@@ -90,9 +90,16 @@ jobs:
           echo "version=$v" >> "$GITHUB_OUTPUT"
       - name: On a tag push, assert the tag matches the csproj Version
         if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/owen-cli-v')
+        # env: indirection (CodeRabbit review), not `csproj_version="${{ ... }}"`
+        # inlined into the script -- this workflow also triggers on pull_request
+        # for paths that include the csproj this value is grep'd from, so a
+        # version string containing shell metacharacters must never be
+        # re-parsed as script text by bash.
+        env:
+          CSPROJ_VERSION: ${{ steps.version.outputs.version }}
         run: |
           tag_version="${GITHUB_REF_NAME#owen-cli-v}"
-          csproj_version="${{ steps.version.outputs.version }}"
+          csproj_version="$CSPROJ_VERSION"
           if [ "$tag_version" != "$csproj_version" ]; then
             echo "FAIL: tag owen-cli-v$tag_version does not match csproj Version $csproj_version"
             echo "Bump <Version> in $CLI_PROJECT to match the tag (or retag) before releasing."
@@ -138,6 +145,12 @@ jobs:
     defaults:
       run:
         shell: bash
+    # env: indirection (CodeRabbit review), not `${{ needs.build-test-pack.outputs.version }}`
+    # inlined directly into each run: script -- a job-level env var reads the
+    # same way everywhere below without bash ever re-parsing the expression
+    # as script text.
+    env:
+      OWEN_CLI_VERSION: ${{ needs.build-test-pack.outputs.version }}
     steps:
       - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4
         with:
@@ -179,7 +192,7 @@ jobs:
           </configuration>
           EOF
       - name: dotnet tool install --global from the packed artifact (isolated source)
-        run: dotnet tool install --global Owen.Cli --version "${{ needs.build-test-pack.outputs.version }}" --configfile "$RUNNER_TEMP/isolated-nuget.config"
+        run: dotnet tool install --global Owen.Cli --version "$OWEN_CLI_VERSION" --configfile "$RUNNER_TEMP/isolated-nuget.config"
       - name: A minimal leak, in a scratch dir with no Own.NET checkout anywhere
         run: |
           mkdir -p "$RUNNER_TEMP/sample"
@@ -197,8 +210,8 @@ jobs:
       - name: owen --version reports the released version
         run: |
           out=$(owen --version)
-          [ "$out" = "${{ needs.build-test-pack.outputs.version }}" ] \
-            || { echo "FAIL: owen --version printed '$out', expected '${{ needs.build-test-pack.outputs.version }}'"; exit 1; }
+          [ "$out" = "$OWEN_CLI_VERSION" ] \
+            || { echo "FAIL: owen --version printed '$out', expected '$OWEN_CLI_VERSION'"; exit 1; }
       - name: owen check finds the leak (--fail-on-finding exits 1, OWN001 present)
         run: |
           set +e
@@ -243,9 +256,9 @@ jobs:
           if command -v owen >/dev/null 2>&1; then
             echo "FAIL: owen still on PATH after uninstall"; exit 1
           fi
-          dotnet tool install --global Owen.Cli --version "${{ needs.build-test-pack.outputs.version }}" --configfile "$RUNNER_TEMP/isolated-nuget.config"
+          dotnet tool install --global Owen.Cli --version "$OWEN_CLI_VERSION" --configfile "$RUNNER_TEMP/isolated-nuget.config"
           out=$(owen --version)
-          [ "$out" = "${{ needs.build-test-pack.outputs.version }}" ] \
+          [ "$out" = "$OWEN_CLI_VERSION" ] \
             || { echo "FAIL: reinstalled owen --version printed '$out'"; exit 1; }
           echo "OK: uninstall -> reinstall reproduces a working install"
 
 
@@ -130,9 +130,13 @@ Three jobs, each gated on the previous succeeding:
    per-OS hint (never an auto-download); and a full **uninstall →
    reinstall** cycle reproduces a working install (reinstall is the same
    code path an upgrade takes).
-3. **`publish`** — `if: startsWith(github.ref, 'refs/tags/owen-cli-v')`,
-   so a `workflow_dispatch` run (no matching tag ref) can never reach this
-   job no matter what inputs are given. Additionally targets the
+3. **`publish`** — `if: github.event_name == 'push' && startsWith(github.ref,
+   'refs/tags/owen-cli-v')`, so neither a `workflow_dispatch` run nor a
+   `pull_request` run can ever reach this job no matter what inputs/ref are
+   given — a bare `startsWith(github.ref, ...)` alone would let
+   `workflow_dispatch --ref owen-cli-v0.1.0` through, since a manual
+   dispatch can be pointed at an existing tag ref too (Codex review, PR
+   #244). Additionally targets the
    `nuget-release` GitHub Environment — **a repo admin must configure that
    environment with required reviewers under Settings → Environments before
    this job can run unattended; it does not exist yet.** Reads