🐛 fix(ci): remove ${{ ... }} expression from comment that still gets interpolated

Follow-up to PR #38. That PR fixed the SHELL line (replaced
${{ github.event.head_commit.message }} with git log) but kept a comment
mentioning the expression literally. Comments are not exempt: the
runner template engine interpolates ${{ ... }} BEFORE bash sees the
script, so the multi-line commit body still ended up injected mid-comment
and broke bash parsing on the next line.

Symptom (still fired on PRs #40-#45 even after PR #38):
  /var/run/act/workflow/12.sh: line 32: syntax error: unexpected newline
    Failure - Update badges and version

Fix: rewrite the comment without the literal expression. The other 3
references to head_commit.message in this file are inside job-level if:
contains(...) checks which are evaluated server-side as booleans, not
interpolated into shell — those are safe and unchanged.

Lesson for the verifier checklist: when fixing template-injection bugs,
search the WHOLE FILE for the expression including comments, not just
active code lines.
This commit is contained in:
2026-05-05 09:33:44 +02:00
parent 2eb69f2709
commit b16f78294d

View File

@@ -299,10 +299,11 @@ jobs:
# Check for version bump on main branch # Check for version bump on main branch
if [ "${{ github.ref }}" = "refs/heads/main" ]; then if [ "${{ github.ref }}" = "refs/heads/main" ]; then
echo "🔖 Checking for version bump..." echo "🔖 Checking for version bump..."
# Always read from git log: ${{ github.event.head_commit.message }} expression # Read commit message from git, NOT from the workflow event payload.
# is interpolated literally into the shell script, so any backtick, unbalanced # The event-payload expression is interpolated literally into the
# quote, or special char in a commit body breaks the next line of the script # rendered script (even inside comments — see PR #38 + #46), so any
# (observed on PR #32-#35: 'syntax error: unexpected newline'). git log is safe. # backtick / unbalanced quote / multi-line body breaks bash parsing.
# git log is interpolation-free and safe.
COMMIT_MSG=$(git log -1 --pretty=%B) COMMIT_MSG=$(git log -1 --pretty=%B)
./scripts/ci-version-bump.sh "$COMMIT_MSG" --no-push ./scripts/ci-version-bump.sh "$COMMIT_MSG" --no-push
fi fi