fix: Prevent script injection in workflow run blocks

Pass inputs and context values through env variables instead of
direct ${{ }} interpolation in run: blocks. Affected workflows:
- manual_version_docs.yaml (inputs.ref, default_branch, step outputs)
- manual_regenerate_models.yaml (inputs.docs_workflow_run_id, github context)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: vdusek

.github/workflows/manual_regenerate_models.yaml

@@ -46,13 +46,15 @@ jobs:
     steps:
       - name: Validate inputs
         if: inputs.docs_pr_number || inputs.docs_workflow_run_id
+        env:
+          DOCS_WORKFLOW_RUN_ID: ${{ inputs.docs_workflow_run_id }}
         run: |
           if [[ -n "$DOCS_PR_NUMBER" ]] && ! [[ "$DOCS_PR_NUMBER" =~ ^[1-9][0-9]*$ ]]; then
             echo "::error::docs_pr_number must be a positive integer, got: $DOCS_PR_NUMBER"
             exit 1
           fi
-          if [[ -n "${{ inputs.docs_workflow_run_id }}" ]] && ! [[ "${{ inputs.docs_workflow_run_id }}" =~ ^[0-9]+$ ]]; then
-            echo "::error::docs_workflow_run_id must be a numeric run ID, got: ${{ inputs.docs_workflow_run_id }}"
+          if [[ -n "$DOCS_WORKFLOW_RUN_ID" ]] && ! [[ "$DOCS_WORKFLOW_RUN_ID" =~ ^[0-9]+$ ]]; then
+            echo "::error::docs_workflow_run_id must be a numeric run ID, got: $DOCS_WORKFLOW_RUN_ID"
             exit 1
           fi
 
@@ -173,5 +175,5 @@ jobs:
         run: |
           gh pr comment "$DOCS_PR_NUMBER" \
             --repo apify/apify-docs \
-            --body "Python client model regeneration failed. [See workflow run](https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }})." \
+            --body "Python client model regeneration failed. [See workflow run](${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID})." \
             || echo "Warning: Failed to post failure comment to apify/apify-docs PR #$DOCS_PR_NUMBER."

.github/workflows/manual_version_docs.yaml

@@ -45,11 +45,11 @@ jobs:
     steps:
       - name: Determine checkout ref
         id: resolve_ref
+        env:
+          INPUT_REF: ${{ inputs.ref }}
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
         run: |
-          REF="${{ inputs.ref }}"
-          if [[ -z "$REF" ]]; then
-            REF="${{ github.event.repository.default_branch }}"
-          fi
+          REF="${INPUT_REF:-$DEFAULT_BRANCH}"
           echo "ref=$REF" >> "$GITHUB_OUTPUT"
 
       - name: Checkout repository
@@ -126,9 +126,7 @@ jobs:
 
       - name: Resolve output commitish
         id: resolve_commitish
+        env:
+          COMMIT_SHA: ${{ steps.commit_versioned_docs.outputs.commit_long_sha }}
         run: |
-          SHA="${{ steps.commit_versioned_docs.outputs.commit_long_sha }}"
-          if [[ -z "$SHA" ]]; then
-            SHA="$(git rev-parse HEAD)"
-          fi
-          echo "commitish=$SHA" >> "$GITHUB_OUTPUT"
+          echo "commitish=${COMMIT_SHA:-$(git rev-parse HEAD)}" >> "$GITHUB_OUTPUT"