From 7558a46fafa3fcb3cbcede19c4054332144023cf Mon Sep 17 00:00:00 2001
From: Denis Kasak <dkasak@termina.org.uk>
Date: Tue, 7 Jul 2026 10:55:42 +0000
Subject: [PATCH] Avoid interpolating expressions into scripts in CI workflows

---
 .github/workflows/docker.yml                | 7 ++++---
 .github/workflows/docs.yaml                 | 4 +++-
 .github/workflows/push_complement_image.yml | 4 +++-
 .github/workflows/twisted_trunk.yml         | 6 ++++--
 4 files changed, 14 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index d23d8e5b14..bdcceae418 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -106,10 +106,11 @@ jobs:
           outputs: type=image,push-by-digest=true,name-canonical=true,push=true
 
       - name: Export digest
+        env:
+          DIGEST: ${{ steps.build.outputs.digest }}
         run: |
-          mkdir -p ${{ runner.temp }}/digests
-          digest="${{ steps.build.outputs.digest }}"
-          touch "${{ runner.temp }}/digests/${digest#sha256:}"
+          mkdir -p "$RUNNER_TEMP/digests"
+          touch "$RUNNER_TEMP/digests/${DIGEST#sha256:}"
 
       - name: Upload digest
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml
index c2c0c7932d..107fe2db5b 100644
--- a/.github/workflows/docs.yaml
+++ b/.github/workflows/docs.yaml
@@ -67,7 +67,9 @@ jobs:
           mdbook-version: '0.5.2'
 
       - name: Set version of docs
-        run: echo 'window.SYNAPSE_VERSION = "${{ needs.pre.outputs.branch-version }}";' > ./docs/website_files/version.js
+        env:
+          BRANCH_VERSION: ${{ needs.pre.outputs.branch-version }}
+        run: echo "window.SYNAPSE_VERSION = \"$BRANCH_VERSION\";" > ./docs/website_files/version.js
 
       - name: Setup python
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
diff --git a/.github/workflows/push_complement_image.yml b/.github/workflows/push_complement_image.yml
index bfa452ff15..0ef5927fdf 100644
--- a/.github/workflows/push_complement_image.yml
+++ b/.github/workflows/push_complement_image.yml
@@ -76,8 +76,10 @@ jobs:
       - name: Run scripts-dev/complement.sh to generate complement-synapse:latest image.
         run: scripts-dev/complement.sh --build-only
       - name: Tag and push generated image
+        env:
+          TAGS: ${{ join(fromJson(steps.meta.outputs.json).tags, ' ') }}
         run: |
-          for TAG in ${{ join(fromJson(steps.meta.outputs.json).tags, ' ') }}; do 
+          for TAG in $TAGS; do
             echo "tag and push $TAG"
             # `localhost/complement-synapse` should match the image created by `scripts-dev/complement.sh`
             docker tag localhost/complement-synapse $TAG
diff --git a/.github/workflows/twisted_trunk.yml b/.github/workflows/twisted_trunk.yml
index a4c2671c98..9fbe851001 100644
--- a/.github/workflows/twisted_trunk.yml
+++ b/.github/workflows/twisted_trunk.yml
@@ -60,9 +60,11 @@ jobs:
           python-version: "3.x"
           extras: "all"
           poetry-version: "2.4.1"
-      - run: |
+      - env:
+          TWISTED_REF: ${{ inputs.twisted_ref || 'trunk' }}
+        run: |
           poetry remove twisted
-          poetry add --extras tls git+https://github.com/twisted/twisted.git#${{ inputs.twisted_ref || 'trunk' }}
+          poetry add --extras tls "git+https://github.com/twisted/twisted.git#$TWISTED_REF"
           poetry install --no-interaction --extras "all test"
       - name: Remove unhelpful options from mypy config
         run: sed -e '/warn_unused_ignores = True/d' -e '/warn_redundant_casts = True/d' -i mypy.ini