fix(gha): convert markdown to Slack markdown to urls are properly unf…#438
fix(gha): convert markdown to Slack markdown to urls are properly unf…#438olivermeyer merged 2 commits intomainfrom
Conversation
There was a problem hiding this comment.
Pull request overview
This PR updates the package publish GitHub Actions workflow to post Slack release announcements with Slack-formatted (mrkdwn) release notes so URLs/links render correctly in Slack.
Changes:
- Adds a workflow step to convert GitHub release notes Markdown into Slack mrkdwn.
- Updates the Slack announcement payload to use the converted release notes output.
- Minor YAML formatting/whitespace adjustments in the workflow.
| shell: bash | ||
| run: | | ||
| # Convert Markdown links [text](url) to Slack mrkdwn <url|text> | ||
| # Convert bold **text** to *text* | ||
| SLACK_RELEASE_NOTES=$(echo '${{ toJSON(steps.git-cliff.outputs.content) }}' | \ |
There was a problem hiding this comment.
The conversion uses toJSON(steps.git-cliff.outputs.content) and then echoes it as a literal string, which produces a JSON-escaped value (surrounding quotes and escaped \n). That means sed will run against the escaped representation and the Slack output is likely to contain quotes/backslashes instead of proper newlines/markdown. Consider passing the raw content into the step (e.g., via an env var) or explicitly decoding the JSON string before running the sed transforms.
| shell: bash | |
| run: | | |
| # Convert Markdown links [text](url) to Slack mrkdwn <url|text> | |
| # Convert bold **text** to *text* | |
| SLACK_RELEASE_NOTES=$(echo '${{ toJSON(steps.git-cliff.outputs.content) }}' | \ | |
| env: | |
| RELEASE_NOTES: ${{ steps.git-cliff.outputs.content }} | |
| shell: bash | |
| run: | | |
| # Convert Markdown links [text](url) to Slack mrkdwn <url|text> | |
| # Convert bold **text** to *text* | |
| SLACK_RELEASE_NOTES=$(printf '%s\n' "${RELEASE_NOTES}" | \ |
| "repository": "${{ github.repository }}", | ||
| "version": "${{ steps.git-cliff.outputs.version }}", | ||
| "release_notes": ${{ toJSON(steps.git-cliff.outputs.content) }}, | ||
| "release_notes": ${{ steps.slack-notes.outputs.content }}, |
There was a problem hiding this comment.
payload appears to be constructed as JSON/YAML, but release_notes is now injected without quoting/escaping. If steps.slack-notes.outputs.content contains newlines, quotes, or colons, this will break the payload parsing or produce invalid JSON for the Slack webhook. Wrap the value in toJSON(...) (or otherwise ensure proper escaping) so the payload remains valid regardless of release note contents.
| "release_notes": ${{ steps.slack-notes.outputs.content }}, | |
| "release_notes": ${{ toJSON(steps.slack-notes.outputs.content) }}, |
Codecov Report✅ All modified and coverable lines are covered by tests. |
| "repository": "${{ github.repository }}", | ||
| "version": "${{ steps.git-cliff.outputs.version }}", | ||
| "release_notes": ${{ toJSON(steps.git-cliff.outputs.content) }}, | ||
| "release_notes": ${{ steps.slack-notes.outputs.content }}, |
There was a problem hiding this comment.
Bug: The release_notes value is not wrapped with toJSON(), which will create an invalid payload for the Slack action if the notes contain special characters or newlines.
Severity: MEDIUM
Suggested Fix
To ensure the payload is always valid JSON, wrap the output variable in a toJSON() call. The line should be changed to: "release_notes": ${{ toJSON(steps.slack-notes.outputs.content) }},.
Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.
Location: .github/workflows/_package-publish.yml#L254
Potential issue: In the `_package-publish.yml` workflow, the `release_notes` field is
populated with raw, potentially multiline content that may contain special characters.
This content is not properly escaped using `toJSON()` before being inserted into the
payload for the `slackapi/slack-github-action`. When the action attempts to parse this
payload, the unescaped value will break the JSON/YAML structure. This will cause the
'Release Announcement' step to fail, preventing release notifications from being sent to
the designated Slack channel.
Did we get this right? 👍 / 👎 to inform future reviews.
|
…urled