Merge pull request 'Fix release notes not being escaped properly' (#19) from paulvt/forgejo-release:fix-escaping-release-notes into main

Reviewed-on: https://code.forgejo.org/actions/forgejo-release/pulls/19
Reviewed-by: earl-warren <earl-warren@noreply.code.forgejo.org>

.forgejo/workflows/integration.yml

@@ -21,6 +21,17 @@ jobs:
           export FORGEJO_RUNNER_LOGS="${{ steps.forgejo.outputs.runner-logs }}"
           forgejo-test-helper.sh run_workflow testdata/upload-download http://testuser:admin1234@${{ steps.forgejo.outputs.host-port }} testuser upload-download forgejo-release "${{ steps.forgejo.outputs.token }}"
 
+          set -ex
+          export FORGEJO="${{ steps.forgejo.outputs.url }}"
+          curl --fail -sS $FORGEJO/api/v1/repos/testuser/upload-download/releases/tags/v2.0 > /tmp/release.json
+          EXPECTED='No shell expansion should on these notes:
+          - $(some_command)
+          - `other_commend`
+          - "double quoted" and '\''single quoted'\'' strings
+          - \backslash escape
+          - !exclamation_mark'
+          test "$EXPECTED" = "$(jq -r .body < /tmp/release.json)"
+
       - name: testdata/upload-download-private
         run: |
           export FORGEJO_RUNNER_LOGS="${{ steps.forgejo.outputs.runner-logs }}"

action.yml

@@ -81,7 +81,10 @@ runs:
 
         export RELEASE_DIR="${{ inputs.release-dir }}"
 
-        export RELEASENOTES="${{ inputs.release-notes }}"
+        export RELEASENOTES=$(cat << 'EOF'
+        ${{ inputs.release-notes }}
+        EOF
+        )
 
         export SHA="${{ inputs.sha }}"
         if test -z "$SHA"; then

testdata/upload-download/.forgejo/workflows/test.yml

@@ -36,7 +36,13 @@ jobs:
           tag: v2.0
           token: FORGEJO_TOKEN
           release-dir: upload-dir-v2
-          release-notes: "RELEASE NOTES V2"
+          release-notes: |-
+            No shell expansion should on these notes:
+            - $(some_command)
+            - `other_commend`
+            - "double quoted" and 'single quoted' strings
+            - \backslash escape
+            - !exclamation_mark
           verbose: true
       - if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
         id: release-download