From 8f5f41db69dc07cf0c91472e9e83ec9237e6fa8a Mon Sep 17 00:00:00 2001 From: Kalvin Chau Date: Thu, 13 Aug 2026 09:42:29 -0700 Subject: [PATCH] fix(release): forward unix provenance arguments pass the complete positional argument list through the posix shell before invoking bash. avoid dash bad substitution in linux and macos release provenance steps. --- justfile | 2 +- scripts/release/tests/release-scripts.test.mjs | 3 +-- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/justfile b/justfile index a5e2e8eb7..6f8dd3b54 100644 --- a/justfile +++ b/justfile @@ -277,7 +277,7 @@ release-reconcile-assets repository tag version output_file: [unix] [positional-arguments] release-write-provenance source_sha version platform output_dir *ASSETS: - bash -euo pipefail -c 'scripts/release/write-provenance.sh "$@"' _ "$1" "$2" "$3" "$4" "${@:5}" + bash -euo pipefail -c 'scripts/release/write-provenance.sh "$@"' _ "$@" # On Windows, run the shared Bash script as one generated recipe so argv remains # positional and is not interpolated into shell source. diff --git a/scripts/release/tests/release-scripts.test.mjs b/scripts/release/tests/release-scripts.test.mjs index 37ed33f5c..b3f56859c 100644 --- a/scripts/release/tests/release-scripts.test.mjs +++ b/scripts/release/tests/release-scripts.test.mjs @@ -777,8 +777,7 @@ describe("desktop release workflow platform gate", () => { 2, ); expect(provenanceRecipes).toContain( - 'bash -euo pipefail -c \'scripts/release/write-provenance.sh "$@"\' _ "$1" "$2" "$3" "$4" "$' + - '{@:5}"', + 'bash -euo pipefail -c \'scripts/release/write-provenance.sh "$@"\' _ "$@"', ); expect(provenanceRecipes).toContain( 'scripts/release/write-provenance.sh "$1" "$2" "$3" "$4" "$' + '{@:5}"',