Fix shell quoting issues (SC2086) across workflows and engines #3131
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
pelikhan
approved these changes
Nov 4, 2025
Contributor
There was a problem hiding this comment.
Pull Request Overview
This PR adds proper quoting to shell variable references and paths in GitHub Actions workflows to improve shell script safety and prevent potential issues with special characters or spaces. The changes ensure consistent best practices for shell scripting by wrapping variable expansions and file paths in double quotes.
Key changes:
- Added double quotes around environment variable references (e.g.,
$CODEX_HOME,$GITHUB_OUTPUT,$GH_AW_MCP_CONFIG,${{ github.repository }}) - Added double quotes around file paths with variable expansions (e.g.,
/tmp/gh-aw/prompt-cache/pr-full-data/pr-${pr_number}.json) - Added double quotes around npm package specifications with variable expansions (e.g.,
opencode-ai@${GH_AW_AGENT_VERSION})
Reviewed Changes
Copilot reviewed 18 out of 18 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| pkg/workflow/codex_engine.go | Added quotes around $CODEX_HOME/logs in mkdir commands |
| .github/workflows/video-analyzer.lock.yml | Added quotes around $GITHUB_OUTPUT in echo command |
| .github/workflows/test-post-steps.md | Added quotes around $GITHUB_STEP_SUMMARY in shell redirect |
| .github/workflows/test-post-steps.lock.yml | Added quotes around $GITHUB_STEP_SUMMARY in compiled workflow |
| .github/workflows/smoke-opencode.lock.yml | Added quotes around opencode-ai@${GH_AW_AGENT_VERSION} in npm install |
| .github/workflows/smoke-codex.lock.yml | Added quotes around $CODEX_HOME/logs in mkdir commands |
| .github/workflows/shared/opencode.md | Added quotes around opencode-ai@${GH_AW_AGENT_VERSION} in npm install |
| .github/workflows/shared/genaiscript.md | Added quotes around $GH_AW_MCP_CONFIG in genaiscript command |
| .github/workflows/shared/ffmpeg.md | Added quotes around $GITHUB_OUTPUT in echo command |
| .github/workflows/prompt-clustering-analysis.md | Added quotes around ${{ github.repository }} and file paths with variable expansion |
| .github/workflows/prompt-clustering-analysis.lock.yml | Added quotes around repository references and output file paths in compiled workflow |
| .github/workflows/duplicate-code-detector.lock.yml | Added quotes around $CODEX_HOME/logs in mkdir commands |
| .github/workflows/daily-test-improver.md | Added quotes around $GITHUB_OUTPUT in echo commands |
| .github/workflows/daily-test-improver.lock.yml | Added quotes around $GITHUB_OUTPUT in compiled workflow |
| .github/workflows/daily-perf-improver.md | Added quotes around $GITHUB_OUTPUT in echo commands |
| .github/workflows/daily-perf-improver.lock.yml | Added quotes around $GITHUB_OUTPUT in compiled workflow |
| .github/workflows/copilot-session-insights.md | Added quotes around $GITHUB_OUTPUT in multiple echo commands |
| .github/workflows/copilot-session-insights.lock.yml | Added quotes around $GITHUB_OUTPUT in compiled workflow |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Copilot
AI
changed the title
[WIP] Fix shell quoting issues across workflows
Fix shell quoting issues (SC2086) across workflows and engines
Nov 4, 2025
pelikhan
approved these changes
Nov 4, 2025
Contributor
|
@copilot merge main |
…ting-issues # Conflicts: # .github/workflows/copilot-session-insights.lock.yml # .github/workflows/prompt-clustering-analysis.lock.yml
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
auto-merge was automatically disabled
November 4, 2025 12:31
Head branch was pushed to by a user without write access
Contributor
Author
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Fix Shell Quoting Issues (SC2086) - ✅ COMPLETE
Objective
Add double quotes around variable references in shell scripts across 9 workflows to prevent globbing and word splitting issues (shellcheck SC2086).
Recent Changes
Plan Completion
Files Modified (9 total)
Workflow Files (5):
.github/workflows/copilot-session-insights.md- Fixed 6 unquoted$GITHUB_OUTPUTand$GITHUB_STEP_SUMMARY.github/workflows/prompt-clustering-analysis.md- Fixed 3 unquoted variables (${{ github.repository }}, file path with variable).github/workflows/daily-perf-improver.md- Fixed 2 unquoted$GITHUB_OUTPUT.github/workflows/daily-test-improver.md- Fixed 2 unquoted$GITHUB_OUTPUT.github/workflows/test-post-steps.md- Fixed 1 unquoted$GITHUB_STEP_SUMMARYShared Configuration Files (3):
6.
.github/workflows/shared/opencode.md- Fixed 1 unquoted npm package version variable7.
.github/workflows/shared/genaiscript.md- Fixed 1 unquoted$GH_AW_MCP_CONFIG8.
.github/workflows/shared/ffmpeg.md- Fixed 1 unquoted$GITHUB_OUTPUTSource Code (1):
9.
pkg/workflow/codex_engine.go- Fixed 2 unquoted$CODEX_HOME/logsin codex engineAcceptance Criteria - All Met ✅
Verification Results
Original prompt
✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.