File tree Expand file tree Collapse file tree
Expand file tree Collapse file tree Original file line number Diff line number Diff line change @@ -257,8 +257,16 @@ jobs:
257257 echo "${DELIMITER}"
258258 } >> $GITHUB_OUTPUT
259259
260- # Title and body reach the shell through env, never a ${{ }} interpolation: both
261- # are attacker-controlled text and would otherwise be spliced into this script.
260+ # Title and body reach the shell through env, never an Actions expression
261+ # interpolation: both are attacker-controlled text and would otherwise be spliced
262+ # into this script.
263+ #
264+ # That expression syntax cannot be written out inside this run block, not even in a
265+ # comment. Actions parses those delimiters in the block's *string value*, comments
266+ # included, and an empty pair is a syntax error that makes the whole workflow
267+ # unparseable -- no jobs, no required check, every PR in the org blocked behind
268+ # "Please close and reopen the PR to trigger this workflow". A YAML comment outside
269+ # a block scalar is safe, because the YAML parser strips it before Actions looks.
262270 # First in the file on purpose: the byte cap keeps the head, so anything the
263271 # reviewer must not miss has to be above the blocks that can grow.
264272 if [ -s "$WARN_FILE" ]; then
You can’t perform that action at this time.
0 commit comments