Fix template injection in e2e-versions.yml (alert #123)

[Copilot]

Description:
Resolves a zizmor/template-injection code scanning alert in the "Verify Java 21 outputs are set" workflow step. Inline ${{ steps.setup-java-21.outputs.* }} expressions inside a run shell script are evaluated before the shell sees the string, meaning a malicious output value could inject arbitrary shell commands.

Fix: Move template expressions to the step's env block and reference them as plain shell variables:

# Before (vulnerable)
run: |
  if [ -z "${{ steps.setup-java-21.outputs.version }}" ]; then ...

# After (safe)
env:
  JAVA21_VERSION: ${{ steps.setup-java-21.outputs.version }}
run: |
  if [ -z "$JAVA21_VERSION" ]; then ...

Both outputs.path and outputs.version are moved to env, eliminating direct template expansion inside the shell script.

Related issue:
Code scanning alert #123

Check list:

• Ran npm run check locally (format, lint, build, test) and all checks pass.
• Mark if documentation changes are required.
• Mark if tests were added or updated to cover the changes.

[Copilot]

Pull request overview

This PR mitigates a zizmor/template-injection code-scanning alert in the e2e-versions.yml workflow by preventing direct GitHub expression interpolation inside a bash run: script, instead passing step outputs via environment variables.

Changes:

• Moved ${{ steps.setup-java-21.outputs.path }} and ${{ steps.setup-java-21.outputs.version }} into the step’s env: block.
• Updated the bash script to reference $JAVA21_PATH and $JAVA21_VERSION (quoted) rather than inline ${{ ... }} expressions.

Show a summary per file

File	Description
.github/workflows/e2e-versions.yml	Moves Java 21 output references into env to avoid template expansion inside the shell script and reduce injection risk.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Low