Skip to content

Commit df083df

Browse files
authored
fix: avoid shell interpretation of PR body in CI workflows (#1280)
Use environment variables and printf instead of direct template substitution to prevent backticks and special characters in PR body from being interpreted as shell commands.
1 parent f177ca3 commit df083df

File tree

2 files changed

+8
-4
lines changed

2 files changed

+8
-4
lines changed

.github/workflows/pr-close-issue.yml

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,11 @@ jobs:
1212
- name: Check for issue number
1313
id: check_issue
1414
shell: bash
15+
env:
16+
PR_BODY: ${{ github.event.pull_request.body }}
1517
run: |
16-
# Store PR body in a file to avoid shell interpretation issues
17-
echo '${{ github.event.pull_request.body }}' > pr_body.txt
18+
# Store PR body in a file using env var to avoid shell interpretation issues
19+
printf '%s' "$PR_BODY" > pr_body.txt
1820
1921
# Check for issue reference pattern
2022
if grep -q "#[0-9]\\+" pr_body.txt; then

.github/workflows/pr-package.yml

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,9 +19,11 @@ jobs:
1919
- name: Check for issue number
2020
id: check_issue
2121
shell: bash
22+
env:
23+
PR_BODY: ${{ github.event.pull_request.body }}
2224
run: |
23-
# Store PR body in a file to avoid shell interpretation issues
24-
echo '${{ github.event.pull_request.body }}' > pr_body.txt
25+
# Store PR body in a file using env var to avoid shell interpretation issues
26+
printf '%s' "$PR_BODY" > pr_body.txt
2527
2628
# Check for issue reference pattern
2729
if grep -q "#[0-9]\\+" pr_body.txt; then

0 commit comments

Comments
 (0)