Fix escaping in workflows

Author: ishulgin

.github/workflows/codex-update.yml

@@ -23,22 +23,22 @@ jobs:
       - name: Check if update is required
         id: check
         run: |
-          if ! npm outdated ${{ env.CODEX_PACKAGE }}; then
+          if ! npm outdated "$CODEX_PACKAGE"; then
             echo "Package is up to date"
             exit 0
           fi
 
-          LATEST=$(npm view ${{ env.CODEX_PACKAGE }} version)
+          LATEST=$(npm view "$CODEX_PACKAGE" version)
           BRANCH="codex-update/$LATEST"
 
           if git ls-remote --exit-code --heads origin "refs/heads/$BRANCH" >/dev/null 2>&1; then
             echo "Branch $BRANCH already exists"
             exit 0
           fi
 
-          echo "version=$LATEST" >> $GITHUB_OUTPUT
-          echo "branch=$BRANCH" >> $GITHUB_OUTPUT
-          echo "should_update=true" >> $GITHUB_OUTPUT
+          echo "version=$LATEST" >> "$GITHUB_OUTPUT"
+          echo "branch=$BRANCH" >> "$GITHUB_OUTPUT"
+          echo "should_update=true" >> "$GITHUB_OUTPUT"
 
   update:
     needs: check
@@ -54,14 +54,14 @@ jobs:
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
-          git checkout -b "${{ env.BRANCH }}"
+          git checkout -b "$BRANCH" --
 
       - name: Install new version of package and commit
         run: |
-          npm install ${{ env.CODEX_PACKAGE }}@${{ env.VERSION }}
+          npm install "$CODEX_PACKAGE@$VERSION"
           npm run generate-types
           git add package.json package-lock.json src/app-server
-          git commit -m "Update codex to ${{ env.VERSION }}"
+          git commit -m "Update codex to $VERSION"
 
       - name: Finalize update with Codex
         id: codex-finalize
@@ -83,7 +83,7 @@ jobs:
 
       - name: Push branch updates
         run: |
-          git push origin "${{ env.BRANCH }}"
+          git push -- origin "$BRANCH"
 
       - name: Generate GitHub App token
         id: app-token
@@ -96,10 +96,10 @@ jobs:
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
         run: |
-          echo -e "[What's new](https://github.com/openai/codex/releases/tag/rust-v${{ env.VERSION }})\n\n$(cat pr-body.md 2>/dev/null || true)" > pr-body.md
+          echo -e "[What's new](https://github.com/openai/codex/releases/tag/rust-v${VERSION})\n\n$(cat pr-body.md 2>/dev/null || true)" > pr-body.md
 
           gh pr create \
             --base main \
-            --title "Update codex to ${{ env.VERSION }}" \
+            --title "Update codex to $VERSION" \
             --body-file pr-body.md \
             --label "codex-update"

.github/workflows/release.yml

@@ -88,7 +88,11 @@ jobs:
           </plist>
           EOF
           ENTITLEMENTS_BASE64=$(gzip -c entitlements.plist | base64 -w 0)
-          echo "ENTITLEMENTS_BASE64=$ENTITLEMENTS_BASE64" >> $GITHUB_ENV
+          {
+            echo "ENTITLEMENTS_BASE64<<EOF"
+            echo "$ENTITLEMENTS_BASE64"
+            echo "EOF"
+          } >> "$GITHUB_ENV"
 
       - name: Sign macOS binaries
         env: