Pre-submission checks

• I am not filing a feature request. These should be filed via the feature request form instead.
• I have looked through the open issues for a duplicate report.

zizmor version

1.11.0

Expected behavior

Here's a pretty common pattern we currently flag:

run: echo ${{ env.FOO }}
env:
  FOO: blah blah

This should be auto-fixed as:

run: echo ${FOO}
env:
  FOO: blah blah

Actual behavior

Instead, we overcorrect by replacing the original FOO: value with its ${{ env.FOO }} expansion, which results in an empty expansion (unless the user has FOO set somewhere higher up):

run: echo ${FOO}
env:
  FOO: ${{ env.FOO }}

The trick here is probably to special-case the env. context namespace and not perform an env: block insertion in that case.

Reproduction steps

See above.

Logs

N/A

Additional context

No response