fix: render maintenance issue bodies as data

.github/scripts/render-maintenance-template.py

@@ -0,0 +1,19 @@
+#!/usr/bin/env python3
+"""Render maintenance issue Markdown without evaluating it as shell code."""
+
+import os
+import re
+import sys
+
+PLACEHOLDER = re.compile(r"\$\{([A-Za-z_][A-Za-z0-9_]*)\}")
+
+
+def substitute(match: re.Match[str]) -> str:
+    name = match.group(1)
+    try:
+        return os.environ[name]
+    except KeyError as exc:
+        raise SystemExit(f"missing template variable: {name}") from exc
+
+
+sys.stdout.write(PLACEHOLDER.sub(substitute, sys.stdin.read()))

.github/workflows/maintenance-queue.yml

@@ -131,15 +131,16 @@ jobs:
             existing="$(gh issue list --repo "$REPO" --state open --label "automation:dependency" --limit 200 --search "${marker} in:body" --json number --jq '.[0].number // empty')"
 
             details="$(jq -r '.changes[] | "- `\(.manifest)` / `\(.table)`: `\(.old)` → `\(.new)`"' <<<"$item")"
-            body="$(cat <<EOF
+            export marker dep details log stat update_log VERSION
+            body="$(python3 .github/scripts/render-maintenance-template.py <<'EOF'
           <!-- ${marker} -->
           <!-- automation-queue:dependency -->
 
-          \`cargo upgrade\` reports a newer manifest dependency requirement for **${dep}**.
+          `cargo upgrade` reports a newer manifest dependency requirement for **${dep}**.
 
           ${details}
 
-          Update this dependency everywhere appropriate, including incompatible/major changes. Read the crate's changelog/release notes where useful, adapt code to current APIs and best practices, refresh \`Cargo.lock\`, and run the full relevant CI/test suite. Do not skip an update merely because it is transitive, low-risk, or already SemVer-compatible.
+          Update this dependency everywhere appropriate, including incompatible/major changes. Read the crate's changelog/release notes where useful, adapt code to current APIs and best practices, refresh `Cargo.lock`, and run the full relevant CI/test suite. Do not skip an update merely because it is transitive, low-risk, or already SemVer-compatible.
 
           This issue is generated and refreshed automatically. A ChatGPT maintenance automation is expected to implement it.
           EOF
@@ -177,13 +178,14 @@ jobs:
           marker="automation-maintenance-error-cargo-upgrade"
           existing="$(gh issue list --repo "$REPO" --state open --label "automation:maintenance-error" --limit 50 --search "${marker} in:body" --json number --jq '.[0].number // empty')"
           log="$(tail -n 200 /tmp/cargo-upgrade.log)"
-          body="$(cat <<EOF
+          export marker dep details log stat update_log VERSION
+          body="$(python3 .github/scripts/render-maintenance-template.py <<'EOF'
           <!-- ${marker} -->
-          The passive dependency detector failed while running \`cargo upgrade\`.
+          The passive dependency detector failed while running `cargo upgrade`.
 
-          \`\`\`text
+          ```text
           ${log}
-          \`\`\`
+          ```
 
           Repair the detector or repository state so passive dependency issue creation resumes.
           EOF
@@ -229,17 +231,18 @@ jobs:
           if [[ "$CHANGED" == "true" ]]; then
             update_log="$(tail -n 250 /tmp/cargo-update.log)"
             stat="$(cat /tmp/lockfile-stat.txt)"
-            body="$(cat <<EOF
+            export marker dep details log stat update_log VERSION
+            body="$(python3 .github/scripts/render-maintenance-template.py <<'EOF'
           <!-- ${marker} -->
           <!-- automation-queue:lockfile -->
 
-          A plain \`cargo update\` changes \`Cargo.lock\`, so there are compatible and/or transitive dependency updates available even if no manifest requirement needs changing.
+          A plain `cargo update` changes `Cargo.lock`, so there are compatible and/or transitive dependency updates available even if no manifest requirement needs changing.
 
-          \`\`\`text
+          ```text
           ${stat}
 
           ${update_log}
-          \`\`\`
+          ```
 
           Refresh the entire lockfile, inspect noteworthy transitive changes where appropriate, run the full relevant CI/test suite, and fix any fallout. There is intentionally no "too trivial to bother" threshold.
 
@@ -252,7 +255,7 @@ jobs:
               gh issue create --repo "$REPO" --title "deps: refresh Cargo.lock" --label "automation:lockfile" --body "$body"
             fi
           elif [[ -n "$existing" ]]; then
-            gh issue close "$existing" --repo "$REPO" --reason completed --comment "Closed automatically: \`cargo update\` no longer changes Cargo.lock."
+            gh issue close "$existing" --repo "$REPO" --reason completed --comment 'Closed automatically: `cargo update` no longer changes Cargo.lock.'
           fi
 
       - name: Report cargo-update detector failure
@@ -266,13 +269,14 @@ jobs:
           marker="automation-maintenance-error-cargo-update"
           existing="$(gh issue list --repo "$REPO" --state open --label "automation:maintenance-error" --limit 50 --search "${marker} in:body" --json number --jq '.[0].number // empty')"
           log="$(tail -n 200 /tmp/cargo-update.log)"
-          body="$(cat <<EOF
+          export marker dep details log stat update_log VERSION
+          body="$(python3 .github/scripts/render-maintenance-template.py <<'EOF'
           <!-- ${marker} -->
-          The passive dependency detector failed while running \`cargo update\`.
+          The passive dependency detector failed while running `cargo update`.
 
-          \`\`\`text
+          ```text
           ${log}
-          \`\`\`
+          ```
 
           Repair the detector or repository state so passive lockfile issue creation resumes.
           EOF
@@ -311,7 +315,9 @@ jobs:
             exit 0
           fi
 
-          body="$(cat <<EOF
+          export marker dep details log stat update_log VERSION
+
+          body="$(python3 .github/scripts/render-maintenance-template.py <<'EOF'
           <!-- ${marker} -->
           <!-- automation-queue:rust-release -->
 
@@ -321,7 +327,7 @@ jobs:
 
           - Read the official Rust ${VERSION} announcement and detailed release notes/changelog.
           - Review relevant language, standard-library, rustc, Cargo, Clippy, rustfmt, target/platform, and tooling changes.
-          - Review all Rust code, \`Cargo.toml\`/\`Cargo.lock\`, CI, Docker/build tooling, \`SKILL.md\`, README/docs, examples, lints, and project conventions for newly preferable patterns or obsolete workarounds.
+          - Review all Rust code, `Cargo.toml`/`Cargo.lock`, CI, Docker/build tooling, `SKILL.md`, README/docs, examples, lints, and project conventions for newly preferable patterns or obsolete workarounds.
           - Adopt useful newly-stable features and current best practices where they improve the project; remove workarounds that the new stable release makes unnecessary.
           - Update the current-stable CI/toolchain references while preserving the intentional MSRV contract unless there is a separately justified reason to raise it.
           - Run the full CI-equivalent test matrix and fix fallout.