fix(publish): read release body via env, not inline shell interpolation

[tastybento]

Problem

publish-platforms.yml's prep step staged the changelog with:

BODY=${{ toJSON(github.event.release.body) }}

toJSON escapes ", \ and newlines, but not backticks or $(...), which remain live inside the resulting double-quoted shell string. A release whose body contains an inline `code` span therefore executes it as a command:

line 26: Util.componentToLegacy: command not found
##[error]Process completed with exit code 127.

This broke BentoBox's 3.18.1 CurseForge/Hangar publish (failed run), is a shell-injection vector (a crafted release body could run arbitrary commands on the runner), and also left literal \r\n in changelog.md.

Fix

Pass the body through the environment and read it with "$RELEASE_BODY", so the shell never parses its contents:

env:
RELEASE_BODY: ${{ github.event.release.body }}run: | ... BODY="${RELEASE_BODY:-}" if [ -z "$BODY" ] || [ "$BODY" = "null" ]; then BODY="Release $VERSION"; fi

Backticks, $(...) and $VAR in release notes are now preserved literally, real newlines survive, and manual workflow_dispatch (no release event → empty body) still falls back to Release $VERSION.

Blast radius

This reusable workflow is used by every BentoBox repo's publish, so the fix applies org-wide. Consumers pin it by SHA; they'll pick up the fix when they re-pin to the merge commit.

🤖 Generated with Claude Code

https://claude.ai/code/session_0153KLwL66bB31pTc4BtsTMd

[tastybento]

Problem

publish-platforms.yml's prep step staged the changelog with:

BODY=${{ toJSON(github.event.release.body) }}

toJSON escapes ", \ and newlines, but not backticks or $(...), which remain live inside the resulting double-quoted shell string. A release whose body contains an inline `code` span therefore executes it as a command:

line 26: Util.componentToLegacy: command not found
##[error]Process completed with exit code 127.

This broke BentoBox's 3.18.1 CurseForge/Hangar publish (failed run), is a shell-injection vector (a crafted release body could run arbitrary commands on the runner), and also left literal \r\n in changelog.md.

Fix

Pass the body through the environment and read it with "$RELEASE_BODY", so the shell never parses its contents:

env:
RELEASE_BODY: ${{ github.event.release.body }}run: | ... BODY="${RELEASE_BODY:-}" if [ -z "$BODY" ] || [ "$BODY" = "null" ]; then BODY="Release $VERSION"; fi

Backticks, $(...) and $VAR in release notes are now preserved literally, real newlines survive, and manual workflow_dispatch (no release event → empty body) still falls back to Release $VERSION.

Blast radius

This reusable workflow is used by every BentoBox repo's publish, so the fix applies org-wide. Consumers pin it by SHA; they'll pick up the fix when they re-pin to the merge commit.

🤖 Generated with Claude Code

https://claude.ai/code/session_0153KLwL66bB31pTc4BtsTMd

[tastybento]

Problem

publish-platforms.yml's prep step staged the changelog with:

BODY=${{ toJSON(github.event.release.body) }}

toJSON escapes ", \ and newlines, but not backticks or $(...), which remain live inside the resulting double-quoted shell string. A release whose body contains an inline `code` span therefore executes it as a command:

line 26: Util.componentToLegacy: command not found
##[error]Process completed with exit code 127.

This broke BentoBox's 3.18.1 CurseForge/Hangar publish (failed run), is a shell-injection vector (a crafted release body could run arbitrary commands on the runner), and also left literal \r\n in changelog.md.

Fix

Pass the body through the environment and read it with "$RELEASE_BODY", so the shell never parses its contents:

env:
RELEASE_BODY: ${{ github.event.release.body }}run: | ... BODY="${RELEASE_BODY:-}" if [ -z "$BODY" ] || [ "$BODY" = "null" ]; then BODY="Release $VERSION"; fi

Backticks, $(...) and $VAR in release notes are now preserved literally, real newlines survive, and manual workflow_dispatch (no release event → empty body) still falls back to Release $VERSION.

Blast radius

This reusable workflow is used by every BentoBox repo's publish, so the fix applies org-wide. Consumers pin it by SHA; they'll pick up the fix when they re-pin to the merge commit.

🤖 Generated with Claude Code

https://claude.ai/code/session_0153KLwL66bB31pTc4BtsTMd

[tastybento]

Problem

publish-platforms.yml's prep step staged the changelog with:

BODY=${{ toJSON(github.event.release.body) }}

toJSON escapes ", \ and newlines, but not backticks or $(...), which remain live inside the resulting double-quoted shell string. A release whose body contains an inline `code` span therefore executes it as a command:

line 26: Util.componentToLegacy: command not found
##[error]Process completed with exit code 127.

This broke BentoBox's 3.18.1 CurseForge/Hangar publish (failed run), is a shell-injection vector (a crafted release body could run arbitrary commands on the runner), and also left literal \r\n in changelog.md.

Fix

Pass the body through the environment and read it with "$RELEASE_BODY", so the shell never parses its contents:

env:
RELEASE_BODY: ${{ github.event.release.body }}run: | ... BODY="${RELEASE_BODY:-}" if [ -z "$BODY" ] || [ "$BODY" = "null" ]; then BODY="Release $VERSION"; fi

Backticks, $(...) and $VAR in release notes are now preserved literally, real newlines survive, and manual workflow_dispatch (no release event → empty body) still falls back to Release $VERSION.

Blast radius

This reusable workflow is used by every BentoBox repo's publish, so the fix applies org-wide. Consumers pin it by SHA; they'll pick up the fix when they re-pin to the merge commit.

🤖 Generated with Claude Code

https://claude.ai/code/session_0153KLwL66bB31pTc4BtsTMd

[tastybento]

Problem

publish-platforms.yml's prep step staged the changelog with:

BODY=${{ toJSON(github.event.release.body) }}

toJSON escapes ", \ and newlines, but not backticks or $(...), which remain live inside the resulting double-quoted shell string. A release whose body contains an inline `code` span therefore executes it as a command:

line 26: Util.componentToLegacy: command not found
##[error]Process completed with exit code 127.

This broke BentoBox's 3.18.1 CurseForge/Hangar publish (failed run), is a shell-injection vector (a crafted release body could run arbitrary commands on the runner), and also left literal \r\n in changelog.md.

Fix

Pass the body through the environment and read it with "$RELEASE_BODY", so the shell never parses its contents:

env:
RELEASE_BODY: ${{ github.event.release.body }}run: | ... BODY="${RELEASE_BODY:-}" if [ -z "$BODY" ] || [ "$BODY" = "null" ]; then BODY="Release $VERSION"; fi

Backticks, $(...) and $VAR in release notes are now preserved literally, real newlines survive, and manual workflow_dispatch (no release event → empty body) still falls back to Release $VERSION.

Blast radius

This reusable workflow is used by every BentoBox repo's publish, so the fix applies org-wide. Consumers pin it by SHA; they'll pick up the fix when they re-pin to the merge commit.

🤖 Generated with Claude Code

https://claude.ai/code/session_0153KLwL66bB31pTc4BtsTMd

[tastybento]

Problem

publish-platforms.yml's prep step staged the changelog with:

BODY=${{ toJSON(github.event.release.body) }}

toJSON escapes ", \ and newlines, but not backticks or $(...), which remain live inside the resulting double-quoted shell string. A release whose body contains an inline `code` span therefore executes it as a command:

line 26: Util.componentToLegacy: command not found
##[error]Process completed with exit code 127.

This broke BentoBox's 3.18.1 CurseForge/Hangar publish (failed run), is a shell-injection vector (a crafted release body could run arbitrary commands on the runner), and also left literal \r\n in changelog.md.

Fix

Pass the body through the environment and read it with "$RELEASE_BODY", so the shell never parses its contents:

env:
RELEASE_BODY: ${{ github.event.release.body }}run: | ... BODY="${RELEASE_BODY:-}" if [ -z "$BODY" ] || [ "$BODY" = "null" ]; then BODY="Release $VERSION"; fi

Backticks, $(...) and $VAR in release notes are now preserved literally, real newlines survive, and manual workflow_dispatch (no release event → empty body) still falls back to Release $VERSION.

Blast radius

This reusable workflow is used by every BentoBox repo's publish, so the fix applies org-wide. Consumers pin it by SHA; they'll pick up the fix when they re-pin to the merge commit.

🤖 Generated with Claude Code

https://claude.ai/code/session_0153KLwL66bB31pTc4BtsTMd

[tastybento]

Problem

publish-platforms.yml's prep step staged the changelog with:

BODY=${{ toJSON(github.event.release.body) }}

toJSON escapes ", \ and newlines, but not backticks or $(...), which remain live inside the resulting double-quoted shell string. A release whose body contains an inline `code` span therefore executes it as a command:

line 26: Util.componentToLegacy: command not found
##[error]Process completed with exit code 127.

This broke BentoBox's 3.18.1 CurseForge/Hangar publish (failed run), is a shell-injection vector (a crafted release body could run arbitrary commands on the runner), and also left literal \r\n in changelog.md.

Fix

Pass the body through the environment and read it with "$RELEASE_BODY", so the shell never parses its contents:

env:
RELEASE_BODY: ${{ github.event.release.body }}run: | ... BODY="${RELEASE_BODY:-}" if [ -z "$BODY" ] || [ "$BODY" = "null" ]; then BODY="Release $VERSION"; fi

Backticks, $(...) and $VAR in release notes are now preserved literally, real newlines survive, and manual workflow_dispatch (no release event → empty body) still falls back to Release $VERSION.

Blast radius

This reusable workflow is used by every BentoBox repo's publish, so the fix applies org-wide. Consumers pin it by SHA; they'll pick up the fix when they re-pin to the merge commit.

🤖 Generated with Claude Code

https://claude.ai/code/session_0153KLwL66bB31pTc4BtsTMd

[tastybento]

Problem

publish-platforms.yml's prep step staged the changelog with:

BODY=${{ toJSON(github.event.release.body) }}

toJSON escapes ", \ and newlines, but not backticks or $(...), which remain live inside the resulting double-quoted shell string. A release whose body contains an inline `code` span therefore executes it as a command:

line 26: Util.componentToLegacy: command not found
##[error]Process completed with exit code 127.

This broke BentoBox's 3.18.1 CurseForge/Hangar publish (failed run), is a shell-injection vector (a crafted release body could run arbitrary commands on the runner), and also left literal \r\n in changelog.md.

Fix

Pass the body through the environment and read it with "$RELEASE_BODY", so the shell never parses its contents:

env:
RELEASE_BODY: ${{ github.event.release.body }}run: | ... BODY="${RELEASE_BODY:-}" if [ -z "$BODY" ] || [ "$BODY" = "null" ]; then BODY="Release $VERSION"; fi

Backticks, $(...) and $VAR in release notes are now preserved literally, real newlines survive, and manual workflow_dispatch (no release event → empty body) still falls back to Release $VERSION.

Blast radius

This reusable workflow is used by every BentoBox repo's publish, so the fix applies org-wide. Consumers pin it by SHA; they'll pick up the fix when they re-pin to the merge commit.

🤖 Generated with Claude Code

https://claude.ai/code/session_0153KLwL66bB31pTc4BtsTMd