From 2b0651119d320341f26b28f311f7e21a9c86a6d5 Mon Sep 17 00:00:00 2001 From: Echolonius Date: Fri, 10 Jul 2026 21:16:57 -0500 Subject: [PATCH] fix(ci): escape issue title in Slack notification payload The workflow interpolated the raw issue title into a JSON payload, so any title containing a double quote produced invalid JSON and the run failed. All three historical failures of this workflow (issues titled with "defer", skills="all", and "Error: Stream closed") are titles containing quotes; every success is quote-free. Wrap the interpolation in toJSON(format(...)) so the title is escaped (and, as a side effect, a crafted title can no longer inject arbitrary Slack API payload fields). --- .github/workflows/slack-issue-notification.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/slack-issue-notification.yml b/.github/workflows/slack-issue-notification.yml index 0360b1c3b..d4c5e6941 100644 --- a/.github/workflows/slack-issue-notification.yml +++ b/.github/workflows/slack-issue-notification.yml @@ -22,7 +22,7 @@ jobs: "type": "section", "text": { "type": "mrkdwn", - "text": "*New Issue:* <${{ github.event.issue.html_url }}|#${{ github.event.issue.number }} ${{ github.event.issue.title }}>" + "text": ${{ toJSON(format('*New Issue:* <{0}|#{1} {2}>', github.event.issue.html_url, github.event.issue.number, github.event.issue.title)) }} } }, {