From e6af1d5cf30e7f0ba5fb60948551aad35d3dd387 Mon Sep 17 00:00:00 2001
From: Volodymyr Zotov <volodymyr.zotov@agilebits.com>
Date: Fri, 24 Mar 2023 15:44:48 -0500
Subject: [PATCH] Fix release MR template

---
 .github/workflows/release-pr.yml | 22 ++++++++--------------
 1 file changed, 8 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/release-pr.yml b/.github/workflows/release-pr.yml
index e23a3a7..2708154 100644
--- a/.github/workflows/release-pr.yml
+++ b/.github/workflows/release-pr.yml
@@ -52,26 +52,20 @@ jobs:
         id: prep_pr
         run: |
           CHANGELOG_PATH=$(printf "%s/CHANGELOG.md" "${GITHUB_WORKSPACE}")
-
           LOG_ENTRY=$(awk '/START\/v[0-9]+\.[0-9]+\.[0-9]+*/{f=1; next} /---/{if (f == 1) exit} f' "${CHANGELOG_PATH}")
-          export PR_BODY=$(cat <<EOF
-          This is an automated PR for a new release.
-
+          DELIMITER="$(openssl rand -hex 8)" # DELIMITER is randomly generated and unique for each run. For more information, see https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#understanding-the-risk-of-script-injections.
+          
+          echo "pr_body<<${DELIMITER}" >> "${GITHUB_OUTPUT}"
+          echo "This is an automated PR for a new release.
+        
           Please check the following before approving:
           - [ ] Changelog is accurate. The documented changes for this release are printed below.
           - [ ] Any files referencing a version number. Confirm it matches the version number in the branch name.
           ---
           ## Release Changelog Preview
-          ${LOG_ENTRY}
-          EOF
-          )
-
-          # Sanitizes multiline strings for action outputs (https://medium.com/agorapulse-stories/23f56447d209)
-          PR_BODY="${PR_BODY//'%'/'%25'}"
-          PR_BODY="${PR_BODY//$'\n'/'%0A'}"
-          PR_BODY="${PR_BODY//$'\r'/'%0D'}"
-          echo "pr_body=$(echo "$PR_BODY")" >> $GITHUB_OUTPUT
-
+          ${LOG_ENTRY}" >> "${GITHUB_OUTPUT}"
+          
+          echo "${DELIMITER}" >> "${GITHUB_OUTPUT}"
       - name: Create Pull Request via API
         id: post_pr
         uses: octokit/request-action@v2.x