ci: pass --branch through env and quote it

[kobihikri]

Hi, and thanks for supervision.

In .github/workflows/build-package.yml, the branch name is passed to the README script by interpolation, unquoted:

run: |
  python .github/scripts/augment_links.py README.md --branch ${{ github.head_ref || github.ref_name }}
  cat README.md

Actions expands ${{ ... }} into the script text before bash runs, so the branch name becomes part of the command rather than an argument to the script. Git allows $, (, ), backticks and spaces in branch names, and $(...) runs inside double quotes — and being unquoted here, a name containing a space would also split into two arguments, so augment_links.py would receive a truncated --branch value.

Scope, honestly: this is a reusable workflow_call workflow, and where it is called from pull_request a fork PR has a read-only token and no secrets. I am raising it as hardening and argument-robustness rather than as a live exploit.

The change passes the value through env: and quotes it:

env:
  BRANCH_REF: ${{ github.head_ref || github.ref_name }}
run: |
  python .github/scripts/augment_links.py README.md --branch "$BRANCH_REF"
  cat README.md

The || fallback is preserved by keeping the whole expression in the env: value, so the script receives the same branch string it does today, and cat README.md is untouched.

Disclosure: I used AI assistance to help spot this and prepare the change, and I read the workflow myself.

[CLAassistant]

All committers have signed the CLA.

[Borda]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

@kobihikri ^^ 🦝

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87%. Comparing base (541b022) to head (c713a92).

Additional details and impacted files

@@           Coverage Diff           @@
##           develop   #2461   +/-   ##
=======================================
  Coverage       87%     87%           
=======================================
  Files           85      85           
  Lines        12021   12021           
=======================================
  Hits         10424   10424           
  Misses        1597    1597           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

This PR hardens the reusable workflow_call GitHub Actions workflow by ensuring the branch name is passed to the README augmentation script as a properly quoted runtime argument, rather than being interpolated into the shell command text.

Changes:

• Move ${{ github.head_ref || github.ref_name }} into a step-level environment variable (BRANCH_REF).
• Quote the branch argument in the augment_links.py invocation to avoid shell word-splitting and prevent branch-name characters from being interpreted by the shell.