From 62a281dac6a305d058299d3f1c6d758c8bfc0b8c Mon Sep 17 00:00:00 2001
From: jakub-przepiora <jakub.przepioraa@gmail.com>
Date: Tue, 30 Jun 2026 16:52:23 +0200
Subject: [PATCH] fix(ci): pass release-notes vars via env, not ${{ }} shell
 interpolation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Release workflow inlined `LOG="${{ steps.changelog.outputs.log }}"` (and the
dispatch `notes` input) directly into the script body, so commit messages
containing double quotes broke out of the shell string — e.g. a commit titled
... "Components & serials used" ... made bash run `serials` as a command and the
whole release failed with exit 127 ("serials: command not found"), so no ZIP was
attached. Pass VERSION/CUSTOM/LOG through `env:` instead; bash reads the values
verbatim without re-parsing quotes/backticks.
---
 .github/workflows/release.yml | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f35dc8d50..11e7aa51a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -69,10 +69,15 @@ jobs:
 
       - name: Build release notes
         id: notes
+        env:
+          # Pass through env, NOT ${{ }} interpolation into the script body:
+          # commit messages / notes contain quotes and backticks that would
+          # otherwise break out of the shell string (e.g. `"… & serials …"`
+          # ran `serials` as a command and failed the whole release).
+          VERSION: ${{ steps.version.outputs.version }}
+          CUSTOM: ${{ github.event.inputs.notes }}
+          LOG: ${{ steps.changelog.outputs.log }}
         run: |
-          VERSION="${{ steps.version.outputs.version }}"
-          CUSTOM="${{ github.event.inputs.notes }}"
-          LOG="${{ steps.changelog.outputs.log }}"
           BODY=""
           if [ -n "$CUSTOM" ]; then
             BODY="${CUSTOM}"$'\n\n'