Problem with commits containing tilde character (`code`) about conventional-changelog-action HOT 3 CLOSED

Hi @RodionKorneev, thank you for reporting the issue. I have tested the output from the code as well as from the action and the generated changelog is not truncated, it seems that this behavior is caused when you consume the changelog. If you are using the changelog with f.e. a request action, you should wrap the changelog prior to consuming it. For me using ${{ toJSON(format('{0}', steps.changelog.outputs.body)) }} has worked out pretty well

      - name: Generate changelog
        uses: ./
        id: changelog
        with:
          from: "..."
          to: "..."

      - name: Create a release
        uses: octokit/[email protected]
        with:
          route: POST /repos/${{ github.repository }}/releases
          draft: true
          name: ${{ steps.next-tag.outputs.tag }}
          tag_name: ${{ steps.next-tag.outputs.tag }}
          target_commitish: ${{ steps.set-commitish.outputs.commitish }}
          body: ${{ toJSON(format('{0}', steps.changelog.outputs.body)) }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

from conventional-changelog-action.

Thank you for reply @dlavrenuek. You are rigth - the problem is on consumer side.

My consumers code seems like:

- name: Create a release
  run: gh release create "${{ steps.next-tag.outputs.tag }}" -p -n "${{ steps.changelog.outputs.body }}"
  env:
    GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

The problem was in command sintax. Back-quoted text in last argument runs as command.

I solved it by replacing double quotes with single quotes like that:

run: gh release create "${{ steps.next-tag.outputs.tag }}" -p -n '${{ steps.changelog.outputs.body }}'

So, now it works as expected =)

from conventional-changelog-action.

@RodionKorneev the git commit history is considered user input and you should never directly use user input in your commands. Imagine someone would write a commit message with f.e.

chore: fix bug' rm -rf; //

Without any filtering/encoding this string will be directly injected in your command. you should work around it by using env: to pass your input as env variables, but please also consider that you have to encode it there so it is not interpretated as yaml content. Something like that should work (but no warranty):

- name: Create a release
  run: gh release create "${{ steps.next-tag.outputs.tag }}" -p -n $BODY
  env:
    GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
    BODY: ${{ toJSON(format('{0}', steps.changelog.outputs.body)) }}

from conventional-changelog-action.