Pass workflow inputs via environment variables in release.yml (Sonar S7630) #22

Description

SonarCloud flagged vulnerability rule githubactions:S7630 on .github/workflows/release.yml.
Values of inputs.version and inputs.next_version are interpolated directly inside bash run blocks, which can lead to script injection if inputs contain unexpected characters.

Proposed Changes

• In .github/workflows/release.yml, assign inputs.version and inputs.next_version to step-level env: variables (e.g. INPUT_VERSION: ${{ inputs.version }}).
• Reference $INPUT_VERSION / $INPUT_NEXT_VERSION in the bash script rather than inline GitHub Actions expressions.

References

• Sonar rule: githubactions:S7630