From 9ff416a85c06c53fa7c7c8d0b9f3df9d2d2338a3 Mon Sep 17 00:00:00 2001 From: Jonathan Dieu Date: Wed, 8 Jul 2026 17:08:34 -0700 Subject: [PATCH] fix(ci): stop interpolating helm-diff output directly into a bash script result="${{ steps.diff.outputs.result }}" splices the raw diff text into the script body before bash ever runs it. Any rendered manifest containing $(...) syntax - which cert-manager's own stock chart uses legitimately in container args (--cluster-resource-namespace=$(POD_NAMESPACE)) - gets executed as a real command substitution once it lands in that double-quoted string, breaking the step (command not found) the moment such a chart shows up in a diff for the first time. Passing it through env: instead means the value is set as-is with no re-parsing. --- .github/workflows/ci.yml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 4192594..1f014bc 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -136,12 +136,13 @@ jobs: } >> "$GITHUB_OUTPUT" - name: Format diff comment + env: + DIFF_RESULT: ${{ steps.diff.outputs.result }} run: | - result="${{ steps.diff.outputs.result }}" - if [ "$result" = "No template changes detected." ]; then + if [ "$DIFF_RESULT" = "No template changes detected." ]; then printf '## Helm template diff\n\nNo template changes detected.\n' > /tmp/diff-comment.md else - printf '## Helm template diff\n\n```diff\n%s\n```\n' "$result" > /tmp/diff-comment.md + printf '## Helm template diff\n\n```diff\n%s\n```\n' "$DIFF_RESULT" > /tmp/diff-comment.md fi - uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1