enhancement(python-setup, release/pypi): remove eval and env-scope caller inputs in run blocks

[MAfarrag]

Context

Security review (defense-in-depth); fixed in PR #28.

Problem

python-setup/pip used eval on strings built from install-groups, and pip/uv/pixi/release-pypi
interpolated caller inputs (install-groups, package, activate-environment, pypi-repository-url, …) directly
into run: bodies. A consumer wiring an input from untrusted event data would get command injection.

Affected locations

File	Location
actions/python-setup/pip/action.yml	eval "$install_cmd" / eval "$dep_groups_cmd"
actions/python-setup/{pip,uv,pixi}/action.yml	${{ inputs.install-groups }} / activate-environment in run bodies
actions/release/pypi/action.yml	${{ inputs.package }} in find_pkg_dir; REPO_ARGS string

Fix (PR #28)

Removed both evals (argv arrays); routed inputs through env:; built REPO_ARGS as a bash array.

Severity / Effort

Low (defense-in-depth) · S

Definition of Done

• No eval in the pip action
• No caller-input ${{ }} in any run: body of these actions