harden actions

.github/workflows/reloader-enterprise-published.yml

@@ -4,14 +4,21 @@ on:
   release:
     types: [published]
 
+# Authenticates with a PAT, not GITHUB_TOKEN — no token scopes needed.
+permissions: {}
+
 jobs:
   dispatch:
     runs-on: ubuntu-latest
     steps:
       - name: Trigger target repository workflow
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
         run: |
+          payload=$(jq -nc --arg tag "$RELEASE_TAG" \
+            '{event_type: "release-published", client_payload: {tag: $tag}}')
           curl -X POST \
           -H "Accept: application/vnd.github.v3+json" \
           -H "Authorization: token ${{ secrets.STAKATER_AB_TOKEN_FOR_RLDR }}" \
           https://api.github.com/repos/stakater-ab/reloader-enterprise/dispatches \
-          -d '{"event_type":"release-published","client_payload":{"tag":"${{ github.event.release.tag_name }}"}}'
+          -d "$payload"