From 815306f1d0e1155f27a650ea7bfbee89a857c0de Mon Sep 17 00:00:00 2001
From: Rachel Powers <508861+Ryex@users.noreply.github.com>
Date: Fri, 21 Mar 2025 12:16:44 -0700
Subject: [PATCH] Use group redirections for multiple outputs, prevent glob
 expansion of PR_NUMBER

Co-authored-by: Seth Flynn <getchoo@tuta.io>
Signed-off-by: Rachel Powers <508861+Ryex@users.noreply.github.com>
---
 .github/workflows/blocked-prs.yml       | 20 ++++++++++++--------
 .github/workflows/merge-blocking-pr.yml |  6 ++++--
 2 files changed, 16 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/blocked-prs.yml b/.github/workflows/blocked-prs.yml
index 9a6caab7d..d32f53bb1 100644
--- a/.github/workflows/blocked-prs.yml
+++ b/.github/workflows/blocked-prs.yml
@@ -134,9 +134,11 @@ jobs:
                   '
             done < <(jq -c '.blocking[]' <<< "$BLOCKING_PRS") | jq -c -s
           )
-          echo "data=$blocked_pr_data" >> "$GITHUB_OUTPUT"
-          echo "all_merged=$(jq -r 'all(.[].merged; .)' <<< "$blocked_pr_data")" >> "$GITHUB_OUTPUT"
-          echo "current_blocking=$(jq -c 'map( select( .merged | not ) | .number )' <<< "$blocked_pr_data" )" >> "$GITHUB_OUTPUT"
+          {
+            echo "data=$blocked_pr_data";
+            echo "all_merged=$(jq -r 'all(.[].merged; .)' <<< "$blocked_pr_data")";
+            echo "current_blocking=$(jq -c 'map( select( .merged | not ) | .number )' <<< "$blocked_pr_data" )";
+          } >> "$GITHUB_OUTPUT"
 
       - name: Add 'blocked' Label is Missing
         id: label_blocked
@@ -145,7 +147,7 @@ jobs:
         env:
           GH_TOKEN: ${{ steps.generate-token.outputs.token }}
         run: |
-          gh -R ${{ github.repository }} issue edit --add-label 'blocked' $PR_NUMBER
+          gh -R ${{ github.repository }} issue edit --add-label 'blocked' "$PR_NUMBER"
 
       - name: Remove 'blocked' Label if All Dependencies Are Merged
         id: unlabel_blocked
@@ -154,7 +156,7 @@ jobs:
         env:
           GH_TOKEN: ${{ steps.generate-token.outputs.token }}
         run: |
-          gh -R ${{ github.repository }} issue edit --remove-label 'blocked' $PR_NUMBER
+          gh -R ${{ github.repository }} issue edit --remove-label 'blocked' "$PR_NUMBER"
 
       - name: Apply 'blocking' Label to Unmerged Dependencies
         id: label_blocking
@@ -213,9 +215,11 @@ jobs:
             echo "  - $type #$base_pr $status [(compare)]($compare_url)" >> "$COMMENT_PATH"
           done < <(jq -c '.[]'  <<< "$BLOCKING_DATA")
 
-          echo 'body<<EOF' >> "$GITHUB_OUTPUT"
-          cat "${COMMENT_PATH}" >> "$GITHUB_OUTPUT"
-          echo 'EOF' >> "$GITHUB_OUTPUT"
+          {
+            echo 'body<<EOF';
+            cat "${COMMENT_PATH}";
+            echo 'EOF';
+          } >> "$GITHUB_OUTPUT"
 
       - name: 💬 PR Comment
         if: fromJSON(steps.pr_ids.outputs.prs).numBlocking > 0
diff --git a/.github/workflows/merge-blocking-pr.yml b/.github/workflows/merge-blocking-pr.yml
index 755cdcde9..6f85b9282 100644
--- a/.github/workflows/merge-blocking-pr.yml
+++ b/.github/workflows/merge-blocking-pr.yml
@@ -39,8 +39,10 @@ jobs:
                 )) as $i ([]; . + [$i])
               '
           )
-          echo "deps=$blocked_prs" >> "$GITHUB_OUTPUT"
-          echo "numdeps=$(jq -r '. | length' <<< "$blocked_prs")" >> "$GITHUB_OUTPUT"
+          {
+            echo "deps=$blocked_prs"
+            echo "numdeps=$(jq -r '. | length' <<< "$blocked_prs")" 
+          }  >> "$GITHUB_OUTPUT"
 
       - name: Trigger Blocked PR Workflows for Dependants
         if: fromJSON(steps.gather_deps.outputs.numdeps) > 0