Summary

Eliminate every error[template-injection] finding in .github/workflows/ by routing PR-author / matrix / input-derived values through env: instead of GitHub Actions ${{ ... }} rendering directly into shell or actions/github-script JS source.

Zizmor 1.24.1: 22 error[template-injection] → 0.

Files touched

pull_request_target / issue_comment (highest exposure)

• pr_slow_ci_suggestion.yml (pull_request_target)
  • PR_FILES was placed inside a << 'EOF' heredoc in run:. The single-quoted heredoc only stops shell expansion after GitHub renders ${{ ... }}; a filename containing EOF\n<payload>\nEOF would escape the heredoc and run on the runner. Now env: { PR_FILES: ... } + printf '%s\n' "$PR_FILES".
  • PR_HEAD_REPO_OWNER, PR_HEAD_REPO_NAME, PR_HEAD_SHA, PR_NUMBER were interpolated directly into actions/github-script script bodies; moved to env: + process.env.
• pr-repo-consistency-bot.yml (issue_comment, gated by maintainer allowlist)
  • Quoted every ${PR_HEAD_REF}, ${PR_HEAD_SHA}, ${PR_HEAD_REPO_FULL_NAME} shell expansion in git fetch, git checkout, git remote add, git push.
  • Final Comment on PR step now passes comment_id and final_comment via env: (no ${{ ... }} left in the script body).
• trl-ci-bot.yml (issue_comment, gated by author_association)
  • github.event.issue.pull_request.url passed via env. GitHub-controlled value, but principle is the same.

Reusable workflows (callable from PR comment CI)

• get-pr-info.yml: inputs.pr_number passed via env, shared between two API calls.
• check_failed_tests.yml: pr_number + commit_sha passed via env in the Extract base commit step.

Reusable workflows (callable from scheduled / dispatched CI)

• collated-reports.yml: machine_type, job, report_repo_id, gpu_name exposed as env, quoted in the python invocation.
• model_jobs_intel_gaudi.yml: inputs.folder_slices, inputs.machine_type, inputs.report_name_prefix, matrix.folders pulled into env:; report-directory name built once and reused.
• self-scheduled-flash-attn-caller.yml: prev_workflow_run_id / other_workflow_run_id passed via env before being written to disk.
• self-scheduled-intel-gaudi.yml: inputs.job passed via env; NUM_SLICES dereferenced via env in the python3 -c snippet.

Validation

• Zizmor 1.24.1: 22 error[template-injection] → 0 across the whole .github/workflows/ tree.
• node --check on every actions/github-script script: body touched: ✅
• bash -n on every run: block touched: ✅
• Behavior preserved: the same values reach the same code paths, only the wiring changed (templating → env vars).

Out of scope (will be follow-up PRs)

• Bumping actions/github-script@v6 → @v7 (handled by the pin-by-SHA PR chore(ci): pin all GitHub Actions and reusable workflows by SHA #45955).
• pr-repo-consistency-bot.yml:7 invalid branches-ignore filter on issue_comment (pre-existing).
• Replacing the hardcoded maintainer allowlist with a team-membership check.
• Switching secrets: inherit to explicit per-secret passing in the 17 callers.