fix: prevent command injection in create-unity-matrix workflow (GDX-417)

[fix-it-felix-sentry]

Summary

This PR fixes a high-severity security vulnerability (command injection) in the create-unity-matrix.yml GitHub Actions workflow.

Problem

The workflow was using direct variable interpolation ${{...}} with github context data in a run: step, which could allow an attacker to inject their own code into the runner. This would allow them to steal secrets and code.

Solution

Moved all workflow expressions to environment variables using the env: section and updated the run script to reference these environment variables with proper double-quoting:

• ${{ inputs.event-name }} → $EVENT_NAME
• ${{ env.PR_UNITY_VERSIONS }} → $PR_UNITY_VERSIONS_VALUE
• ${{ env.FULL_UNITY_VERSIONS }} → $FULL_UNITY_VERSIONS_VALUE

This prevents untrusted input interpolation inside the run: script and avoids command injection risks, since the shell will only interpolate the environment variable (not the workflow expression) at runtime.

References

• Parent ticket: https://linear.app/getsentry/issue/VULN-1097
• Child ticket: https://linear.app/getsentry/issue/GDX-417
• GitHub Actions Security Hardening
• Semgrep Rule

Testing

• ✅ YAML syntax validation passed
• ✅ No functional changes to the workflow logic
• ✅ The workflow will continue to produce the same output

[linear]

GDX-417 Command Injection vulnerability in getsentry/sentry-unity .github/workflows/create-unity-matrix.yml

[github-actions]

Semver Impact of This PR

🟢 Patch (bug fixes)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).

---

Bug Fixes 🐛

• Prevent command injection in create-unity-matrix workflow (GDX-417) by fix-it-felix-sentry[bot] in #2552

Internal Changes 🔧

• (deps) Update Native SDK to v0.12.8 by github-actions in #2550

---

_{🤖 This preview updates automatically when you update the PR.}

[github-actions]

	Fails
🚫	Please consider adding a changelog entry for the next release.

Instructions and example for changelog

Please add an entry to CHANGELOG.md to the "Unreleased" section. Make sure the entry includes this PR's number.

Example:

## Unreleased

### Fixes

- prevent command injection in create-unity-matrix workflow (GDX-417) ([#2552](https://github.com/getsentry/sentry-unity/pull/2552))

If none of the above apply, you can opt out of this check by adding #skip-changelog to the PR description or adding a skip-changelog label.

Generated by 🚫 dangerJS against 4615cf6