahKagan

.github/workflows/dependencies.yml

@@ -24,6 +24,9 @@ jobs:
         - python-version: "3.9"
           os: ubuntu-24.04
 
+    env:
+      PROJECT: ${{ matrix.project }}
+
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
@@ -37,12 +40,12 @@ jobs:
       run: |
         python -m pip install --upgrade pip
         python -m pip install pytest flake8 ./smmap
-        if test "${{ matrix.project }}" = gitdb; then python -m pip install ./gitdb; fi
+        if test "$PROJECT" = gitdb; then python -m pip install ./gitdb; fi
     - name: Lint
-      run: flake8 "${{ matrix.project }}/${{ matrix.project }}" --count --select=E9,F63,F7,F82 --show-source --statistics
+      run: flake8 "$PROJECT/$PROJECT" --count --select=E9,F63,F7,F82 --show-source --statistics
     - name: Test
       run: |
-        if test "${{ matrix.project }}" = gitdb; then
+        if test "$PROJECT" = gitdb; then
           GITDB_TEST_GIT_REPO_BASE="$(git rev-parse --git-common-dir)" pytest -o addopts= -v gitdb/gitdb/test
         else
           pytest -o addopts= -v smmap/smmap/test

.github/workflows/downstream.yml

@@ -48,4 +48,7 @@ jobs:
           version: '0.12.13'
           enable-cache: false
       - name: Test latest release against this checkout
-        run: uv run test/downstream/run.py "${{ matrix.project }}" --backend "${{ matrix.backend }}"
+        env:
+          PROJECT: ${{ matrix.project }}
+          BACKEND: ${{ matrix.backend }}
+        run: uv run test/downstream/run.py "$PROJECT" --backend "$BACKEND"