From 95c7dbc793a24dfba09ea751a0fe09dd1d4cd0f3 Mon Sep 17 00:00:00 2001
From: Paul Makles <me@insrt.uk>
Date: Thu, 12 Feb 2026 16:47:05 +0000
Subject: [PATCH] ci: do not interpolate directly into release workflows (#545)

---
 .github/workflows/release-please.yml  | 3 ++-
 .github/workflows/release-webhook.yml | 8 ++++++--
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 7e68e112..63d9a88e 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -45,8 +45,9 @@ jobs:
         if: ${{ steps.rp.outputs.prs_created == 'true' || steps.rp.outputs.prs_updated == 'true' }}
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          RP_PR_OUTPUT_JSON: ${{ steps.rp.outputs.prs }}
         run: |
-          PR_NUMBER=$(echo '${{ steps.rp.outputs.prs }}' | jq -r '.[0].number')
+          PR_NUMBER=$(echo "$RP_PR_OUTPUT_JSON" | jq -r '.[0].number')
           gh pr checkout "$PR_NUMBER"
           
           cargo update -w
diff --git a/.github/workflows/release-webhook.yml b/.github/workflows/release-webhook.yml
index 58a1d419..2262162c 100644
--- a/.github/workflows/release-webhook.yml
+++ b/.github/workflows/release-webhook.yml
@@ -12,8 +12,12 @@ jobs:
 
     steps:
       - name: Send release notification webhook
+        env:
+          TAG_NAME: ${{ github.event.release.tag_name }}
+          REPOSITORY: ${{ github.repository }}
+          WEBHOOK_URL: ${{ secrets.STOAT_WEBHOOK_UPDATES_URL }}
         run: |
-          RELEASE_URL="https://github.com/${{ github.repository }}/releases/tag/${{ github.event.release.tag_name }}"
-          curl -X POST "${{ secrets.STOAT_WEBHOOK_UPDATES_URL }}" \
+          RELEASE_URL="https://github.com/${REPOSITORY}/releases/tag/${TAG_NAME}"
+          curl -X POST "$WEBHOOK_URL" \
             -H "Content-Type: application/json" \
             -d "{\"content\": \"$RELEASE_URL\"}"