Potential fix for code scanning alert no. 1: Cache Poisoning via low-privileged code injection

[kevinjqliu]

Potential fix for https://github.com/apache/iceberg-rust/security/code-scanning/1

To fix the issue, pass github.event.workflow_run.head_branch into the shell as an environment variable instead of interpolating it directly in the script, and then reference only the environment variable inside the run block. This follows the safer pattern from the “Secure Workflow” example, where GitHub expressions are resolved into environment variables and then treated as inert data.

Concretely, update the Validate release tag format step:

• Add an env: section with two variables:
  • DISPATCH_RELEASE_TAG: ${{ github.event.inputs.release_tag }}
  • RUN_HEAD_BRANCH: ${{ github.event.workflow_run.head_branch }}
• Replace the direct usages of ${{ github.event.inputs.release_tag }} and ${{ github.event.workflow_run.head_branch }} in the shell script with $DISPATCH_RELEASE_TAG and $RUN_HEAD_BRANCH respectively.

This change is all within .github/workflows/release_python.yml, in the validate-release-tag job, Validate release tag format step. No new methods, external definitions, or imports are required.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.

Tested

On fork repo github action run:
https://github.com/kevinjqliu/iceberg-rust/actions/runs/22290533306

[kevinjqliu]

CI blocked, #2165 #2166 should fix it

[blackmwk]

Thanks @kevinjqliu for this fix!

[kevinjqliu]

great! fixed https://github.com/apache/iceberg-rust/security/code-scanning/1