address code scan

Author: blink1073

python/post-publish/action.yml

@@ -57,15 +57,17 @@ runs:
         path: dist/
     - name: Ensure we have the package version
       shell: bash
+      env:
+        VERSION: "${{ inputs.version }}"
       run: |
         # Handle version already bumped
-        if [ -z "${{ inputs.version }}" ]; then
+        if [ -z "${VERSION}" ]; then
           # Extract the version from the sdist name, which must be of the from
           # {name}-{version}.tar.gz according to PEP 625.
           VERSION=$(ls dist/*.tar.gz | rev | cut -d'-' -f 1 | rev | sed 's/.tar.gz//g')
           echo "VERSION=$VERSION" >> $GITHUB_ENV
         else
-          echo "VERSION=${{ inputs.version}}" >> $GITHUB_ENV
+          echo "VERSION=${VERSION}" >> $GITHUB_ENV
         fi
     - name: Create detached signature for dist files
       uses: mongodb-labs/drivers-github-tools/gpg-sign@v2