From 14162f55c2e10a4b64a3e96cc6e917886f950eeb Mon Sep 17 00:00:00 2001 From: Eric Liu Date: Thu, 18 Jun 2026 19:21:22 -0700 Subject: [PATCH] fix: use heredoc for python3 to avoid shell quoting bugs The previous python3 -c '...' approach broke when lambdas contained single quotes (e.g. '"' + tag + '"'), causing the bash string to terminate early and output literal text instead of variable values. --- .gitea/actions/flux-deploy/action.yml | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/.gitea/actions/flux-deploy/action.yml b/.gitea/actions/flux-deploy/action.yml index 6acbb58..7641b5a 100644 --- a/.gitea/actions/flux-deploy/action.yml +++ b/.gitea/actions/flux-deploy/action.yml @@ -75,13 +75,14 @@ runs: cd "$workdir/gitops" # ── Update image fields via regex ────────────────────────── - python3 -c ' + python3 << 'PYEOF' import os, pathlib, re path = pathlib.Path(os.environ["GITOPS_FILE"]) repo = os.environ.get("IMAGE_REPOSITORY", "") tag = os.environ["IMAGE_TAG"] tag_keys = [k.strip() for k in os.environ["TAG_KEYS"].split(",") if k.strip()] + Q = '"' text = path.read_text() @@ -94,14 +95,12 @@ runs: # Pattern matches both formats: # tag: 2026-06-17-abc1234 (unquoted) # tag: "2026-06-17-abc1234" (quoted) - # rustImageTag: &anchor "value" (YAML anchor with quotes) + # imageTag: &anchor "value" (YAML anchor with quotes) # tag: *anchor (YAML alias — left alone by design) - # - # Group 1: everything up to and including the last quote or whitespace before the value - # Replacement: group(1) + new tag (preserving quoting style) + pat_quoted = r"(" + re.escape(key) + r':\s*(?:&\S+\s+)?)"[^"]*"' quoted = re.sub( - r"(" + re.escape(key) + r""":\s*(?:&\S+\s+)?)\"[^"]*\"""", - lambda m: m.group(1) + '"' + tag + '"', + pat_quoted, + lambda m: m.group(1) + Q + tag + Q, text ) if quoted != text: @@ -116,7 +115,7 @@ runs: ) path.write_text(text) - ' + PYEOF # ── Commit + push (idempotent) ──────────────────────────── if git diff --quiet -- "$GITOPS_FILE"; then