Merge pull request #360 from Tencent/fix/ci-security

fix: action ci script security
Tencent · Jul 17, 2023 · b030d86 · b030d86
2 parents fbec2b4 + 8e9a17a
commit b030d86
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/.github/workflows/auto-release.yml b/.github/workflows/auto-release.yml
@@ -55,10 +55,11 @@ jobs:
           ref: ${{ steps.comment.outputs.branch }}
       - run: echo '${{ github.event.comment.body }}'
       - name: Commit and push if needed
+        env:
+          BODY: ${{ github.event.comment.body }}
         run: |
           txt=$(cat CHANGELOG.md)
-          body='${{ github.event.comment.body }}'
-          echo "${txt%%##*}${body}${txt##*---}" > CHANGELOG.md
+          echo "${txt%%##*} $BODY ${txt##*---}" > CHANGELOG.md
           git add .
           git config --local user.email "github-actions[bot]@users.noreply.github.com"
           git config --local user.name "github-actions[bot]"