aaronsb_obsidian-mcp-plugin/.github/workflows/release.yml
Aaron Bockelie 6358d31fdd fix(ci): harden release.yml against shell injection in notes
The previous template inlined ${{ inputs.release_notes }} directly into
a double-quoted bash NOTES="..." assignment, so backticks (or $vars) in
the notes were evaluated by the shell as command substitution. Today's
0.11.30 release hit this — backticks in the ADR-107 release notes blew
up the heredoc and failed the workflow before tag creation.

Switch the templated values to env-var bindings (RELEASE_NAME,
RELEASE_VERSION, RELEASE_NOTES_INPUT) and assemble the markdown via
printf so the notes are treated as data, not code.
2026-05-24 17:11:06 -05:00

99 lines
No EOL
3.2 KiB
YAML

name: Create Release
on:
workflow_dispatch:
inputs:
release_notes:
description: 'Additional release notes (optional)'
required: false
type: string
env:
PLUGIN_NAME: obsidian-mcp-plugin
permissions:
contents: write
id-token: write # required for build-provenance attestation (#164)
attestations: write # required for build-provenance attestation (#164)
jobs:
build:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
with:
fetch-depth: 0 # Fetch full history for version bumping
- name: Use Node.js
uses: actions/setup-node@v6
with:
node-version: '20'
- name: Install dependencies
run: npm ci
- name: Lint code
run: npm run lint
- name: Run tests
run: npm run test
- name: Build plugin
run: npm run build
- name: Build MCPB bundle
run: node scripts/build-mcpb.mjs
- name: Get version from manifest
id: version
run: |
echo "version=$(jq -r '.version' manifest.json)" >> $GITHUB_OUTPUT
echo "name=$(jq -r '.name' manifest.json)" >> $GITHUB_OUTPUT
- name: Check if version tag exists
id: check_tag
run: |
if git rev-parse "${{ steps.version.outputs.version }}" >/dev/null 2>&1; then
echo "exists=true" >> $GITHUB_OUTPUT
else
echo "exists=false" >> $GITHUB_OUTPUT
fi
- name: Attest build provenance
if: steps.check_tag.outputs.exists == 'false'
uses: actions/attest-build-provenance@v2
with:
# Attest every asset Obsidian installs (main.js, manifest.json,
# styles.css) plus the .mcpb bundles. The portal flags any
# installable asset lacking attestation — #164 originally missed
# styles.css/manifest.json.
subject-path: |
main.js
manifest.json
styles.css
obsidian-mcp-${{ steps.version.outputs.version }}.mcpb
obsidian-mcp.mcpb
- name: Create Release
if: steps.check_tag.outputs.exists == 'false'
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
RELEASE_NAME: ${{ steps.version.outputs.name }}
RELEASE_VERSION: ${{ steps.version.outputs.version }}
# Bind via env to avoid shell interpretation of user-supplied notes
# (backticks, $vars, etc. in the notes must NOT be evaluated).
RELEASE_NOTES_INPUT: ${{ inputs.release_notes }}
run: |
NOTES=$(printf '## %s %s\n\n%s\n\n### Installation via BRAT\n1. Install the BRAT plugin if you haven'\''t already\n2. Command palette → "BRAT: Add a beta plugin for testing"\n3. Enter: `aaronsb/obsidian-mcp-plugin`\n4. Enable the plugin in Community Plugins\n' "$RELEASE_NAME" "$RELEASE_VERSION" "$RELEASE_NOTES_INPUT")
gh release create "$RELEASE_VERSION" \
--title "$RELEASE_NAME $RELEASE_VERSION" \
--generate-notes \
--notes "$NOTES" \
--prerelease \
main.js \
manifest.json \
styles.css \
"obsidian-mcp-$RELEASE_VERSION.mcpb" \
obsidian-mcp.mcpb