ci: fix remaining zizmor warnings (#5525)

.github/actions/build-sign-and-package-plugin/action.yml

@@ -19,9 +19,11 @@ runs:
     - name: Determine official plugin version
       id: plugin-version
       shell: bash
+      env:
+        PLUGIN_VERSION_NUMBER: ${{ inputs.plugin_version_number }}
       run: |
         # VERY IMPORTANT: chop off the "v".. this tells the oncall plugin that this is an OSS build
-        PLUGIN_VERSION="$(echo ${{ inputs.plugin_version_number }} | sed 's/^v//')"
+        PLUGIN_VERSION="$(echo ${{ env.PLUGIN_VERSION_NUMBER }} | sed 's/^v//')"
         echo version="$PLUGIN_VERSION" >> $GITHUB_OUTPUT
     - name: Determine artifact filename
       shell: bash

.github/actions/install-frontend-dependencies/action.yml

@@ -9,13 +9,15 @@ runs:
   using: composite
   steps:
     - name: Install pnpm
-      uses: pnpm/action-setup@v4
+      uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
       with:
         version: 9.1.4
     - name: Determine grafana-plugin directory location
       id: grafana-plugin-directory
       shell: bash
-      run: echo "grafana-plugin-directory=${{ inputs.oncall-directory }}/grafana-plugin" >> $GITHUB_OUTPUT
+      env:
+        ONCALL_DIRECTORY: ${{ inputs.oncall-directory }}
+      run: echo "grafana-plugin-directory=${{ env.ONCALL_DIRECTORY }}/grafana-plugin" >> $GITHUB_OUTPUT
     - name: Determine pnpm-lock.yaml location
       id: pnpm-lock-location
       shell: bash

.github/actions/set-engine-version-in-settings/action.yml

@@ -15,9 +15,13 @@ runs:
   steps:
     - name: Set engine version in settings file
       shell: bash
-      working-directory: ${{ inputs.working_directory }}
+      env:
+        WORKING_DIRECTORY: ${{ inputs.working_directory }}
+        ENGINE_VERSION_NUMBER: ${{ inputs.engine_version_number }}
+        SETTINGS_FILE_PATH: ${{ inputs.settings_file_path }}
+      working-directory: ${{ env.WORKING_DIRECTORY }}
       # yamllint disable rule:line-length
       run: |
-        sed "0,/VERSION.*/ s/VERSION.*/VERSION = \"${{ inputs.engine_version_number }}\"/g" ${{ inputs.settings_file_path }} > ./settings.temp && mv settings.temp ${{ inputs.settings_file_path }}
-        cat ${{ inputs.settings_file_path }} | grep VERSION | head -1
+        sed "0,/VERSION.*/ s/VERSION.*/VERSION = \"${{ env.ENGINE_VERSION_NUMBER }}\"/g" ${{ env.SETTINGS_FILE_PATH }} > ./settings.temp && mv settings.temp ${{ env.SETTINGS_FILE_PATH }}
+        cat ${{ env.SETTINGS_FILE_PATH }} | grep VERSION | head -1
       # yamllint enable rule:line-length

.github/actions/setup-python/action.yml

@@ -15,13 +15,17 @@ runs:
     - name: Setup Python
       id: setup-python
       uses: actions/setup-python@v5.1.0
+      env:
+        PYTHON_REQUIREMENTS_PATHS: ${{ inputs.python-requirements-paths }}
       with:
         python-version: "3.12.10"
         cache: "pip"
-        cache-dependency-path: ${{ inputs.python-requirements-paths }}
+        cache-dependency-path: ${{ env.PYTHON_REQUIREMENTS_PATHS }}
     - name: Install Python dependencies
       if: ${{ inputs.install-dependencies == 'true' }}
       shell: bash
+      env:
+        PYTHON_REQUIREMENTS_PATHS: ${{ inputs.python-requirements-paths }}
       run: |
         pip install uv setuptools
-        uv pip sync --system ${{ inputs.python-requirements-paths }}
+        uv pip sync --system ${{ env.PYTHON_REQUIREMENTS_PATHS }}