Refactor release notes creation to use printf for safer handling of special characters

[MishaKav]

✨ PR Description

Purpose: Refactor release notes generation in GitHub Actions workflow to use printf instead of heredoc for safer handling of special characters.
Main changes:

• Replaced heredoc-based release notes creation with printf command to properly escape special characters
• Eliminated intermediary variables for PR title, release notes, and PR number
• Added explanatory comment about the change's purpose

Generated by LinearB AI and added by gitStream.
_{AI-generated content may contain inaccuracies. Please verify before using. We'd love your feedback! 🚀}

[Copilot]

Pull Request Overview

This PR refactors the release notes creation process in the GitHub Actions workflow to use printf instead of heredoc syntax for safer handling of special characters that might be present in PR titles and descriptions.

• Replaces heredoc (cat > file << EOF) with printf for generating release notes
• Eliminates intermediate shell variables that could cause issues with special characters
• Maintains the same release notes format while improving robustness

[orca-security-us]

Orca Security Scan Summary

Status	Check	Issues by priority
Passed	Infrastructure as Code	0   0   0   0	View in Orca
Passed	SAST	0   0   0   0	View in Orca
Passed	Secrets	0   0   0   0	View in Orca
Passed	Vulnerabilities	0   0   0   0	View in Orca

[yeelali14]

LGTM

[gitstream-cm]

Please mark which AI tools you used for this PR by checking the appropriate boxes:

• GitHub Copilot
• Cursor
• ChatGPT
• Tabnine
• JetBrains AI Assistant
• VSCode IntelliCode
• Claude
• Gemini
• Other AI tool
• No AI tools were used

Tip: If you want to avoid this comment in the future, you can add a label of the format 🤖 ai-* when creating your PR.

[gitstream-cm]

✨ PR Review

The refactoring aims to improve handling of special characters by switching from heredoc to printf, but introduces a potential security vulnerability through improper shell argument handling.

1 issues detected:

🔒 Security - Unescaped user-controlled input is passed directly to shell commands, creating potential for command injection or syntax errors.

Details: The printf command uses GitHub Actions variables directly as arguments without proper shell escaping. If PR titles or release notes contain special characters, quotes, backticks, or shell metacharacters, they could break the command syntax or potentially execute unintended code.
File: .github/workflows/create-tag-on-merge.yml (83-88)

Generated by LinearB AI and added by gitStream.
_{AI-generated content may contain inaccuracies. Please verify before using. We'd love your feedback! 🚀}

[gitstream-cm]

🔒 Security - Shell Injection Risk: Either revert to the previous shell variable approach with proper quoting, or use printf with properly escaped arguments. Consider using shell parameter expansion with proper quoting like "${PR_TITLE@Q}" or a more robust templating approach.

Suggested change

	# Create release notes using printf to handle special characters safely
	printf "## What's Changed\n\n%s in [#%s](https://github.com/${{ github.repository }}/pull/%s)\n\n%s\n" \
	"${{ steps.should-deploy.outputs.pr-title }}" \
	"${{ steps.should-deploy.outputs.pr-number }}" \
	"${{ steps.should-deploy.outputs.pr-number }}" \
	"${{ steps.should-deploy.outputs.release-notes }}" > release_notes.md
	# Create release notes using shell variables with proper quoting
	PR_TITLE="${{ steps.should-deploy.outputs.pr-title }}"
	PR_NUMBER="${{ steps.should-deploy.outputs.pr-number }}"
	RELEASE_NOTES="${{ steps.should-deploy.outputs.release-notes }}"
	printf "## What's Changed\n\n%s in [#%s](https://github.com/${{ github.repository }}/pull/%s)\n\n%s\n" \
	"$PR_TITLE" \
	"$PR_NUMBER" \
	"$PR_NUMBER" \
	"$RELEASE_NOTES" > release_notes.md