fix(ci): prevent workflow script injection via env vars

[utkrishtsahu]

Changes

This PR remediates a GitHub Workflow script injection vulnerability in the CI/publish workflows. Untrusted ${{ }} expressions (action inputs and secrets) were being interpolated directly into shell run: scripts, allowing anyone able to invoke the workflow to inject arbitrary shell commands and potentially exfiltrate secrets. Per GitHub's secure-use guidance, the fix moves these values into env: blocks and references them as quoted shell variables so the shell treats them as data, not code.

• .github/actions/setup/action.yml — inputs.gradle / inputs.kotlin moved to an env: block ($GRADLE / $KOTLIN) and referenced as quoted shell variables in the sdkman run: step.
• .github/workflows/publish.yml — the OSSR_USERNAME, OSSR_PASSWORD, SIGNING_KEY, and SIGNING_PASSWORD secrets moved to an env: block on the publishAndroidLibraryPublicationToMavenRepository step; also removed a stray trailing " after -PisSnapshot=false.

No endpoints, classes, methods, public APIs, or UI are affected — the change is confined to CI workflow configuration.

Not changed (verified safe): inputs.java (with: field of setup-java), github.event.inputs.branch (ref: of checkout), and the concurrency group: expressions are consumed by the Actions runner, not a shell, so they are not injection vectors.

Alternatives considered: Restricting inputs via choice-type parameters was considered but rejected — the env-var pattern is GitHub's recommended mitigation, is minimally invasive, and preserves the existing flexibility of the composite action's version inputs.

References

SEC-8159

Testing

• YAML syntax validated for both files (yaml.safe_load — both parse cleanly).
• actionlint (recommended for reviewers): docker run --rm -v "$PWD":/repo -w /repo rhysd/actionlint:latest -color
• Injection closed (behavioral check): a malicious version string (e.g. GRADLE='6.7.1; touch pwned') is now treated as a literal argument to sdk rather than executed as a command.
• Publish workflow cannot be end-to-end tested from a PR since it requires the release environment and real Maven Central credentials; the change is limited to how existing secrets are passed and does not alter the gradle command's behavior.

[ ] This change adds test coverage — N/A (workflow configuration; no unit-testable surface)

[x] This change has been tested on the latest version of the platform/language or why not — validated via YAML parsing and injection simulation; live publish run not exercised (requires protected release environment + credentials).

Checklist

[x] I have read the Auth0 general contribution guidelines

[x] I have read the Auth0 Code of Conduct

[x] All existing and new tests complete without errors