fix: remove eval, stop printing secrets to logs, pin actions [E-1815]

[jonathansantilli]

Summary

• Remove eval "$python_cmd" — call python directly with env vars
• Remove echo "$python_cmd" that printed SONARQUBE_TOKEN in plaintext to workflow logs
• Remove bare env command that dumped all environment variables to logs
• Move all ${{ inputs.* }} from run: blocks to env: blocks
• Move github-token from curl command line to env var
• Replace bash -l {0} with bash
• Quote all variable expansions
• Pin all action references to immutable commit SHAs

Security Context

Line 94 (echo "$python_cmd") prints a string containing SONARQUBE_TOKEN=<actual-token> to the workflow log every time the action runs. On public repos, anyone can read Actions logs.

The consumer .github/scripts/sonarqube_download_report.py already reads from os.environ — the fix simply sets the env vars via the env: block instead of via eval inline assignment. No changes needed to the python script.

Consumer Impact

None. The action inputs: and outputs: are unchanged. The python script receives the same environment variables. This fix is transparent.

Test plan

• No CI configured on this repo — verified by code review
• The same fix pattern (env: blocks instead of direct interpolation, remove eval, quote variables) was tested end-to-end on fix: prevent shell injection via eval in action.yml and review/action.yml [E-1815] action#31 with all checks green and injection test passing

The injection test evidence is documented in detail at: mobb-dev/action#31 (comment)