Merge pull request #3 from aws/harden-actions-event-context

Harden reusable workflows: pass event context via env vars

Author: jariy17

.github/workflows/reusable-pr-security-review.yml

@@ -86,11 +86,15 @@ jobs:
       - name: Resolve subject
         id: subject
         if: github.event_name == 'pull_request_target'
+        env:
+          EVENT_ACTION: ${{ github.event.action }}
+          SENDER_LOGIN: ${{ github.event.sender.login }}
+          PR_AUTHOR_LOGIN: ${{ github.event.pull_request.user.login }}
         run: |
-          if [ "${{ github.event.action }}" = "labeled" ]; then
-            echo "login=${{ github.event.sender.login }}" >> "$GITHUB_OUTPUT"
+          if [ "$EVENT_ACTION" = "labeled" ]; then
+            echo "login=$SENDER_LOGIN" >> "$GITHUB_OUTPUT"
           else
-            echo "login=${{ github.event.pull_request.user.login }}" >> "$GITHUB_OUTPUT"
+            echo "login=$PR_AUTHOR_LOGIN" >> "$GITHUB_OUTPUT"
           fi
       # Authorized = member of the org team OR a write/admin collaborator (team tier first).
       - name: Check authorization

.github/workflows/reusable-strands-command.yml

@@ -88,8 +88,10 @@ jobs:
           required-permission: write
       - name: Enforce authorization
         if: github.event_name != 'workflow_dispatch' && steps.authz.outputs.is-authorized != 'true'
+        env:
+          COMMENT_USER: ${{ github.event.comment.user.login }}
         run: |
-          echo "❌ User ${{ github.event.comment.user.login }} does not have write access"
+          echo "❌ User $COMMENT_USER does not have write access"
           exit 1
 
       - name: Checkout