Fix template injection in e2e-versions.yml (zizmor alert #122)

[Copilot]

Resolves a zizmor/template-injection code scanning alert by removing direct GitHub expression expansion inside a run: bash script, which could allow shell injection if output values contain metacharacters.

Changes:

• In the "Verify Java 21 outputs are set" step, moved ${{ steps.setup-java-21.outputs.path }} and ${{ steps.setup-java-21.outputs.version }} from inline script expansion into env: variables (JAVA_21_PATH, JAVA_21_VERSION), consistent with the safe pattern used throughout the rest of the workflow.

# Before (unsafe)
run: |
  if [ -z "${{ steps.setup-java-21.outputs.path }}" ]; then ...

# After (safe)
env:
  JAVA_21_PATH: ${{ steps.setup-java-21.outputs.path }}
  JAVA_21_VERSION: ${{ steps.setup-java-21.outputs.version }}
run: |
  if [ -z "$JAVA_21_PATH" ]; then ...

Related issue:
N/A — code scanning alert #122

Check list:

• Ran npm run check locally (format, lint, build, test) and all checks pass.
• Mark if documentation changes are required.
• Mark if tests were added or updated to cover the changes.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Updates the e2e GitHub Actions workflow to verify Java 21 setup outputs using step-scoped environment variables, improving shell interpolation consistency.

Changes:

• Pass setup-java-21 outputs into the verification step via env
• Update verification script to reference $JAVA_21_PATH / $JAVA_21_VERSION instead of inline ${{ ... }} expressions

Show a summary per file

File	Description
.github/workflows/e2e-versions.yml	Refactors the Java 21 output verification step to use environment variables for easier/safer shell usage

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Low