Cleanup of workflow files (#187)

Author: mandreko-bitwarden

.github/workflows/main.yml

@@ -50,20 +50,22 @@ jobs:
       - name: Determine stable version
         id: stable-version
         if: ${{ github.event_name == 'release' }}
+        env:
+          TAG_NAME: ${{ github.event.release.tag_name }}
         run: |
-          if ! [[ "${{ github.event.release.tag_name }}" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z].*)?$ ]]; then
-              echo "Invalid version: ${{ github.event.release.tag_name }}"
+          if ! [[ "${TAG_NAME}" =~ ^[0-9]+\.[0-9]+\.[0-9]+(-[a-zA-Z].*)?$ ]]; then
+              echo "Invalid version: ${TAG_NAME}"
               exit 1
           fi
-          
-          echo "version=${{ github.event.release.tag_name }}" >> $GITHUB_OUTPUT
+
+          echo "version=${TAG_NAME}" >> "$GITHUB_OUTPUT"
 
       - name: Determine prerelease version
         id: pre-version
         if: ${{ github.event_name != 'release' }}
         run: |
           hash="${{ github.event.pull_request.head.sha || github.sha }}"
-          echo "version=0.0.0-ci-${hash:0:7}" >> $GITHUB_OUTPUT
+          echo "version=0.0.0-ci-${hash:0:7}" >> "$GITHUB_OUTPUT"
 
     outputs:
       version: ${{ steps.stable-version.outputs.version || steps.pre-version.outputs.version }}
@@ -78,6 +80,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false # we don't need to push anything
 
       - name: Install .NET
         uses: actions/setup-dotnet@87b7050bc53ea08284295505d98d2aa94301e852 # v4.2.0
@@ -106,6 +110,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Install .NET
         uses: actions/setup-dotnet@87b7050bc53ea08284295505d98d2aa94301e852 # v4.2.0
@@ -149,6 +155,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Install .NET
         uses: actions/setup-dotnet@87b7050bc53ea08284295505d98d2aa94301e852 # v4.2.0
@@ -166,9 +174,11 @@ jobs:
           -p:ContinuousIntegrationBuild=true
 
       - name: Run pack
+        env:
+          VERSION: ${{ needs.version.outputs.version }}
         run: >
           dotnet pack
-          -p:Version=${{ needs.version.outputs.version }}
+          -p:Version="${VERSION}"
           -p:ContinuousIntegrationBuild=true
           --no-restore
           --no-build
@@ -226,11 +236,12 @@ jobs:
       - name: Dispatch deployment
         env:
           GITHUB_TOKEN: ${{ steps.retrieve-secret-pat.outputs.github-pat-bitwarden-devops-bot-repo-scope }}
+          VERSION: ${{ needs.version.outputs.version }}
         run: >
           gh workflow run deploy-passwordless-dotnet
           --repo bitwarden/passwordless-devops
-          --field repository=${{ github.repository }}
-          --field run-id=${{ github.run_id }}
-          --field artifact=packages
-          --field environment=${{ matrix.environment }}
-          --field version=${{ needs.version.outputs.version }}
+          --field repository="${GITHUB_REPOSITORY}"
+          --field run-id="${GITHUB_RUN_ID}"
+          --field artifact="packages"
+          --field environment="${{ matrix.environment }}"
+          --field version="${VERSION}"