flan cd39489c7f compat/release: stop interpolating ${{ }} into run: bodies ...

The report body is full of backticks, so 'echo "${{ steps.report.outputs.body }}"'
pasted it into the shell text and bash executed create-snapshot, def and async as
commands. The report is built from iX's middleware source, so that was an injection
vector as well as a bug. inputs.tag on workflow_dispatch had the same shape.

Data goes through files, scalars through env:. Tests enforce it across every
workflow.

2026-07-13 17:30:50 +00:00

..

test_alert_source.py

v0.5.1: the update alert could have broken middlewared at startup

2026-07-13 16:52:23 +00:00

test_apply_blocks.py

v0.3.4: one implementation of apply/revert (patch/mw_patch.py)

2026-07-13 16:02:53 +00:00

test_create_task.py

v0.3.3: keep the restic repo password out of argv and shell history

2026-07-13 15:43:24 +00:00

test_mw_patch.py

v0.3.4: one implementation of apply/revert (patch/mw_patch.py)

2026-07-13 16:02:53 +00:00

test_patch_ui.py

Refuse to write a bundle whose parens we unbalanced

2026-07-13 14:57:16 +00:00

test_release_gate.py

Make Gitea canonical; derive the changelog URL from the remote instead of hard-coding GitHub

2026-07-13 17:21:30 +00:00

test_release_notes.py

Compatibility watch: check the patch's assumptions against every TrueNAS release line

2026-07-13 17:25:37 +00:00

test_truecloud_nested.py

Delete the snapshot tree atomically instead of 252 calls

2026-07-13 14:35:04 +00:00

test_workflows.py

compat/release: stop interpolating ${{ }} into run: bodies

2026-07-13 17:30:50 +00:00