Fix template injection (zizmor alert #118) in e2e-versions.yml

[Copilot]

Description:
Resolves a zizmor/template-injection code scanning alert where ${{ steps.setup-java-17.outputs.path }} was interpolated directly into a run shell block, allowing the step output to expand into attacker-controllable code.

Fix moves the expression into a step-level env variable and references it as a plain shell variable:

# Before (vulnerable)
run: |
  if [ "$JAVA_HOME" != "${{ steps.setup-java-17.outputs.path }}" ]; then

# After (safe)
env:
  JAVA_17_PATH: ${{ steps.setup-java-17.outputs.path }}
run: |
  if [ "$JAVA_HOME" != "$JAVA_17_PATH" ]; then

Related issue:
Code scanning alert #118

Check list:

• Ran npm run check locally (format, lint, build, test) and all checks pass.
• Mark if documentation changes are required.
• Mark if tests were added or updated to cover the changes.

[Copilot]

Pull request overview

This PR addresses a zizmor/template-injection risk in the e2e-versions GitHub Actions workflow by removing direct ${{ ... }} interpolation from a bash run: block and routing the value through a step-level environment variable instead.

Changes:

• Introduces JAVA_17_PATH as a step-level env variable sourced from steps.setup-java-17.outputs.path.
• Updates the Java 17 JAVA_HOME verification script to compare against $JAVA_17_PATH rather than embedding the expression in the shell script.

Show a summary per file

File	Description
.github/workflows/e2e-versions.yml	Moves Java 17 output usage into env to avoid direct expression interpolation in a bash run: block.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Low