Workflow to create GFM artifact(s)

[sebbASF]

This workflow runs once a week to create the GFM artifact if necessary.
Most weeks it should do nothing, as there should already be an artifact present.
The gap between runs could be increased, provided that the expiry date checking was also updated.

[jsoref]

you should never use ${{ ... }} inside a run: block.

use:

env:
  gfm_version: ${{ matrix.gfm_version }}
...
run:
          echo "Found a valid artifact for $gfm_version (expires $OUT)"
...

[sebbASF]

Why not?

[jsoref]

Depending on what you're doing, it can result in security vulnerabilities or very surprising misbehaviors.

In this case, if your matrix was:

matrix:
  gfm_version:
  - hello"; touch /tmp/flag; echo "

then you'd be constructing a script of the form:

          echo "Found a valid artifact for hello"; touch /tmp/flag; echo " (expires $OUT)"

which is fairly surprising.
https://github.com/check-spelling-sandbox/sturdy-adventure/actions/runs/13166687061/job/36748420310#step:6:14

[sebbASF]

I see, thanks for the explanation.
It seems unlikely that the matrix would contain such a value, but I agree it is safer to protect the code by using an intermediate variable.

[jsoref]

it's nice if you automatically debug on rerun...

|| [ "$GITHUB_RUN_ATTEMPT" != 1 ]

[jsoref]

Note that you should also move this to an env:, it isn't just ${{ matrix, it's ${{ anything

[sebbASF]

Yes, I realise that. Except perhaps $(( github.xxx }} for some values of xxx

[jsoref]

for most of those, github has a $GITHUB_..., so you really should never do it :)... it's a safe enough rule.

[sebbASF]

AIUI, $GITHUB_ is replaced at run-time, whereas ${{ github.xxx }} is replaced before passing the script to the runner. This means a simple replacement is not possible in general. In particular, Windows scripts may be tricky to fix.