ci: pass ref name via env to block template injection

Interpolating `github.ref_name` directly into the release `run` block lets an attacker-controlled ref name execute shell code. Pass it through the `GITHUB_REF_NAME` env var instead.

Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>

.github/workflows/release.yml

@@ -39,8 +39,8 @@ jobs:
         run: |
           set -eu -o pipefail
 
-          make build-cross VERSION="${{ github.ref_name }}"
+          make build-cross VERSION="${GITHUB_REF_NAME}"
-          make dist checksum VERSION="${{ github.ref_name }}"
+          make dist checksum VERSION="${GITHUB_REF_NAME}"
 
       - name: Set latest version
         run: |