CI: escape various inputs

Shouldn't make a difference since all is trusted, but why not.

In the case of the PKGBUILD reusable workflow ignore the error since
we need to pass unescaped commands to it for testing.

.github/workflows/PKGBUILD.yml

@@ -56,8 +56,10 @@ jobs:
         pacboy: toolchain:p
 
     - name: '🚧 Build package'
+      env:
+        PKGBUILD_PATH: ${{ inputs.path }}
       run: |
-        cd ${{ inputs.path }}
+        cd "$PKGBUILD_PATH"
         makepkg-mingw --noconfirm --noprogressbar -sCLf
 
     - name: '📤 Upload artifact: package'
@@ -67,10 +69,12 @@ jobs:
         path: ${{ inputs.path }}/*.zst
 
     - name: '🔍 Show package content'
+      env:
+        PKGBUILD_PATH: ${{ inputs.path }}
       run: |
         mkdir tmp
         cd tmp
-        tar -xf ../${{ inputs.path }}/*.zst
+        tar -xf ../"$PKGBUILD_PATH"/*.zst
         tree .
 
 
@@ -103,4 +107,4 @@ jobs:
       run: pacman -U --noconfirm --noprogressbar *.zst
 
     - name: '🚦 Test package'
-      run: ${{ inputs.test }}
+      run: ${{ inputs.test }}  # zizmor: ignore[template-injection]

.github/workflows/Test.yml

@@ -454,14 +454,18 @@ jobs:
       run: |
         cygpath -m /
     - shell: pwsh
+      env:
+        MSYS2_LOCATION: ${{ steps.msys2.outputs.msys2-location }}
       run: |
-        echo '${{ steps.msys2.outputs.msys2-location }}'
+        echo "$env:MSYS2_LOCATION"
     - shell: pwsh
+      env:
+        MSYS2_LOCATION: ${{ steps.msys2.outputs.msys2-location }}
       run: |
         $Env:MSYS2_ROOT = msys2 -c 'cygpath -a -w /'
         $Env:MSYS2_ROOT
-        if ($env:MSYS2_ROOT -ne '${{ steps.msys2.outputs.msys2-location }}') {
-            Write-Error "Error: MSYS2_ROOT is '$env:MSYS2_ROOT', expected '${{ steps.msys2.outputs.msys2-location }}'"
+        if ($env:MSYS2_ROOT -ne "$env:MSYS2_LOCATION") {
+            Write-Error "Error: MSYS2_ROOT is '$env:MSYS2_ROOT', expected '$env:MSYS2_LOCATION'"
             exit 1
         }
     - shell: python

README.md

@@ -241,7 +241,9 @@ The absolute path of the MSYS2 installation location. Example: `D:\a\_temp\msys6
 ```yaml
   - uses: msys2/setup-msys2@v2
     id: msys2
-  - run: echo '${{ steps.msys2.outputs.msys2-location }}'
+  - env:
+      MSYS2_LOCATION: ${{ steps.msys2.outputs.msys2-location }}
+    run: echo "$env:MSYS2_LOCATION"
 ```
 
 Available since v2.24.1