Fix release notes quoting; release HTML to Text as v0.3.0 - #6
Merged
Merged
Conversation
The Release workflow interpolated the notes into the gh command with ${{ }},
so backticks in the changelog ran as command substitution. The v0.2.3 run died
after pushing its tag, leaving no GitHub release and no deploy.
Also records HTML to Text under [Unreleased] (PR #5 shipped without an entry,
so its merge released nothing) and ignores tmp/.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two reasons nothing new has been deployed since v0.2.2.
1. The v0.2.3 Release run failed (run 35978735265)
The "Create the GitHub release" step passed the notes as
--notes "${{ steps.cut.outputs.notes }}". GitHub substitutes${{ }}into the script text before bash parses it. So the backticks in the 0.2.3 notes (`display: flex`,`<code>`) ran as command substitution:The failure came after the changelog commit and the
v0.2.3tag had already been pushed. The result:It is also a script-injection hole: any changelog text is executed as shell.
Fix:
TAGandNOTESare now passed to that step as env vars, and the script only references"$TAG"/"$NOTES". I reproduced the exact CI error locally with the old form, and confirmed the new form prints the notes unchanged.deploy.ymlandci.ymluse${{ }}only inwith:inputs, which bash never parses.2. Merging #5 released nothing
#5 didn't add anything under
[Unreleased]in CHANGELOG.md. An empty[Unreleased]releases nothing, as designed. This PR adds the entry.Also
tmp/is now in.gitignore.What merging this does
scripts/release.ts --dry-rungivesbump: minor,0.2.3 -> 0.3.0. v0.3.0 will be deployed, containing HTML to Text plus the 0.2.3 fixes that never shipped. Its notes contain backticks, so this first run also tests the fix.v0.2.3 still has no GitHub release entry. It can be backfilled by hand if you want the list complete.