Repository navigation
v2.23.2
What's new
The release-notes-narrative v2 automation no longer crashes the Release job on bash parameter expansion. v2.23.0 and v2.23.1 both shipped to npm successfully but failed their Release job with SyntaxError: Unexpected token ':', because @semantic-release/exec renders the entire successCmd YAML block through lodash-es template() with no escape support — every ${...} in the bash script (including ${VAR:-default} parameter expansion and even ${...} inside comments) was being evaluated as a JavaScript expression.
The fix moves the dispatch logic out of the YAML scalar entirely. The successCmd: is now a one-line invocation of an external script:
successCmd: 'scripts/dispatch-release-notes.sh "${nextRelease.gitTag}"'scripts/dispatch-release-notes.sh receives the target tag as $1 and is otherwise a normal shell script — no Lodash collision surface. The only template interpolation Lodash sees is the one we want: the target version from semantic-release context.
This is the third hotfix in the v2 automation sequence. The two earlier attempts (#430 introduced the inline successCmd; #431 tried to fix it with backslash escapes) failed because Lodash's default template settings have no backslash-escape semantics — \${VAR} still evaluates VAR as JavaScript and just leaves the backslash as a literal character in the output. Verified empirically by running template('\\${VAR}')({}) locally and observing the same is not defined error.
The 19 integration tests in tests/integration/release-notes-ci.test.ts continue to cover the full dispatch chain: tag validation, correlation-token generation, polling fallback, conclusion-taxonomy classification (success, neutral, failure, cancelled, timed_out, action_required, skipped), security signals (HTTP 401/403, off-target release edits, body-integrity check post-write), and unexpected gh run watch exit codes.
The fourth hotfix in this chain (still in flight at PR #433) addresses a separate production failure surfaced by this release: gh workflow run rejected the dispatch with HTTP 422: Unexpected inputs provided: ["correlation-id"] because the fro-bot.yaml workflow did not declare correlation-id as a valid workflow_call/workflow_dispatch input. That fix adds the input declaration. v2.23.2's release notes you are reading right now were rewritten manually using the v1 skill procedure.