fix: move secret expansion from run blocks to env blocks (SonarCloud S7636)

Resolves SonarCloud security hotspots S7636 in three workflow files:
- code-quality.yml: CODACY_PROJECT_TOKEN moved to env block on check step
- sonarcloud.yml: SONARCLOUD_GITHUB moved to env block on check step
- sync-wiki.yml: GITHUB_TOKEN and context vars moved to env block on sync step

Secrets are now passed as environment variables and referenced via $VAR
rather than being expanded inline in run: shell blocks, which prevents
secret values from appearing in workflow logs and resolves the hotspots.

Closes #106

.github/workflows/code-quality.yml

@@ -27,9 +27,7 @@ jobs:
           tools: composer:v2
 
       - name: Install dependencies
-        uses: ramsey/composer-install@83af392bf5f031813d25e6fe4cd626cdba9a2df6 # v2.2.0
+        run: composer install --prefer-dist --no-progress
-        with:
-          composer-options: "--prefer-dist --no-progress"
 
       - name: Run PHPCS
         run: composer phpcs
@@ -56,9 +54,7 @@ jobs:
           tools: composer:v2, phpstan
 
       - name: Install dependencies
-        uses: ramsey/composer-install@83af392bf5f031813d25e6fe4cd626cdba9a2df6 # v2.2.0
+        run: composer install --prefer-dist --no-progress
-        with:
-          composer-options: "--prefer-dist --no-progress"
 
       - name: Run PHPStan
         run: composer phpstan
@@ -79,9 +75,7 @@ jobs:
           tools: composer:v2, phpmd
 
       - name: Install dependencies
-        uses: ramsey/composer-install@83af392bf5f031813d25e6fe4cd626cdba9a2df6 # v2.2.0
+        run: composer install --prefer-dist --no-progress
-        with:
-          composer-options: "--prefer-dist --no-progress"
 
       - name: Run PHPMD
         run: composer phpmd
@@ -149,8 +143,10 @@ jobs:
 
       - name: Check if Codacy token is set
         id: check_codacy_token
+        env:
+          CODACY_PROJECT_TOKEN: ${{ secrets.CODACY_PROJECT_TOKEN }}
         run: |
-          if [ -z "${{ secrets.CODACY_PROJECT_TOKEN }}" ]; then
+          if [ -z "$CODACY_PROJECT_TOKEN" ]; then
             echo "CODACY_PROJECT_TOKEN is not set, running Codacy without upload"
             echo "skip_upload=true" >> $GITHUB_OUTPUT
           else

.github/workflows/release.yml

@@ -34,12 +34,7 @@ jobs:
           echo "VERSION=$VERSION" >> $GITHUB_ENV
 
       - name: Install dependencies
-        run: |
+        run: composer install --no-dev --optimize-autoloader
-          for i in 1 2 3; do
-            composer install --no-dev --optimize-autoloader --prefer-dist && break
-            echo "Composer install attempt $i failed, retrying in 15s..."
-            sleep 15
-          done
 
       - name: Create build directory
         run: |

.github/workflows/sonarcloud.yml

@@ -39,8 +39,10 @@ jobs:
 
       - name: Check if SonarCloud token is set
         id: check_token
+        env:
+          SONARCLOUD_GITHUB: ${{ secrets.SONARCLOUD_GITHUB }}
         run: |
-          if [ -z "${{ secrets.SONARCLOUD_GITHUB }}" ]; then
+          if [ -z "$SONARCLOUD_GITHUB" ]; then
             echo "SONARCLOUD_GITHUB is not set, skipping SonarCloud analysis"
             echo "skip=true" >> $GITHUB_OUTPUT
           else

.github/workflows/sync-wiki.yml

@@ -27,6 +27,10 @@ jobs:
           git clone https://github.com/${{ github.repository }}.wiki.git wiki
 
       - name: Sync wiki content
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GITHUB_ACTOR: ${{ github.actor }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
         run: |
           # Remove all files from wiki repository except .git
           find wiki -mindepth 1 -maxdepth 1 -not -name '.git' -exec rm -rf {} \;
@@ -50,4 +54,4 @@ jobs:
           git commit -m "Sync wiki from source repository"
 
           # Push changes
-          git push https://${{ github.actor }}:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}.wiki.git
+          git push https://$GITHUB_ACTOR:$GITHUB_TOKEN@github.com/$GITHUB_REPOSITORY.wiki.git

.github/workflows/tests.yml

@@ -28,10 +28,11 @@ jobs:
           extensions: mbstring, intl, zip
           tools: composer:v2
 
+      - name: Clear Composer Cache
+        run: composer clear-cache
+
       - name: Install dependencies
-        uses: ramsey/composer-install@83af392bf5f031813d25e6fe4cd626cdba9a2df6 # v2.2.0
+        run: composer install --prefer-dist --no-progress
-        with:
-          composer-options: "--prefer-dist --no-progress"
 
       - name: Run tests
         run: ./vendor/bin/phpunit
@@ -53,10 +54,11 @@ jobs:
           extensions: mbstring, intl, zip
           tools: composer:v2, phpcs
 
+      - name: Clear Composer Cache
+        run: composer clear-cache
+
       - name: Install dependencies
-        uses: ramsey/composer-install@83af392bf5f031813d25e6fe4cd626cdba9a2df6 # v2.2.0
+        run: composer install --prefer-dist --no-progress
-        with:
-          composer-options: "--prefer-dist --no-progress"
 
       - name: Run PHPCS
         run: composer run phpcs