ci: fix Discord notification failing on issue titles with quotes#22
Merged
Conversation
…titles)
The "Notify Discord" step in the issue-opened workflow hand-built its JSON
by interpolating ${{ github.event.issue.title }} straight into the curl
-d string. Any title containing a double quote (or backslash/control char)
produced invalid JSON and Discord rejected it (code 50109), so the step
failed and no notification was sent. Issues #25 and #26 (quoted titles)
hit exactly this.
Encode the payload with `jq -n --arg`, and pass the title/URL via env vars
(which also closes a shell-injection vector from `${{ }}` in `run:`).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The
issues: openedworkflow's Notify Discord step hand-built its JSON payload by interpolating${{ github.event.issue.title }}straight into thecurl -dstring. Any issue title containing a"(or\, or a control char) produced invalid JSON, so Discord rejected it:The step exited non-zero and no notification was sent. This is independent of how the issue is created (web UI,
gh, API) — it is purely about the title characters. Plain-titled issues happened to work.Fix
jq -n --arg content ... '{content: $content}'so the title is JSON-escaped correctly.ISSUE_TITLE/ISSUE_URL/DISCORD_WEBHOOK_URLviaenv:instead of inline${{ }}in therun:block — this also closes a shell-injection vector (a crafted title like`id`/$(...)would otherwise execute on the runner).Verified locally: the new pipeline yields valid JSON for a hostile title (
Man0u0 "Flowers for All" — Ul'dah; $(whoami) \id` \backslash`), with the injection payload appearing as literal text.The same fix is applied to the sibling repos (Garlemald-Client, meteor-decomp). No approval needed — self-merge once CI is green.
🤖 Generated with Claude Code