From ba8ffe5f5b9845e63ac8cdbfbb0bc9166a23008a Mon Sep 17 00:00:00 2001
From: Paul Schneider <paul@pschneider.fr>
Date: Mon, 17 Aug 2026 16:30:28 +0100
Subject: [PATCH] fix state file: use JSON instead of shell-sourcable env

The previous version wrote RELEASE_BODY to a state file using the
'<<EOF ... EOF' heredoc syntax, then 'source'd that file at the
top of each subsequent step. Bash cannot parse that file as
shell input: the heredoc body contains markdown with backticks,
asterisks, colons, etc., which bash tries to interpret as
commands ('postit: command not found', '1.0.6: command not
found', etc.).

Switch to JSON via jq: jq handles all escaping correctly via
--arg/--argjson. Each step reads the fields it needs with
`jq -r '.field' $STATE_FILE`.

Also fixes a botched jq merge in the validation step that
mixed `jq -n ... > STATE_FILE` with a `<<< "" `
here-string to the same file.
---
 .forgejo/workflows/release.yml | 53 +++++++++++++++++++++-------------
 1 file changed, 33 insertions(+), 20 deletions(-)

diff --git a/.forgejo/workflows/release.yml b/.forgejo/workflows/release.yml
index 88a4e4f..71b38ac 100644
--- a/.forgejo/workflows/release.yml
+++ b/.forgejo/workflows/release.yml
@@ -29,10 +29,12 @@
 # on met à jour la release existante plutôt que d'en multiplier
 # pour un même tag. Le permalien /releases/tag/<tag> reste stable.
 #
-# Inter-step state: we persist values between steps via a plain
-# env file under /tmp, sourced at the top of each step that needs
-# it. This keeps the workflow self-contained and avoids any
-# runtime variable names we did not choose.
+# Inter-step state: persisted as JSON in /tmp/release-state.json,
+# read at the top of each step with `jq -r .<field>`. Using JSON
+# sidesteps shell parsing issues that come with sourcing a file
+# that contains heredocs / markdown / colons / etc. — RELEASE_BODY
+# in particular is markdown content straight from CHANGELOG.md and
+# cannot be safely `source`d.
 name: Forgejo Release postit-deb
 
 on:
@@ -63,7 +65,7 @@ jobs:
     container:
       image: docker.io/pazof/yavsc-build-env:debian12-dotnet10-android36-v2
     env:
-      STATE_FILE: /tmp/release-state.env
+      STATE_FILE: /tmp/release-state.json
     steps:
       - name: Installer les pré-requis de build (debhelper + icônes)
         # L'image runner fournit déjà dotnet-sdk-10.0, git, jq,
@@ -100,11 +102,14 @@ jobs:
           git checkout "$TAG"
 
           echo "Checked out at $(git rev-parse HEAD) on tag $TAG"
-          echo "TAG=$TAG" >> "$STATE_FILE"
+
+          # Persist TAG in the state file. --arg ensures proper
+          # JSON escaping of any special chars.
+          jq -n --arg tag "$TAG" '{tag: $tag}' > "$STATE_FILE"
 
       - name: Valider le tag et la section CHANGELOG
         run: |
-          source "$STATE_FILE"
+          TAG=$(jq -r '.tag' "$STATE_FILE")
           cd /src/_src
           echo "Validating tag $TAG"
 
@@ -176,19 +181,21 @@ jobs:
 
           echo "Section CHANGELOG validée pour [$TAG] - $CHANNEL"
 
-          # Persist values for the next steps via our local state file.
-          {
-            echo "RELEASE_BODY<<EOF"
-            echo "$RELEASE_BODY"
-            echo "EOF"
-            echo "IS_PRERELEASE=$IS_PRERELEASE"
-          } >> "$STATE_FILE"
+          # Persist validation results. Use --arg for strings (so
+          # jq handles escaping of backticks, asterisks, colons,
+          # etc.) and --argjson for booleans.
+          jq -n \
+            --arg tag "$TAG" \
+            --arg body "$RELEASE_BODY" \
+            --argjson is_prerelease "$IS_PRERELEASE" \
+            '{tag: $tag, body: $body, is_prerelease: $is_prerelease}' \
+            > "$STATE_FILE"
 
       - name: Build .deb amd64
         env:
           POSTIT_RUNTIME: linux-x64
         run: |
-          source "$STATE_FILE"
+          TAG=$(jq -r '.tag' "$STATE_FILE")
           cd /src/_src
           echo "→ Building amd64 for POSTIT_GIT_TAG=$TAG"
           make deb POSTIT_GIT_TAG="$TAG" POSTIT_RUNTIME=linux-x64
@@ -197,7 +204,7 @@ jobs:
         env:
           POSTIT_RUNTIME: linux-arm64
         run: |
-          source "$STATE_FILE"
+          TAG=$(jq -r '.tag' "$STATE_FILE")
           cd /src/_src
           echo "→ Building arm64 for POSTIT_GIT_TAG=$TAG"
           # Cross-RID .NET depuis un hôte amd64 : standard, pas
@@ -206,7 +213,7 @@ jobs:
 
       - name: Localiser les .deb produits
         run: |
-          source "$STATE_FILE"
+          TAG=$(jq -r '.tag' "$STATE_FILE")
           cd /src
           DEB_AMD64=$(find . -maxdepth 3 -name "postit_*${TAG}-1_amd64.deb" \
                       -not -path "./_src/debian/*" -printf '%p\n' | head -1)
@@ -217,8 +224,10 @@ jobs:
             ls -la /src/ 2>/dev/null || true
             exit 1
           fi
-          echo "DEB_AMD64=/src/$DEB_AMD64" >> "$STATE_FILE"
-          echo "DEB_ARM64=/src/$DEB_ARM64" >> "$STATE_FILE"
+          # Merge .deb paths into state file.
+          jq --arg amd64 "/src/$DEB_AMD64" --arg arm64 "/src/$DEB_ARM64" \
+            '. + {deb_amd64: $amd64, deb_arm64: $arm64}' \
+            "$STATE_FILE" > "${STATE_FILE}.tmp" && mv "${STATE_FILE}.tmp" "$STATE_FILE"
           echo "✓ Found both .deb files"
 
       - name: Publier la release Forgejo via l'API REST
@@ -227,7 +236,11 @@ jobs:
           FORGEJO_API_URL: ${{ forgejo.api_url }}
           FORGEJO_REPOSITORY: ${{ forgejo.repository }}
         run: |
-          source "$STATE_FILE"
+          TAG=$(jq -r '.tag' "$STATE_FILE")
+          RELEASE_BODY=$(jq -r '.body' "$STATE_FILE")
+          IS_PRERELEASE=$(jq -r '.is_prerelease' "$STATE_FILE")
+          DEB_AMD64=$(jq -r '.deb_amd64' "$STATE_FILE")
+          DEB_ARM64=$(jq -r '.deb_arm64' "$STATE_FILE")
           if [[ -z "$TAG" ]]; then
             echo "::error::No tag resolved for the API call."
             exit 1