[FSSDK-10665] fix: Github Actions YAML files vulnerable to script injections corrected (optimizely#946)

* [FSSDK-10665] fix: Github Actions YAML files vulnerable to script injections corrected

* Update release.yml

unnecessary assignment of default environment variable

* Update release.yml

renamed ALTERNATE_RELEASE_TAG to GITHUB_RELEASE_TAG

Author: FarhanAnjum-opti

.github/workflows/integration_test.yml

@@ -23,15 +23,19 @@ jobs:
         path: 'home/runner/travisci-tools'
         ref: 'master'
     - name: set SDK Branch if PR
+      env:
+        HEAD_REF: ${{ github.head_ref }}
       if: ${{ github.event_name == 'pull_request' }}
       run: |
-        echo "SDK_BRANCH=${{ github.head_ref }}" >> $GITHUB_ENV
-        echo "TRAVIS_BRANCH=${{ github.head_ref }}" >> $GITHUB_ENV
+        echo "SDK_BRANCH=$HEAD_REF" >> $GITHUB_ENV
+        echo "TRAVIS_BRANCH=$HEAD_REF" >> $GITHUB_ENV
     - name: set SDK Branch if not pull request
+      env:
+        REF_NAME: ${{ github.ref_name }}
       if: ${{ github.event_name != 'pull_request' }}
       run: |
-        echo "SDK_BRANCH=${{ github.ref_name }}" >> $GITHUB_ENV
-        echo "TRAVIS_BRANCH=${{ github.ref_name }}" >> $GITHUB_ENV
+        echo "SDK_BRANCH=$REF_NAME" >> $GITHUB_ENV
+        echo "TRAVIS_BRANCH=$REF_NAME" >> $GITHUB_ENV
     - name: Trigger build
       env:
         SDK: javascript

.github/workflows/release.yml

@@ -32,20 +32,21 @@ jobs:
           echo "latest-release-tag=$(curl -qsSL \
             -H "Accept: application/vnd.github+json" \
             -H "Authorization: Bearer ${{ secrets.GITHUB_TOKEN }}" \
-            "${{ github.api_url }}/repos/${{ github.repository }}/releases/latest" \
+            "$GITHUB_API_URL/repos/$GITHUB_REPOSITORY/releases/latest" \
           | jq -r .tag_name)" >> $GITHUB_OUTPUT
 
       - id: npm-tag
         name: Determine NPM tag
+        env:
+          GITHUB_RELEASE_TAG: ${{ github.event.release.tag_name }}
         run: |
           VERSION=$(jq -r '.version' package.json)
           LATEST_RELEASE_TAG="${{ steps.latest-release.outputs['latest-release-tag']}}"
-
+          
           if [[ ${{ github.event_name }} == "workflow_dispatch" ]]; then
-            GITHUB_REF=${{ github.ref }}
             RELEASE_TAG=${GITHUB_REF#refs/tags/}
           else
-            RELEASE_TAG="${{ github.event.release.tag_name }}"
+            RELEASE_TAG=$GITHUB_RELEASE_TAG
           fi
 
           if [[ $RELEASE_TAG == $LATEST_RELEASE_TAG ]]; then