aaronsb_obsidian-mcp-plugin/.github
Aaron Bockelie 6358d31fdd fix(ci): harden release.yml against shell injection in notes
The previous template inlined ${{ inputs.release_notes }} directly into
a double-quoted bash NOTES="..." assignment, so backticks (or $vars) in
the notes were evaluated by the shell as command substitution. Today's
0.11.30 release hit this — backticks in the ADR-107 release notes blew
up the heredoc and failed the workflow before tag creation.

Switch the templated values to env-var bindings (RELEASE_NAME,
RELEASE_VERSION, RELEASE_NOTES_INPUT) and assemble the markdown via
printf so the notes are treated as data, not code.
2026-05-24 17:11:06 -05:00
..
ISSUE_TEMPLATE docs: Add comprehensive project documentation and security audit 2025-07-12 00:14:45 -05:00
workflows fix(ci): harden release.yml against shell injection in notes 2026-05-24 17:11:06 -05:00
dependabot.yml ci: Enable Dependabot for automated dependency updates 2025-12-03 12:43:00 -06:00
FUNDING.yml feat: Add GitHub Sponsors integration 2025-08-13 07:12:15 -05:00
pull_request_template.md docs: Add comprehensive project documentation and security audit 2025-07-12 00:14:45 -05:00