From 93c552df6f2640bb11682c7ab6f11f3303b33640 Mon Sep 17 00:00:00 2001
From: Zbigniew Sobiecki <zbigniew@sobiecki.name>
Date: Mon, 22 Jun 2026 13:59:16 +0200
Subject: [PATCH] fix(ci): build release PR body via --body-file to avoid
 shell-quoting failures

The release workflow interpolated commit headlines into the gh pr create
command via GitHub Actions env-expression expansion. A headline containing a
double-quote or backtick was pasted raw into the shell and broke argument
parsing, aborting the release with an unknown-argument error.

Read COMMITS / COMMIT_COUNT as shell env vars and write the PR body to a temp
file consumed with --body-file, so arbitrary commit messages are safe. The same
shell-var fix is applied to the pre-merge step summary.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 .github/workflows/release.yml | 24 ++++++++++++++++--------
 1 file changed, 16 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 841ee93ad..4fe736110 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -51,10 +51,10 @@ jobs:
           echo "" >> "$GITHUB_STEP_SUMMARY"
           echo "**Mode:** ${{ inputs.dry_run && 'Dry run (validation only)' || 'Live merge' }}" >> "$GITHUB_STEP_SUMMARY"
           echo "" >> "$GITHUB_STEP_SUMMARY"
-          echo "### Commits to be released (${{ env.COMMIT_COUNT }}):" >> "$GITHUB_STEP_SUMMARY"
+          echo "### Commits to be released ($COMMIT_COUNT):" >> "$GITHUB_STEP_SUMMARY"
           echo "" >> "$GITHUB_STEP_SUMMARY"
           echo '```' >> "$GITHUB_STEP_SUMMARY"
-          echo "${{ env.COMMITS }}" >> "$GITHUB_STEP_SUMMARY"
+          echo "$COMMITS" >> "$GITHUB_STEP_SUMMARY"
           echo '```' >> "$GITHUB_STEP_SUMMARY"
 
       - name: Dry run - show diff summary
@@ -81,14 +81,22 @@ jobs:
       - name: Create release PR
         if: ${{ !inputs.dry_run }}
         run: |
+          # Build the PR body via a file using SHELL env vars ($COMMITS), NOT
+          # GitHub Actions expression interpolation, so a commit message that
+          # contains a double-quote or backtick is not pasted raw into the gh
+          # command (which previously aborted the release with "unknown argument").
+          BODY_FILE="$(mktemp)"
+          {
+            echo "Automated release PR created by the release workflow."
+            echo ""
+            echo "### Commits ($COMMIT_COUNT):"
+            echo '```'
+            echo "$COMMITS"
+            echo '```'
+          } > "$BODY_FILE"
           PR_URL=$(gh pr create --base main --head dev \
             --title "chore: release - merge dev into main" \
-            --body "Automated release PR created by the release workflow.
-
-          ### Commits (${{ env.COMMIT_COUNT }}):
-          \`\`\`
-          ${{ env.COMMITS }}
-          \`\`\`")
+            --body-file "$BODY_FILE")
           echo "Created PR: $PR_URL"
           PR_NUMBER=$(echo "$PR_URL" | grep -o '[0-9]*$')
           echo "PR_NUMBER=$PR_NUMBER" >> "$GITHUB_ENV"