From 10675102dd6a76a26d92b38337ff2cea76912b96 Mon Sep 17 00:00:00 2001 From: Samuel Stegall Date: Sun, 31 May 2026 15:20:42 -0500 Subject: [PATCH] ci: drop literal ${{ }} from Discord-step comment (fixes invalid workflow file) GitHub Actions parses ${{ }} expressions inside the entire run: block, including shell # comments. The comment added in the previous Discord-payload fix referenced ${{ }} literally, which produced "An expression was expected" (Line 36) and invalidated the whole workflow. Reworded the comment so no template-expression token appears anywhere in the run: block. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/add_issues_to_project.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/add_issues_to_project.yml b/.github/workflows/add_issues_to_project.yml index 209b57e..ed7c63f 100644 --- a/.github/workflows/add_issues_to_project.yml +++ b/.github/workflows/add_issues_to_project.yml @@ -37,7 +37,8 @@ jobs: # Build the payload with jq so titles containing quotes, backslashes, # or other JSON-special characters are escaped correctly (a raw # interpolated title broke the JSON -> Discord 50109). Passing the - # title/URL via env also avoids shell-injection from `${{ }}` in `run:`. + # title/URL via env (rather than inlining template expressions in the + # run block) also avoids shell injection from untrusted issue titles. content="$(printf '<@&1510380634349109440>, Issue created for Garlemald Client.\nTitle: %s\n%s' "$ISSUE_TITLE" "$ISSUE_URL")" jq -n --arg content "$content" '{content: $content}' \ | curl -sS -X POST "$DISCORD_WEBHOOK_URL" \