From a5ca9c9e9df464169a5995256343d291a7965d57 Mon Sep 17 00:00:00 2001 From: per1234 Date: Sun, 4 Dec 2022 04:08:57 -0800 Subject: [PATCH] Fix formatting of generated release notes The "Arduino IDE" GitHub Actions workflow generates a changelog from the commits since the last tag. This changelog is published in multiple ways: - Printed to workflow run logs - Uploaded to Arduino's download server (mostly useful for the nightly builds) - Initial version of release notes For the last, the changelog text must be passed from the dedicated changelog generation workflow step to the release step. This is done via workflow job output. At the time the system was set up, outputs for workflow `run` steps were set using the `set-output` workflow command. That "workflow command" system was later determined by GitHub to have potential security vulnerabilities, so it was replaced with a `GITHUB_OUTPUT` environment file. The "Arduino IDE" workflow was migrated to the new "environment file" approach. It was later discovered that there was an undocumented breaking change in the method for handling multi-line strings in workflow step outputs between the old "workflow command" system and the new "environment file". This resulted in the initial release notes having an incorrect format. For example, what would previously have been formatted like this: - Updated translation files (#1606) [23c7f5f] - Use 0.29.0 CLI in IDE2 (#1683) [f1144ef] Was now formatted like this: - Updated translation files (#1606) [23c7f5f]%0A - Use 0.29.0 CLI in IDE2 (#1683) [f1144ef]%0A The solution is to remove the commands that did the escaping of the changelog text in a manner that is no longer supported and replace them with a "here document"-style format. A random number is used as the "delimiter" (limit string) per the security recommendations in the official GitHub documentation. Note that even though the multiline strings handling documentation was placed under the environment variable section, it also applies to setting outputs. --- .github/workflows/build.yml | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 5a185a1ae..df1c3d7a7 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -180,10 +180,14 @@ jobs: fi fi echo -e "$BODY" - OUTPUT_SAFE_BODY="${BODY//'%'/'%25'}" - OUTPUT_SAFE_BODY="${OUTPUT_SAFE_BODY//$'\n'/'%0A'}" - OUTPUT_SAFE_BODY="${OUTPUT_SAFE_BODY//$'\r'/'%0D'}" - echo "BODY=$OUTPUT_SAFE_BODY" >> $GITHUB_OUTPUT + + # Set workflow step output + # See: https://docs.github.com/actions/using-workflows/workflow-commands-for-github-actions#multiline-strings + DELIMITER="$RANDOM" + echo "BODY<<$DELIMITER" >> $GITHUB_OUTPUT + echo "$BODY" >> $GITHUB_OUTPUT + echo "$DELIMITER" >> $GITHUB_OUTPUT + echo "$BODY" > CHANGELOG.txt - name: Upload Changelog [GitHub Actions]