Skip to content

ci(release): remove empty ${{ }} expression from bash comment#310

Merged
mateeullahmalik merged 1 commit into
masterfrom
fix/release-workflow-comment-expr-injection
Jul 6, 2026
Merged

ci(release): remove empty ${{ }} expression from bash comment#310
mateeullahmalik merged 1 commit into
masterfrom
fix/release-workflow-comment-expr-injection

Conversation

@mateeullahmalik

Copy link
Copy Markdown
Collaborator

Problem

Every workflow run of Build and Release Workflow on master since #307 landed (commit ea1a9c4) has been dying at dispatch with the workflow startup-failure fingerprint documented in that same PR — status: completed, conclusion: failure, jobs: [], run_started_at == updated_at (sub-second), workflow name reported as the raw file path rather than the name: field.

Verified on:

Root cause

The comment PR #307 added inside the Get tag information step's run: block contains the literal string:

# Prior implementation inlined the message via ${…{ }} interpolation,

(showing here with a ZWSP to avoid re-triggering the bug in the PR body.)

GitHub Actions validates every ${{ … }} expression in the workflow file at dispatch time — including expressions inside bash comments in run: block scalars. It does not know or care that bash would treat the line as a comment; the GHA templating engine parses the whole YAML file first. An empty ${{ }} expression is a syntactic error, so the workflow is rejected before any job is scheduled.

This is the same class of trap as #303#307, just at the comment layer rather than the bash-execution layer.

Fix

Rephrase the comment to describe the prior pattern in English instead of embedding the literal ${{ … }} syntax. No functional change to any step logic.

-          # Prior implementation inlined the message via \${{ }} interpolation,
-          # which let commit-body tokens (e.g. \"deadcode\") execute as bash
-          # and killed v2.6.0-testnet with exit 127. See PR history.
+          # Prior implementation inlined the message via GitHub Actions
+          # expression interpolation, which let commit-body tokens (e.g.
+          # \"deadcode\") execute as bash and killed v2.6.0-testnet with
+          # exit 127. See PR history (#303 / #307).

Verification

Pre-merge on the branch commit 1a36fc8:

  • Run 28756743275Build and Release Workflow (correct name:, not the raw file path), `build` job dispatched (`in_progress`), `release` job `skipped` because branch push doesn't match `refs/tags/v*`. Startup-failure fingerprint is gone.

Next step (not part of this PR)

Once merged, retag `v2.6.0-testnet` onto post-merge master. The workflow's `Check if release already exists` step will hit the pre-existing draft release object and take the idempotent "Upload assets to existing release (preserve manual notes)" path, finally attaching the tarball + binary that the fleet's sn-manager needs.

Risk / rollback

Comment-only diff. Rollback = revert. No behavioural surface.

Follow-up to #307. The comment added in that PR contained the literal
text '${{ }} interpolation' inside a run: bash block. GitHub Actions
validates ${{ ... }} expressions everywhere in the workflow file at
dispatch time — including inside bash comments in run: block scalars.
An empty ${{ }} expression is a validation error, so every push to
master (and every tag push) since #307 landed hits a workflow startup
failure: run accepted, 0 jobs scheduled, run_started_at == updated_at,
conclusion=failure.

Verified failure signature on ea1a9c4 (post-#307 master):
  run 28756586178 / 28756630521 — status=completed, conclusion=failure,
  jobs=[], run_started_at == updated_at.

Also observed on tag push of v2.6.0-testnet retagged onto ea1a9c4:
the release job never scheduled, so assets remained empty.

Fix: rephrase the comment to describe the prior pattern in English
rather than embedding the literal syntax. No functional change to
any step logic.

Signed-off-by: Matee ullah Malik <mateeullahmalik@hotmail.com>
@mateeullahmalik mateeullahmalik merged commit 8eb1754 into master Jul 6, 2026
12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants