Skip to content

fix: release workflow — use github.token and handle first release #515

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
automagik-genie merged 1 commit into from
Mar 9, 2026
Merged

fix: release workflow — use github.token and handle first release #515

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 10 additions & 7 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ jobs:
- name: Check if release already exists
id: exists
env:
GH_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN }}
GH_TOKEN: ${{ github.token }}
run: |
TAG="v${{ steps.pkg.outputs.version }}"

Expand All @@ -44,7 +44,7 @@ jobs:
id: prev
if: steps.exists.outputs.skip != 'true'
env:
GH_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN }}
GH_TOKEN: ${{ github.token }}
run: |
TAG="v${{ steps.pkg.outputs.version }}"
PREV=$(gh release list --limit 50 --json tagName -q '.[].tagName' | grep -v "^${TAG}$" | head -1)
Expand All @@ -54,21 +54,24 @@ jobs:
- name: Generate changelog
uses: orhun/git-cliff-action@v4
id: cliff
if: steps.exists.outputs.skip != 'true'
if: steps.exists.outputs.skip != 'true' && steps.prev.outputs.tag != ''
with:
config: cliff.toml
args: ${{ steps.prev.outputs.tag && format('{0}..HEAD', steps.prev.outputs.tag) || 'HEAD~20..HEAD' }}
args: ${{ format('{0}..HEAD', steps.prev.outputs.tag) }}
env:
GITHUB_REPO: ${{ github.repository }}

- name: Create release
if: steps.exists.outputs.skip != 'true'
env:
GH_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN }}
RELEASE_NOTES: ${{ steps.cliff.outputs.content }}
GH_TOKEN: ${{ github.token }}
run: |
TAG="v${{ steps.pkg.outputs.version }}"
printf '%s' "$RELEASE_NOTES" > /tmp/release-notes.md
NOTES="${{ steps.cliff.outputs.content }}"

@chatgpt-codex-connector chatgpt-codex-connector Bot Mar 7, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Avoid interpolating release notes directly into shell code

The Create release step now inlines steps.cliff.outputs.content into NOTES="...", which means GitHub expression expansion happens before Bash parsing; if the changelog contains characters like ", backticks, or $() (common in commit subjects/body text), the script can break or perform command substitution, causing release jobs to fail unpredictably. This regression is introduced by moving from an env var to direct inline assignment, so release notes should be passed in a way that bypasses shell parsing.

Useful? React with 👍 / 👎.

if [ -z "$NOTES" ]; then
NOTES="Initial release of genie v3 CLI."
fi
Comment on lines +71 to +73

@coderabbitai coderabbitai Bot Mar 7, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

Fallback message may be misleading on subsequent releases.

If git-cliff runs (previous tag exists) but produces empty output—e.g., only merge commits or non-conventional messages—the fallback claims "Initial release of genie v3 CLI." which would be incorrect for a non-initial release.

Consider a more generic fallback like "No notable changes." or check whether the cliff step was skipped vs ran-but-empty.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/release.yml around lines 71 - 73, The fallback NOTES
assignment currently sets "Initial release of genie v3 CLI." which can be
incorrect when git-cliff ran but produced no output; update the logic in the
release workflow to use a neutral fallback (e.g., set NOTES="No notable
changes.") or add a check that distinguishes the git-cliff step being skipped vs
run-but-empty (inspect the git-cliff output variable or file before assigning
NOTES) so the fallback no longer claims an initial release; update the block
that assigns the NOTES variable accordingly.

printf '%s' "$NOTES" > /tmp/release-notes.md
Comment on lines +70 to +74

@coderabbitai coderabbitai Bot Mar 7, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

Shell injection risk: avoid direct interpolation of multi-line content.

${{ steps.cliff.outputs.content }} is interpolated into the shell string before execution. If the changelog contains quotes, backticks, $, or newlines, this can break parsing or cause unexpected behavior. Pass via environment variable instead.

Proposed fix 
       - name: Create release
         if: steps.exists.outputs.skip != 'true'
         env:
           GH_TOKEN: ${{ github.token }}
+          CLIFF_NOTES: ${{ steps.cliff.outputs.content }}
         run: |
           TAG="v${{ steps.pkg.outputs.version }}"
-          NOTES="${{ steps.cliff.outputs.content }}"
+          NOTES="${CLIFF_NOTES}"
           if [ -z "$NOTES" ]; then
             NOTES="Initial release of genie v3 CLI."
           fi
           printf '%s' "$NOTES" > /tmp/release-notes.md
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
NOTES="${{ steps.cliff.outputs.content }}"
if [ -z "$NOTES" ]; then
NOTES="Initial release of genie v3 CLI."
fi
printf '%s' "$NOTES" > /tmp/release-notes.md
- name: Create release
if: steps.exists.outputs.skip != 'true'
env:
GH_TOKEN: ${{ github.token }}
CLIFF_NOTES: ${{ steps.cliff.outputs.content }}
run: |
TAG="v${{ steps.pkg.outputs.version }}"
NOTES="${CLIFF_NOTES}"
if [ -z "$NOTES" ]; then
NOTES="Initial release of genie v3 CLI."
fi
printf '%s' "$NOTES" > /tmp/release-notes.md
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/release.yml around lines 70 - 74, Replace the inline
interpolation of `${{ steps.cliff.outputs.content }}` with an environment
variable to avoid shell injection: set an env entry (e.g. env: NOTES: ${{
steps.cliff.outputs.content }}) on the workflow step that writes the file, then
use the already-present printf '%s' "$NOTES" > /tmp/release-notes.md (ensure the
printf uses the quoted "$NOTES"). This keeps the multi-line/unsafe content out
of the command string while preserving the original behavior.

gh release create "${TAG}" \
--target "${{ github.sha }}" \
--title "${TAG}" \
Expand Down
Loading