[sylvesterkaczmarek]

Checklist (Please check before submitting)

• I reviewed the Contributing Guide. (Contributor confirmation pending.)
• I signed and emailed the appropriate Contributor License Agreement to GSFC-SoftwareRelease@mail.nasa.gov and copied cfs-program@lists.nasa.gov. (Not yet verified.)

Describe the contribution

Part of #1029. Replace direct GitHub expression interpolation inside shell run blocks across the cFS workflows and composite actions with step environment variables. Quote path, regex, container and configuration values at the shell boundary. Inputs intentionally representing commands in the CodeQL workflow retain their command semantics through explicit Bash execution.

Fifteen workflow/composite-action files are affected. Direct GitHub expressions inside shell run blocks are reduced from 114 to zero. This PR does not claim to close the broader #1029 issue.

Testing performed

1. Parsed all 15 changed YAML workflow/action files successfully.
2. Extracted and syntax-checked 114 shell run blocks using Bash -n.
3. Compared actionlint diagnostics with the previous base, observing no newly introduced findings; existing baseline findings remain.
4. Checked the edited workflows for remaining direct GitHub expressions inside shell scripts and ran git diff --check.
5. Rebased onto the dev branch, including its newly added application-specific documentation warning filter and new build-tag expression.
6. Full upstream GitHub Actions execution is not yet verified because the fork-originated workflow is awaiting maintainer authorization.

Expected behavior changes

• API change: none.
• Behavior: workflow values are passed as data via environment variables instead of being substituted directly into generated shell commands. The aim is to prevent shell injection while preserving existing jobs and intended command-input behavior.
• No flight software or runtime binaries are changed.

System(s) tested on

• Hardware: Apple Silicon (arm64) development machine.
• OS: macOS 26.6.2.
• Versions: local Bash and workflow/YAML validation tools; no flight-software target system tested. Hosted workflow validation pending.

Additional context

The change is scoped to GitHub Actions workflows/composite actions. Previously raised review feedback concerning quoting and repeated environment variables has been incorporated in head 9e712eb. Required external-contributor CLA and personal checklist confirmations are not represented as complete.

Code contributions

Not applicable to flight software or cFS submodule code; this PR changes repository CI/workflow configuration.

Contributor Info - All information REQUIRED for consideration of pull request

Sylvester Kaczmarek — Personal (individual contribution).

[sylvesterkaczmarek]

Rebased onto current dev, preserved the new documentation-warning filter, and hardened the newly added build-tag expression. All 15 changed YAML files parse and 114 shell steps pass Bash syntax checks. Direct expressions in run blocks: 114 before, zero after; no new actionlint findings. Full GitHub workflow execution is pending.

[sylvesterkaczmarek]

@jphickey @arielswalker Following up on this #1029 workflow-hardening PR. I rebased it across the 35 commits now on dev and resolved the one conflict by preserving the new fromJSON(inputs.run-local-tests) condition while keeping the config name out of shell source. Current head d874738 is 0 behind, mergeable, signed, and GitHub Verified. Revalidation on current dev: all 15 modified YAML files parse; all 114 run blocks pass bash -n; direct GitHub expressions inside run blocks remain 0; git diff --check passes. I also cleaned up the shell-variable conversions so actionlint/ShellCheck diagnostics on the nine changed workflows drop from 147 on current dev to 120 on this branch, with no new file/rule deltas. The prior upstream CI run on the old head was fully green; fresh checks have not populated yet after today's rewrite. Could you review the refreshed head when convenient?

[sylvesterkaczmarek]

Addressed the requested workflow refactor in GitHub-Verified commit 6820f5d. INPUT_CONFIG_NAME is now job-scoped, repeated step env declarations are gone, no GitHub expression is embedded in a run block, and the validator diagnostic set is unchanged from the previous head. @arielswalker, could you re-review the refreshed head when convenient?

[sylvesterkaczmarek]

Thanks for the review, @arielswalker. The repeated input is now job-scoped and the run steps use the quoted shell variable. Could you approve the pending workflows and re-review this head?

[sylvesterkaczmarek]

Thanks Ariel — updated the quoted config variable form throughout build-cfs-multitarget in 2c185d4.

[sylvesterkaczmarek]

Addressed the remaining workflow review feedback in 9e712eb: the config target now quotes only $INPUT_CONFIG_NAME before the suffix, repeated MATRIX_TARGET is job-scoped in build-doc, repeated MATRIX_CONFIG is job-scoped in test-cfs-qemu, and repeated INPUT_APP_NAME/MATRIX_VARIANT are job-scoped in build-run-app. All workflow YAML parses, git diff --check is clean, and actionlint is unchanged from the prior head: 72 existing diagnostics, 0 new / 0 removed. @arielswalker, could you re-review this head when convenient?

Rechecked 9e712eb: all 15 changed YAML files parse and all 114 shell blocks pass bash -n. The eight addressed inline threads are now resolved; step-output variables remain step-scoped where required. The current build/test workflow still needs maintainer approval before hosted validation can run.

[sylvesterkaczmarek]

The requested quoting and environment-variable changes are in 9e712eb. Could you re-review and approve the waiting workflow?

[arielswalker]

@sylvesterkaczmarek Have you signed and emailed the CLA? Also the wrong PR template was used for this. You are using a template made for only internal cFS team members. Please use the correct one.

[sylvesterkaczmarek]

Thanks for flagging this. I have replaced the internal-team PR template with the external-contributor format linked in dev, including the contribution details, testing, expected behavior, system information and contributor identity.

I have left the CLA submission checkbox unchecked because I cannot verify that the signed cFS Framework CLA has been emailed to GSFC-SoftwareRelease@mail.nasa.gov with cfs-program@lists.nasa.gov copied. That needs to be completed separately by the contributor. The workflow changes themselves are unchanged.