ci: do not interpolate directly into release workflows (#545)

.github/workflows/release-please.yml

@@ -45,8 +45,9 @@ jobs:
         if: ${{ steps.rp.outputs.prs_created == 'true' || steps.rp.outputs.prs_updated == 'true' }}
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          RP_PR_OUTPUT_JSON: ${{ steps.rp.outputs.prs }}
         run: |
-          PR_NUMBER=$(echo '${{ steps.rp.outputs.prs }}' | jq -r '.[0].number')
+          PR_NUMBER=$(echo "$RP_PR_OUTPUT_JSON" | jq -r '.[0].number')
           gh pr checkout "$PR_NUMBER"
           
           cargo update -w

.github/workflows/release-webhook.yml

@@ -12,8 +12,12 @@ jobs:
 
     steps:
       - name: Send release notification webhook
+        env:
+          TAG_NAME: ${{ github.event.release.tag_name }}
+          REPOSITORY: ${{ github.repository }}
+          WEBHOOK_URL: ${{ secrets.STOAT_WEBHOOK_UPDATES_URL }}
         run: |
-          RELEASE_URL="https://github.com/${{ github.repository }}/releases/tag/${{ github.event.release.tag_name }}"
-          curl -X POST "${{ secrets.STOAT_WEBHOOK_UPDATES_URL }}" \
+          RELEASE_URL="https://github.com/${REPOSITORY}/releases/tag/${TAG_NAME}"
+          curl -X POST "$WEBHOOK_URL" \
             -H "Content-Type: application/json" \
             -d "{\"content\": \"$RELEASE_URL\"}"