ci: Fix PowerShell quoting in the windows release build #47

Merged

linus merged 1 commit from ash/fix-windows-release-quoting into develop

2026-10-24 17:12:16 +00:00

ash commented

2026-10-24 17:09:05 +00:00

Collaborator

Why

The v1.0.5 release (run 170, job Build windows, step Build for windows) failed before compiling: the -o path nested double quotes (-replace "^v","") inside a double-quoted string, so PowerShell reported "The string is missing the terminator" and "Missing closing ')' in subexpression".

What changed

.forgejo/workflows/tag-release.yaml: compute $ver = $env:VERSION -replace '^v', '' first, then use $ver in the -o path. I checked every workflow: this was the only occurrence. The PR and push CI Windows steps use plain $env:VERSION and don't strip the v.

Testing

No pwsh on the jumpbox, so I ran PowerShell 7.4.6 on the box and called [System.Management.Automation.Language.Parser]::ParseInput on the step script:

old line from develop: 2 errors, the same as run 170 ("The string is missing the terminator", "Missing closing ')' in subexpression")
new step (all 4 lines): 0 errors
with VERSION=v1.0.6 and BUILD=171 the path is bin/swiped-mod-switcher-1.0.6-171-windows-amd64.exe

PR CI doesn't run tag-release.yaml, so the real proof is the next tag run.

Risk / rollback

CI only. Revert the commit to roll back.

## Why The v1.0.5 release (run 170, job Build windows, step Build for windows) failed before compiling: the `-o` path nested double quotes (`-replace "^v",""`) inside a double-quoted string, so PowerShell reported "The string is missing the terminator" and "Missing closing ')' in subexpression". ## What changed `.forgejo/workflows/tag-release.yaml`: compute `$ver = $env:VERSION -replace '^v', ''` first, then use `$ver` in the `-o` path. I checked every workflow: this was the only occurrence. The PR and push CI Windows steps use plain `$env:VERSION` and don't strip the `v`. ## Testing No pwsh on the jumpbox, so I ran PowerShell 7.4.6 on the box and called `[System.Management.Automation.Language.Parser]::ParseInput` on the step script: - old line from develop: 2 errors, the same as run 170 ("The string is missing the terminator", "Missing closing ')' in subexpression") - new step (all 4 lines): 0 errors - with VERSION=v1.0.6 and BUILD=171 the path is `bin/swiped-mod-switcher-1.0.6-171-windows-amd64.exe` PR CI doesn't run tag-release.yaml, so the real proof is the next tag run. ## Risk / rollback CI only. Revert the commit to roll back.

ash added 1 commit

2026-10-24 17:09:06 +00:00

ci: Fix PowerShell quoting in the windows release build

CI / Build windows (pull_request) Successful in 10s

Details

CI / Build (pull_request) Successful in 43s

Details

CI / Lint (pull_request) Successful in 46s

Details

CI / Test (pull_request) Successful in 52s

Details

8abce52aac

Run 170 (v1.0.5) failed in Build for windows: the -o path nested double quotes inside a double-quoted string, so PowerShell could not parse the step. Compute the stripped version into $ver first with single-quoted replace arguments.

ash requested reviews from eva, blake

2026-10-24 17:09:06 +00:00

eva approved these changes

2026-10-24 17:10:49 +00:00

eva left a comment

GO on 8abce52. Pulling the version strip into $ver with a single-quoted pattern fixes the nested double quotes that broke run 170, and the output name now matches the Linux/macOS builds (${VERSION#v}). The step runs under Windows PowerShell (shell: powershell), not pwsh 7, but this syntax parses the same in both. Upload still picks up everything in bin/, so nothing downstream depends on the exact name. PR CI is green; as you said, the real proof is the next tag run.

This touches the release workflow, so Blake needs to sign off before Linus merges.

GO on 8abce52. Pulling the version strip into `$ver` with a single-quoted pattern fixes the nested double quotes that broke run 170, and the output name now matches the Linux/macOS builds (`${VERSION#v}`). The step runs under Windows PowerShell (`shell: powershell`), not pwsh 7, but this syntax parses the same in both. Upload still picks up everything in `bin/`, so nothing downstream depends on the exact name. PR CI is green; as you said, the real proof is the next tag run. This touches the release workflow, so Blake needs to sign off before Linus merges.

blake approved these changes

2026-10-24 17:11:54 +00:00

blake left a comment

Security GO on 8abce52aac (Blake, read by hand).

Diff is 1 file, +2/-1, only the Windows build step's run: script. The version strip moves into $ver = $env:VERSION -replace '^v', ''.
No script injection: the untrusted tag name still reaches PowerShell only through env: VERSION: ${{github.ref_name}} and is used as $env:VERSION. No ${{ }} is interpolated into the script.
Triggers (on: push: tags) and permissions are unchanged. No token is referenced or echoed in this step, and there's no workflow_dispatch exposure (cf. vulture#22).

Security GO on 8abce52aac (Blake, read by hand). - Diff is 1 file, +2/-1, only the Windows build step's `run:` script. The version strip moves into `$ver = $env:VERSION -replace '^v', ''`. - No script injection: the untrusted tag name still reaches PowerShell only through `env: VERSION: ${{github.ref_name}}` and is used as `$env:VERSION`. No `${{ }}` is interpolated into the script. - Triggers (`on: push: tags`) and permissions are unchanged. No token is referenced or echoed in this step, and there's no workflow_dispatch exposure (cf. vulture#22).