ci(H-Coverage): pass github.head_ref via env var instead of inline run interpolation

[kobihikri]

What this does

In .github/workflows/H-Coverage.yml, ${{ github.head_ref }} is currently interpolated directly into the run: shell in two steps (-e GITHUB_HEAD_REF="${{ github.head_ref }}"). This moves it to a top-level env: variable and references it as ${HEAD_REF} in the shell instead.

Why

This follows GitHub's documented guidance to avoid interpolating context values into run: scripts directly — passing them through an environment variable keeps the value literal. It's a small, behavior-preserving hardening (the container still receives the same GITHUB_HEAD_REF).

 env:
+  HEAD_REF: ${{ github.head_ref }}
 ...
-            -e GITHUB_HEAD_REF="${{ github.head_ref }}" \
+            -e GITHUB_HEAD_REF="${HEAD_REF}" \

Two lines changed plus one env entry; no functional change.

---

Disclosure: I used an AI tool to help prepare this; I verified the change against the workflow myself and take responsibility for it. Happy to adjust to your preferred style.

[CLAassistant]

All committers have signed the CLA.

[risemeup1111]

已完成首轮代码审查，未发现需要阻塞合入的问题。改动范围很小，github.head_ref 已通过 env 中转并在 shell 中以引用变量传给容器，未看到行为回退。

当前仍有 CLA 检查处于 pending 状态，合入前需要作者按 CLA assistant 提示完成。

^{Powered by Nyanpasu with gpt-5.5 xhigh, please check the suggestions carefully.}

[PaddlePaddle-bot]

🤖 Paddle-CI-Agent | pr_review | 2026-07-14 22:59:47

📋 Review 摘要

PR 概述：将 H-Coverage workflow 中 github.head_ref 先写入 HEAD_REF env，再在两处 docker run 中以 ${HEAD_REF} 传给容器，避免在 run 脚本里直接插值。

变更范围：.github/workflows/H-Coverage.yml

影响面 Tag：[Execute Infrastructure]

问题

级别	文件	概述
-	-	未发现阻塞性问题。PR 规范问题在下面章节报，不在这里重复。

📝 PR 规范检查

标题未使用仓库要求的 [Tag] 标题描述 格式，描述也缺少 ### PR Category、### PR Types、### Description、### 是否引起精度变化 四个必填 section。建议直接替换为以下内容。

标题建议（可直接复制）：

[Execute Infrastructure] Harden H-Coverage head_ref env handling

PR 描述建议（点击展开，可直接复制）

### PR Category
<!-- One of [ User Experience | Execute Infrastructure | Operator Mechanism | CINN | Custom Device | Performance Optimization | Distributed Strategy | Parameter Server | Communication Library | Auto Parallel | Inference | Environment Adaptation ] -->
Execute Infrastructure

### PR Types
<!-- One of [ New features | Bug fixes | Improvements | Performance | BC Breaking | Deprecations | Docs | Devs | Not User Facing | Security | Others ] -->
Security

### Description
<!-- Describe what you’ve done -->
In `.github/workflows/H-Coverage.yml`, move `github.head_ref` into the workflow `HEAD_REF` environment variable and pass it to both coverage containers as `GITHUB_HEAD_REF="${HEAD_REF}"`. This avoids direct GitHub context interpolation inside `run` shell scripts while preserving the container environment value.

Scope: H-Coverage GitHub Actions workflow only.

Verification: reviewed the workflow diff and shell environment expansion path; no Paddle runtime behavior is changed.

### 是否引起精度变化
<!-- one of the following [ 是 | 否 ]-->
否

总体评价

变更思路符合 GitHub Actions 对 run 脚本中上下文值处理的加固方向，当前未发现阻塞性代码问题。合入前建议补齐 PR 标题和描述模板。

[paddle-bot]

你的PR提交成功，感谢你对开源项目的贡献!
请关注后续CI自动化测试结果，详情请参考Paddle-CI手册。
Your PR has been submitted. Thanks for your contribution!
Please wait for the result of CI firstly. See Paddle CI Manual for details.