From b22bed9db4cc3e0db60f66434db86190c6bdc774 Mon Sep 17 00:00:00 2001 From: Philippos Savvides Date: Sun, 30 Aug 2026 07:45:38 -0700 Subject: [PATCH] fix(ci): pass the release tag through env so actionlint can lint release.yml MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit #87 turned on VALIDATE_GITHUB_ACTIONS, which runs actionlint over every workflow. release.yml does not currently pass it. actionlint feeds `run:` blocks to shellcheck, substituting each `${{ }}` expression with an underscore placeholder of equal length first. At 22 characters, `${{ github.ref_name }}` became: if [ "v$VER" != "______________________" ]; then The left operand starts with a literal `v` and the right operand cannot, so shellcheck reports SC2193 — "the arguments to this comparison can never be equal" — and actionlint exits 1. Binding the expression to an env var and comparing against `$TAG_NAME` removes the placeholder from the compared text, so the check passes. Verified locally: the placeholder form exits 1 on SC2193, the env form exits 0. This is also the pattern GitHub recommends for reaching context values from a run block, since interpolating `${{ }}` straight into a shell script is the script-injection shape. Not exploitable here — the trigger is restricted to `v*` tags — but the safe form is two lines. No behaviour change: same comparison, message, and exit code. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/release.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 4690099..8df0b6a 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -14,10 +14,12 @@ jobs: steps: - uses: actions/checkout@v4 - name: Verify tag matches VERSION, plugin.json, and CHANGELOG + env: + TAG_NAME: ${{ github.ref_name }} run: | VER="$(tr -d '[:space:]' < VERSION)" - if [ "v$VER" != "${{ github.ref_name }}" ]; then - echo "Tag ${{ github.ref_name }} does not match VERSION ($VER)" >&2 + if [ "v$VER" != "$TAG_NAME" ]; then + echo "Tag $TAG_NAME does not match VERSION ($VER)" >&2 exit 1 fi grep -qF "\"version\": \"$VER\"" .claude-plugin/plugin.json || {