Aaron Bockelie 6358d31fdd fix(ci): harden release.yml against shell injection in notes ... The previous template inlined ${{ inputs.release_notes }} directly into a double-quoted bash NOTES="..." assignment, so backticks (or $vars) in the notes were evaluated by the shell as command substitution. Today's 0.11.30 release hit this — backticks in the ADR-107 release notes blew up the heredoc and failed the workflow before tag creation. Switch the templated values to env-var bindings (RELEASE_NAME, RELEASE_VERSION, RELEASE_NOTES_INPUT) and assemble the markdown via printf so the notes are treated as data, not code.		2026-05-24 17:11:06 -05:00
..
build.yml	fix(mcp): stop debug route shadowing the GET /mcp SSE stream + two-row Levenshtein	2026-05-18 21:05:22 -05:00
feature-release.yml	ci: Bump actions/checkout from 3 to 6 (#48)	2025-12-14 22:45:52 -06:00
release.yml	fix(ci): harden release.yml against shell injection in notes	2026-05-24 17:11:06 -05:00
scorecard-watch.yml	feat(scorecard): scheduled regression gate vs committed baseline (#165)	2026-05-16 23:42:05 -05:00
security.yml	ci: Bump github/codeql-action from 3 to 4 (#49)	2025-12-14 22:45:54 -06:00
test.yml	ci: Bump actions/checkout from 3 to 6 (#48)	2025-12-14 22:45:52 -06:00