Read contexts and expressions

A deployment condition reads a trusted ref from context and passes a bounded value through env to the command. This is a small part of a GitHub repository whose workflow tests, builds, packages, and deploys a small site through a protected environment, but the boundary it creates affects everything that follows.

Expressions are evaluated by Actions, while shell variables and quoting are evaluated later by the chosen shell. The useful target is not encyclopedic coverage. Make one deliberate choice, observe its consequences, and know which requirement would make you revise it.

Watch for one shortcut in particular: trying to splice untrusted event text directly into a shell script. It makes later failures harder to locate. Instead, distinguish expression and shell evaluation, pass data through environment, and quote it in the receiving shell. Prefer an implementation you can explain from the outside before optimizing it.

Keep the wider goal in view: Create one workflow whose trigger, runner, permissions, commands, and failure behavior are obvious. A short observation with concrete evidence is more useful than a confident sentence with no reproduction path.

Use a pull request title containing shell characters and prove the workflow treats it only as data. Hand the result to someone else and see whether the behavior is clear without an oral explanation.