From 8fa7085d97b09b75535162f4b205ba9510aa2fa1 Mon Sep 17 00:00:00 2001
From: jamiecobbett <jcobbett@gocardless.com>
Date: Tue, 1 Sep 2026 11:51:55 +0100
Subject: [PATCH] Fix release notes shell injection in create_release workflow

By interpolating the changelog entry into a double quoted bash string, bash
parsed the contents for commands. When the changelog entry included backticks
for a code block, bash tried to execute it.

Passing via the env context avoids this.
---
 .github/workflows/build.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 1df57ba7..85521e32 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -141,7 +141,6 @@ jobs:
           TAG="v${{ needs.check_version.outputs.version }}"
           git tag "$TAG"
           git push origin "$TAG"
-          NOTES="${{ steps.notes.outputs.notes }}"
           if [ -n "$(echo "$NOTES" | tr -d '[:space:]')" ]; then
             gh release create "$TAG" --title "$TAG" --notes "$NOTES"
           else
@@ -149,3 +148,4 @@ jobs:
           fi
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          NOTES: ${{ steps.notes.outputs.notes }}