chore: fix sonarcloud issues (#1836)

* chore: fix sonarcloud issues

Signed-off-by: Kim Tsao <ktsao@redhat.com>

* chore: replace inline scripts with env var usage

Signed-off-by: Kim Tsao <ktsao@redhat.com>

---------

Signed-off-by: Kim Tsao <ktsao@redhat.com>

Author: kim-tsao

.github/workflows/release_workspace_version.yml

@@ -25,11 +25,16 @@ jobs:
     steps:
         - name: Check PR title, author, branch and merged status
           id: check_pr
+          env:
+            PR_TITLE: ${{ github.event.pull_request.title }}
+            HEAD_REF: ${{ github.event.pull_request.head.ref }}    
+            USER_LOGIN: ${{ github.event.pull_request.user.login }}    
+            PR_MERGED: ${{ github.event.pull_request.merged }}
           run: |
-              if [[ "${{ github.event.pull_request.title }}" == Version*Packages* \
-              && "${{ github.event.pull_request.user.login }}" == "rhdh-bot" ]] \
-              && [[ "${{ github.event.pull_request.head.ref }}" == maintenance-changesets-release/* ]] \
-              && [[ "${{ github.event.pull_request.merged }}" == "true" ]]; then
+              if [[ "$PR_TITLE" == Version*Packages* \
+              && "$USER_LOGIN" == "rhdh-bot" ]] \
+              && [[ "$HEAD_REF" == maintenance-changesets-release/* ]] \
+              && [[ "PR_MERGED" == "true" ]]; then
                 echo "is_version_pr=true" >> $GITHUB_OUTPUT
               else
                 echo "is_version_pr=false" >> $GITHUB_OUTPUT
@@ -38,8 +43,10 @@ jobs:
         # ADDED: Extracts workspace name from branch, ensuring it is a workspace/** branch
         - name: Extract Workspace name from branch
           id: extract_workspace
+          env:
+            BASE_REF: ${{ github.event.pull_request.base.ref }}
           run: |
-              WORKSPACE_NAME=$(echo "${{ github.event.pull_request.base.ref }}" | cut -d'/' -f2)
+              WORKSPACE_NAME=$(echo "$BASE_REF" | cut -d'/' -f2)
               echo "workspace_name=$WORKSPACE_NAME" >> $GITHUB_OUTPUT
 
   changesets-pr:
@@ -62,9 +69,11 @@ jobs:
          ref: ${{ github.ref }}
 
       - name: Verify maintenance-changesets-release branch does not exist
+        env:
+          WORKSPACE_NAME: ${{ needs.check-merged-pr.outputs.workspace_name }}         
         run: |
-          if git ls-remote --exit-code origin "refs/heads/maintenance-changesets-release/${{ needs.check-merged-pr.outputs.workspace_name }}"; then
-            echo "Error: maintenance-changesets-release/${{ needs.check-merged-pr.outputs.workspace_name }} branch already exists. Please clean up the branch before proceeding."
+          if git ls-remote --exit-code origin "refs/heads/maintenance-changesets-release/$WORKSPACE_NAME"; then
+            echo "Error: maintenance-changesets-release/$WORKSPACE_NAME branch already exists. Please clean up the branch before proceeding."
             exit 1
           fi
 
@@ -90,10 +99,12 @@ jobs:
         run: yarn install --immutable
 
       - name: Fetch previous commit for release check
-        run: git fetch origin '${{ github.event.pull_request.base.sha }}'
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+        run: git fetch origin "$BASE_SHA"
 
       - name: Fetch the commit that triggered the workflow (used by backstage/changesets-action)
-        run: git fetch origin ${{ github.sha }}
+        run: git fetch origin "$GITHUB_SHA"
         continue-on-error: true
 
       - name: Check if release
@@ -170,7 +181,7 @@ jobs:
       # CHANGED: Publish with tag "maintenance" to avoid overwriting the latest npm tag
       - name: publish
         run: |
-          yarn config set -H 'npmAuthToken' "${{secrets.RHDH_NPM_TOKEN}}"
+          yarn config set -H 'npmAuthToken' "$NODE_AUTH_TOKEN"
           yarn workspaces foreach -v --no-private npm publish --access public --tolerate-republish --tag "maintenance"
         env:
           NODE_AUTH_TOKEN: ${{ secrets.RHDH_NPM_TOKEN }}