escapeBareShellDollarSigns replaces every $ that is NOT the start of a ${{ }} GitHub Actions expression with \$. This prevents bash from performing variable expansion when the string is embedded inside a double-quoted shell argument. For example, the JSON key "$schema" would be mis-expanded by bash
(s string)
| 70 | // in the script text. Any other $ — including $varname, ${varname}, and $0-$9 |
| 71 | // positional parameters — is escaped. |
| 72 | func escapeBareShellDollarSigns(s string) string { |
| 73 | var result strings.Builder |
| 74 | result.Grow(len(s)) |
| 75 | for i := range len(s) { |
| 76 | if s[i] != '$' { |
| 77 | result.WriteByte(s[i]) |
| 78 | continue |
| 79 | } |
| 80 | // It is a $; check whether it opens a ${{ }} GitHub Actions expression. |
| 81 | if i+2 < len(s) && s[i+1] == '{' && s[i+2] == '{' { |
| 82 | // Start of ${{ }}: leave as-is so GitHub Actions can evaluate it. |
| 83 | result.WriteByte(s[i]) |
| 84 | } else { |
| 85 | // Bare $: escape to \$ so bash treats it as a literal dollar sign. |
| 86 | result.WriteString(`\$`) |
| 87 | } |
| 88 | } |
| 89 | return result.String() |
| 90 | } |
| 91 | |
| 92 | // shellEscapeArgWithVarsPreserved escapes arg for use as a double-quoted shell argument, |
| 93 | // preserving ${{ }} GitHub Actions expressions and specific ${varName} shell variable |