eric/actions-k8s
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: use heredoc for python3 to avoid shell quoting bugs

Browse Source 
The previous python3 -c '...' approach broke when lambdas
contained single quotes (e.g. '"' + tag + '"'), causing
the bash string to terminate early and output literal text
instead of variable values.
This commit is contained in:
Eric X. Liu
2026-06-18 19:21:22 -07:00
parent 248eb37110
commit 14162f55c2
1 changed files with 7 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitea/actions/flux-deploy/action.yml
+7 -8
View File
@@ -75,13 +75,14 @@ runs:
cd "$workdir/gitops" cd "$workdir/gitops"
# ── Update image fields via regex ────────────────────────── # ── Update image fields via regex ──────────────────────────
python3 -c ' python3 << 'PYEOF'
import os, pathlib, re import os, pathlib, re
path = pathlib.Path(os.environ["GITOPS_FILE"]) path = pathlib.Path(os.environ["GITOPS_FILE"])
repo = os.environ.get("IMAGE_REPOSITORY", "") repo = os.environ.get("IMAGE_REPOSITORY", "")
tag = os.environ["IMAGE_TAG"] tag = os.environ["IMAGE_TAG"]
tag_keys = [k.strip() for k in os.environ["TAG_KEYS"].split(",") if k.strip()] tag_keys = [k.strip() for k in os.environ["TAG_KEYS"].split(",") if k.strip()]
Q = '"'
text = path.read_text() text = path.read_text()
@@ -94,14 +95,12 @@ runs:
# Pattern matches both formats: # Pattern matches both formats:
# tag: 2026-06-17-abc1234 (unquoted) # tag: 2026-06-17-abc1234 (unquoted)
# tag: "2026-06-17-abc1234" (quoted) # tag: "2026-06-17-abc1234" (quoted)
# rustImageTag: &anchor "value" (YAML anchor with quotes) # imageTag: &anchor "value" (YAML anchor with quotes)
# tag: *anchor (YAML alias — left alone by design) # tag: *anchor (YAML alias — left alone by design)
# pat_quoted = r"(" + re.escape(key) + r':\s*(?:&\S+\s+)?)"[^"]*"'
# Group 1: everything up to and including the last quote or whitespace before the value
# Replacement: group(1) + new tag (preserving quoting style)
quoted = re.sub( quoted = re.sub(
r"(" + re.escape(key) + r""":\s*(?:&\S+\s+)?)\"[^"]*\"""", pat_quoted,
lambda m: m.group(1) + '"' + tag + '"', lambda m: m.group(1) + Q + tag + Q,
text text
) )
if quoted != text: if quoted != text:
@@ -116,7 +115,7 @@ runs:
) )
path.write_text(text) path.write_text(text)
' PYEOF
# ── Commit + push (idempotent) ──────────────────────────── # ── Commit + push (idempotent) ────────────────────────────
if git diff --quiet -- "$GITOPS_FILE"; then if git diff --quiet -- "$GITOPS_FILE"; then