Quote shell variables in build-library.yml / build-template.yml to resolve shellcheck SC2086 findings #518

Summary

Surfaced while verifying .github/workflows/build-samples*.yml for #511 with actionlint (which runs shellcheck against each run: script). actionlint isn't wired into any CI job today (grep -r actionlint .github/ returns nothing), so nothing is currently failing in CI, but the underlying findings are real and worth fixing as defensive hygiene: several run: steps use unquoted shell variables, which shellcheck flags as SC2086 ("Double quote to prevent globbing and word splitting").

Findings

$ actionlint .github/workflows/build-library.yml .github/workflows/build-template.yml
.github/workflows/build-library.yml:77:9: SC2086 ... (dotnet build step: $BUILD_VERSION x2)
.github/workflows/build-library.yml:85:9: SC2086 ... (dotnet test step: $BUILD_VERSION x2)
.github/workflows/build-library.yml:110:9: SC2086 ... ($GITHUB_STEP_SUMMARY)
.github/workflows/build-library.yml:120:9: SC2086 ... (dotnet pack step: $BUILD_VERSION x2)
.github/workflows/build-template.yml:66:9: SC2086 ... (dotnet pack step: $BUILD_VERSION)

Specifically:

• build-library.yml lines ~77-82 (dotnet build), ~85-89 (dotnet test), ~120-124 (dotnet pack): -p:PackageVersion=$BUILD_VERSION / -p:Version=$BUILD_VERSION should be -p:PackageVersion="$BUILD_VERSION" / -p:Version="$BUILD_VERSION".
• build-library.yml line 110: cat "${{ github.workspace }}/TestResults/SummaryGithub.md" >> $GITHUB_STEP_SUMMARY — the redirect target should be >> "$GITHUB_STEP_SUMMARY".
• build-template.yml line ~66 (dotnet pack DatasyncTemplates.csproj): same -p:Version=$BUILD_VERSION pattern as above.

Impact

Low in practice today — BUILD_VERSION is a semver-shaped string and GITHUB_STEP_SUMMARY is a GitHub-provided file path, neither of which currently contains spaces or glob characters (*, ?, [). But leaving these unquoted is fragile: a future version string format change or an unusual runner temp-path could silently break these steps via word-splitting.

Suggested approach

• Quote the flagged variables as noted above ("$BUILD_VERSION", "$GITHUB_STEP_SUMMARY").
• Re-run actionlint across .github/workflows/ to confirm these are the only findings (build-samples*.yml are already clean per Add CI workflow to build mobile /samples heads: Android, iOS, Uno (Phase 3 of #509) #511's implementation).
• Consider adding an actionlint job to CI (or a pre-commit/local check) so future workflow changes get this kind of feedback automatically, since it isn't run anywhere today.

Should be a pure whitespace/quoting change — no functional impact, build-only verification (actionlint clean, existing workflows continue to trigger/build the same way).

Related

• Add CI workflow to build mobile /samples heads: Android, iOS, Uno (Phase 3 of #509) #511 — Phase 3 samples CI rollout, where this was incidentally discovered while linting new workflow files.