Change: Mark bash inputs as literal string

Let bash not interpret the inputs. This fixes using passwords containing special characters like `$`.
greenbone · Jan 16, 2024 · 0312a8e · 0312a8e
1 parent 528b2e8
commit 0312a8e
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/signature/action.yml b/signature/action.yml
@@ -29,13 +29,13 @@ runs:
       shell: bash
       run: |
         echo -e "${{ inputs.gpg-key }}" >> tmp.file
-        gpg --pinentry-mode loopback --passphrase ${{ inputs.gpg-passphrase }} --import tmp.file
+        gpg --pinentry-mode loopback --passphrase '${{ inputs.gpg-passphrase }}' --import tmp.file
         rm tmp.file
     - name: "Create a GPG signature"
       shell: bash
       run: |
         if [ -z "${{ inputs.signature-file }}"]; then
-          gpg --pinentry-mode loopback --local-user ${{ inputs.gpg-fingerprint }} --yes --detach-sign --passphrase ${{ inputs.gpg-passphrase }} --armor ${{ inputs.file }}
+          gpg --pinentry-mode loopback --local-user '${{ inputs.gpg-fingerprint }}' --yes --detach-sign --passphrase '${{ inputs.gpg-passphrase }}' --armor '${{ inputs.file }}'
         else
-          gpg --pinentry-mode loopback --local-user ${{ inputs.gpg-fingerprint }} --yes --detach-sign --passphrase ${{ inputs.gpg-passphrase }} --armor --output ${{ inputs.signature-file }} ${{ inputs.file }}
+          gpg --pinentry-mode loopback --local-user '${{ inputs.gpg-fingerprint }}' --yes --detach-sign --passphrase '${{ inputs.gpg-passphrase }}' --armor --output ${{ inputs.signature-file }} '${{ inputs.file }}'
         fi