platformsh / gha-prep-for-autopr

Preps a repository to allow for auto-merging of pull requests.
1 stars 0 forks source link

GitHub variable expansion and quoting issues #7

Closed gilzow closed 1 year ago

gilzow commented 1 year ago

Even if the original variable was set with quotes, when GitHub performs it's internal variable expansion (i.e. ${{ inputs.some_var }} it doesn't include the quoting. So if you do:

bar="biz / baz"
echo "foo=${bar}" >> $GITHUB_OUTPUT

in one step, and then in a later step do

myVar=${{ steps.previous_step.outputs.foo }}

This will throw an error as the way GitHub performs the expansion is to dump it back into the shell.

See this example: https://github.com/platformsh-templates/wordpress-composer/actions/runs/4684592646/jobs/8300899655#step:4:19

For any shell variable assignments using GitHub variable expansions we need to make sure we quote them, especially if the original source is from an external source (inputs, vars, secrets, etc)