MESH-2530 Address github action vulnerability

Author: acarriedev

.github/workflows/pull-request.yml

@@ -8,7 +8,6 @@ permissions:
   pull-requests: write
 
 jobs:
-
   tox:
     strategy:
       matrix:
@@ -37,11 +36,14 @@ jobs:
       - name: merge into base_branch
         if: ${{ github.event_name == 'pull_request' }}
         run: |
-          echo base branch "${{ github.base_ref }}"
-          echo pr branch "${{ github.head_ref }}"
-          git checkout "${{ github.base_ref }}"
+          echo base branch "$BASE_BRANCH"
+          echo pr branch "$PR_BRANCH"
+          git checkout "$BASE_BRANCH"
           git checkout -b "merging-${{ github.event.number }}"
           git merge --ff-only "${{ github.event.pull_request.head.sha }}"
+        env:
+          BASE_BRANCH: ${{ github.base_ref }}
+          PR_BRANCH: ${{ github.head_ref }}
 
       - name: setup python
         uses: actions/setup-python@v5
@@ -61,7 +63,6 @@ jobs:
         if: success() || failure()
         run: make down
 
-
   coverage:
     runs-on: ubuntu-latest
     if: github.repository == 'NHSDigital/nhs-aws-helpers'
@@ -89,11 +90,14 @@ jobs:
       - name: merge into base_branch
         if: ${{ github.event_name == 'pull_request' }}
         run: |
-          echo base branch "${{ github.base_ref }}"
-          echo pr branch "${{ github.head_ref }}"
-          git checkout "${{ github.base_ref }}"
+          echo base branch "$BASE_BRANCH"
+          echo pr branch "$PR_BRANCH"
+          git checkout "$BASE_BRANCH"
           git checkout -b "merging-${{ github.event.number }}"
           git merge --ff-only "${{ github.event.pull_request.head.sha }}"
+        env:
+          BASE_BRANCH: ${{ github.base_ref }}
+          PR_BRANCH: ${{ github.head_ref }}
 
       - name: setup python
         uses: actions/setup-python@v5
@@ -158,16 +162,16 @@ jobs:
       - name: run sonar scan
         if: success() || failure()
         run: |
-         PATH="$PWD/sonar-scanner/bin:$PATH"
-         if [[ "${{ github.event_name }}" == "pull_request" ]]; then
-           git checkout "${GITHUB_HEAD_REF}"
-           sonar-scanner -Dsonar.pullrequest.branch="{{ github.event.pull_request.head.sha }}" -Dsonar.pullrequest.base="{{ github.event.pull_request.base.sha }}" -Dsonar.pullrequest.key="${{ github.event.number }}"
-         else
-           sonar-scanner
-         fi
+          PATH="$PWD/sonar-scanner/bin:$PATH"
+          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+            git checkout "${GITHUB_HEAD_REF}"
+            sonar-scanner -Dsonar.pullrequest.branch="{{ github.event.pull_request.head.sha }}" -Dsonar.pullrequest.base="{{ github.event.pull_request.base.sha }}" -Dsonar.pullrequest.key="${{ github.event.number }}"
+          else
+            sonar-scanner
+          fi
         env:
-         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-         SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
 
       - name: archive reports
         if: success() || failure()
@@ -206,11 +210,14 @@ jobs:
       - name: merge into base_branch
         if: ${{ github.event_name == 'pull_request' }}
         run: |
-          echo base branch "${{ github.base_ref }}"
-          echo pr branch "${{ github.head_ref }}"
-          git checkout "${{ github.base_ref }}"
+          echo base branch "$BASE_BRANCH"
+          echo pr branch "$PR_BRANCH"
+          git checkout "$BASE_BRANCH"
           git checkout -b "merging-${{ github.event.number }}"
           git merge --ff-only "${{ github.event.pull_request.head.sha }}"
+        env:
+          BASE_BRANCH: ${{ github.base_ref }}
+          PR_BRANCH: ${{ github.head_ref }}
 
       - name: setup python
         uses: actions/setup-python@v5
@@ -262,7 +269,6 @@ jobs:
           echo "RELEASE_VERSION=$version" >> $GITHUB_ENV
           echo "${version}"
 
-
   publish:
     runs-on: ubuntu-latest
     if: github.repository == 'NHSDigital/nhs-aws-helpers' && github.actor != 'dependabot[bot]'