Function shellEscapeArg

pkg/workflow/shell.go:29–58

shellEscapeArg escapes a single argument for safe use in shell commands. Arguments containing ${{ }} GitHub Actions expressions are double-quoted; other arguments with special shell characters are single-quoted.

(arg string)

// Arguments containing ${{ }} GitHub Actions expressions are double-quoted;
// other arguments with special shell characters are single-quoted.
func shellEscapeArg(arg string) string {
	// If the argument contains GitHub Actions expressions (${{ }}), use double-quote
	// wrapping. GitHub Actions evaluates ${{ }} at the YAML level before the shell runs,
	// so single-quoting would mangle the expression syntax (e.g., 'staging' inside
	// ${{ env.X == 'staging' }} becomes '\''staging'\'' which GA cannot parse).
	// Double-quoting preserves the expression for GA evaluation.
	if containsExpression(arg) {
		shellLog.Print("Argument contains GitHub Actions expression, using double-quote wrapping")
		escaped := strings.ReplaceAll(arg, `"`, `\"`)
		// Escape bare $ signs (those not part of a ${{ }} expression) so that bash
		// does not perform variable expansion inside the double-quoted string.
		// For example, the JSON key "$schema" must become "\$schema" so bash writes
		// the literal dollar sign rather than expanding the (unset) shell variable
		// $schema to an empty string. ${{ … }} expressions are left untouched because
		// GitHub Actions resolves them before the shell ever runs.
		escaped = escapeBareShellDollarSigns(escaped)
		return `"` + escaped + `"`
	}

	// Check if the argument contains special shell characters that need escaping
	if strings.ContainsAny(arg, "()[]{}*?$`\"'\\|&;<> \t\n") {
		shellLog.Print("Argument contains special characters, applying escaping")
		// Handle single quotes in the argument by escaping them
		// Use '\'' instead of '\"'\"' to avoid creating double-quoted contexts
		// that would interpret backslash escape sequences
		escaped := strings.ReplaceAll(arg, "'", "'\\''")
		return "'" + escaped + "'"
	}
	return arg
}

// escapeBareShellDollarSigns replaces every $ that is NOT the start of a ${{ }}
// GitHub Actions expression with \$. This prevents bash from performing variable