Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 12 additions & 3 deletions .github/workflows/regenerate.yml
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,15 @@ name: Regenerate Client

on:
workflow_dispatch:
inputs:
title:
description: PR title, auto-generated from the spec diff in www.
required: false
type: string
summary:
description: PR body summarizing the spec changes.
required: false
type: string

jobs:
regenerate:
Expand Down Expand Up @@ -59,7 +68,7 @@ jobs:
uses: peter-evans/create-pull-request@v6
with:
token: ${{ steps.app-token.outputs.token }}
title: "chore: regenerate client from updated OpenAPI spec"
title: "${{ inputs.title || 'chore: regenerate client from updated OpenAPI spec' }}"
branch: openapi-update-${{ github.run_id }}
commit-message: "chore: regenerate client from OpenAPI spec"
body: "Auto-generated from updated HotData OpenAPI spec."
commit-message: "${{ inputs.title || 'chore: regenerate client from OpenAPI spec' }}"
body: "${{ inputs.summary || 'Auto-generated from updated HotData OpenAPI spec.' }}"
Comment on lines +71 to +74

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: wrapping ${{ ... }} in "..." does textual substitution into a YAML double-quoted scalar, so any " or \ in inputs.title/inputs.summary will produce invalid YAML and fail the step before the action ever runs. Since summary is intended to hold a PR body (likely multi-line markdown with backticks/quotes generated upstream), this is fragile in practice.

Dropping the outer quotes makes the expression result the entire YAML value directly, which avoids re-parsing the substituted text:

Suggested change
title: "${{ inputs.title || 'chore: regenerate client from updated OpenAPI spec' }}"
branch: openapi-update-${{ github.run_id }}
commit-message: "chore: regenerate client from OpenAPI spec"
body: "Auto-generated from updated HotData OpenAPI spec."
commit-message: "${{ inputs.title || 'chore: regenerate client from OpenAPI spec' }}"
body: "${{ inputs.summary || 'Auto-generated from updated HotData OpenAPI spec.' }}"
title: ${{ inputs.title || 'chore: regenerate client from updated OpenAPI spec' }}
branch: openapi-update-${{ github.run_id }}
commit-message: ${{ inputs.title || 'chore: regenerate client from OpenAPI spec' }}
body: ${{ inputs.summary || 'Auto-generated from updated HotData OpenAPI spec.' }}

(not blocking)

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch on the fragility, but dropping the outer quotes breaks raw-YAML parsing here: the fallback string 'chore: regenerate client from updated OpenAPI spec' contains a literal : , so unquoted the value parses as a nested mapping (mapping values are not allowed here). So the quotes need to stay.

Handling the real risk upstream instead: the title is now sanitized at the source in www (notify-sdks.yml / api-docs.yml) with tr -d '\r"\\' | cut -c1-100, stripping quotes/backslashes/newlines and enforcing the length cap before it is ever dispatched here. With the value guaranteed clean, the quoted interpolation is safe. Keeping as-is.

Loading