fix: dangerous workflow (#3669)

Signed-off-by: Joyce Brum <joycebrum@google.com>
lit · Feb 14, 2023 · 499985d · Anonymous696969696969 · Feb 17, 2023 · 499985d
1 parent 65df149
commit 499985d
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/.github/workflows/release-image.yaml b/.github/workflows/release-image.yaml
@@ -33,11 +33,11 @@ jobs:
         run: npm run build
 
       - name: Create release image
+        env:
+          BODY: ${{ github.event.pull_request.body }}
         run: |
           # Store the PR body contents containing the changelog in 'release.md'
-          cat <<'EOF' > release.md
-          ${{ github.event.pull_request.body }}
-          EOF
+          echo "$BODY" > release.md
           # Only render the pull request content including and after the "#
           # Releases" heading.
           node_modules/.bin/release-image -m <(sed -n '/# Releases/,$p' release.md)