Update update-container-tags.yaml

[yeger00]

Putting the branch in as intermediate environment variable as suggested in https://securitylab.github.com/resources/github-actions-untrusted-input/#:~:text=%60)%3B%0A%7D)%3B-,Remediation,-The%20best%20practice

[yeger00]

Hi,
Any update on this?
This is the same flaw as in the ultralytics attack about 2 weeks ago:
Here is the exploit
And here is the fix PR
I found this issue by searching the same code in GitHub search, and used the same fix also suggested by GitHub as mentioned in the description.

Thanks,

[vivian-rook]

Thanks for the patch

[vivian-rook]

I revert this as it seemed to be trying to run a literal
git checkout "$GITHUB_REF"

https://github.com/toolforge/paws/actions/runs/12691704677/job/35375371175?pr=476

This is a legitimate concern, thank you for bringing it to our attention.

https://phabricator.wikimedia.org/T383334

[vivian-rook]

#479 might do it.