quote bash parameters

move comment note  to top of file

Author: 2bndy5

.github/workflows/binary-builds.yml

@@ -160,7 +160,7 @@ jobs:
           GH_TOKEN: ${{ github.token }}
         run: |
           files=$(ls dist/cpp-linter*)
-          gh release upload ${{ github.ref_name }} $files
+          gh release upload "${{ github.ref_name }}" $files
       - run: cargo publish -p cpp-linter
         env:
           CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}

.github/workflows/bump-n-release.yml

@@ -1,5 +1,7 @@
 name: Bump-n-Release
 
+# NOTE: The change log is only updated in the remote upon release (in `bump-release` job)
+
 on:
   push:
     branches:
@@ -58,5 +60,4 @@ jobs:
           OUTPUT: ${{ runner.temp }}/changes.md
           GITHUB_REPO: ${{ github.repository }}
           GITHUB_TOKEN: ${{ secrets.BUMP_N_RELEASE }}
-      - run: cat ${{ runner.temp }}/changes.md >> $GITHUB_STEP_SUMMARY
-  # NOTE: The change log is updated upon release in `bump-release` job above
+      - run: cat "${{ runner.temp }}/changes.md" >> "$GITHUB_STEP_SUMMARY"

.github/workflows/node-js-packaging.yml

@@ -234,4 +234,4 @@ jobs:
       #     GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       #   run:
       #     files=$(ls ./npm/**cpp-linter.*.node)
-      #     gh release upload ${{ github.ref_name }} $files
+      #     gh release upload "${{ github.ref_name }}" $files

.github/workflows/python-packaging.yml

@@ -192,4 +192,4 @@ jobs:
       #     GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       #   run:
       #     files=$(ls ./dist/cpp-linter*.{whl,atr.gz})
-      #     gh release upload ${{ github.ref_name }} $files
+      #     gh release upload "${{ github.ref_name }}" $files