Fix command injection vulnerability in iOS workflow

[fix-it-felix-sentry]

Summary

This PR fixes a command injection vulnerability in the iOS workflow by moving the ios-version input from direct interpolation in the run: script to an environment variable.

Changes

• Moved ${{ inputs.ios-version }} from the run: script to an env: block as SENTRY_IOS_VERSION
• Removed the direct assignment in the PowerShell script (the env var is automatically available as $env:SENTRY_IOS_VERSION)

Security Impact

Using GitHub context data directly in run: scripts can allow attackers to inject malicious code if they control the input value. By using an intermediate environment variable, the input is safely escaped and cannot be used for code injection.

References

• Parent ticket: https://linear.app/getsentry/issue/VULN-1334
• Child ticket: https://linear.app/getsentry/issue/ENG-7130
• GitHub Actions Security Hardening
• GitHub Actions Untrusted Input Research

[linear-code]

ENG-7130 Command Injection vulnerability in getsentry/sentry-unity .github/workflows/test-run-ios.yml

[github-actions]

Semver Impact of This PR

⚪ None (no version bump detected)

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).

---

Internal Changes 🔧

• (deps) Update Java SDK to v8.36.0 by github-actions in #2591

Other

• Fix command injection vulnerability in iOS workflow by fix-it-felix-sentry[bot] in #2598

---

_{🤖 This preview updates automatically when you update the PR.}

[github-actions]

	Fails
🚫	Please consider adding a changelog entry for the next release.

Instructions and example for changelog

Please add an entry to CHANGELOG.md to the "Unreleased" section. Make sure the entry includes this PR's number.

Example:

## Unreleased

### Fixes

- Fix command injection vulnerability in iOS workflow ([#2598](https://github.com/getsentry/sentry-unity/pull/2598))

If none of the above apply, you can opt out of this check by adding #skip-changelog to the PR description or adding a skip-changelog label.

Generated by 🚫 dangerJS against 858c4f6