fix: publish hardened workflow sync action

* fix: write multiline action outputs safely

Signed-off-by: Vitor Mattos <vitor@php.rio>

* test: cover multiline action outputs

Signed-off-by: Vitor Mattos <vitor@php.rio>

* fix: pin hardened workflow sync action

Signed-off-by: Vitor Mattos <vitor@php.rio>

* fix: pin hardened workflow sync action

Signed-off-by: Vitor Mattos <vitor@php.rio>

* test: cover single-line action outputs

Signed-off-by: Vitor Mattos <vitor@php.rio>

---------

Signed-off-by: Vitor Mattos <vitor@php.rio>

Author: vitormattos

actions/sync-workflows/sync.py

@@ -245,8 +245,14 @@ def render_summary(report: dict[str, object]) -> str:
 
 def write_output(name: str, value: str) -> None:
     output = os.environ.get("GITHUB_OUTPUT")
-    if output:
-        with Path(output).open("a", encoding="utf-8") as handle:
+    if not output:
+        return
+
+    with Path(output).open("a", encoding="utf-8") as handle:
+        if "\n" in value:
+            delimiter = f"WORKFLOW_SYNC_{name.upper()}"
+            handle.write(f"{name}<<{delimiter}\n{value}{delimiter}\n")
+        else:
             handle.write(f"{name}={value}\n")
 
 

patches/nextcloud/sync-workflow-templates.yml.patch

@@ -113,7 +113,7 @@
 -          echo "DRAFT_ONLY=${draft_only}" >> $GITHUB_ENV
 +      - name: Synchronize workflow templates
 +        id: sync
-+        uses: LibreCodeCoop/github-workflows/actions/sync-workflows@57e644fe4882e942ac19bbe99729b4b7e3c9014e
++        uses: LibreCodeCoop/github-workflows/actions/sync-workflows@5006416b915ee2d0f10f6349b4762f588a899bcd
 +        with:
 +          source: source/workflow-templates
 +          target: target

tests/test_sync_workflows_action.py

@@ -3,9 +3,11 @@
 
 import hashlib
 import importlib.util
+import os
 import tempfile
 import unittest
 from pathlib import Path
+from unittest.mock import patch
 
 MODULE_PATH = (
     Path(__file__).resolve().parents[1]
@@ -194,6 +196,31 @@ def test_broken_patch_sets_draft_signal_and_keeps_catalog_lock(self) -> None:
                 sync_module.md5(source_file),
             )
 
+    def test_writes_single_line_github_output(self) -> None:
+        with tempfile.TemporaryDirectory() as directory:
+            output = Path(directory) / "output"
+            with patch.dict(os.environ, {"GITHUB_OUTPUT": str(output)}):
+                sync_module.write_output("changed", "true")
+
+            self.assertEqual(
+                output.read_text(encoding="utf-8"),
+                "changed=true\n",
+            )
+
+    def test_writes_multiline_github_output(self) -> None:
+        with tempfile.TemporaryDirectory() as directory:
+            output = Path(directory) / "output"
+            with patch.dict(os.environ, {"GITHUB_OUTPUT": str(output)}):
+                sync_module.write_output("summary", "line one\nline two\n")
+
+            self.assertEqual(
+                output.read_text(encoding="utf-8"),
+                "summary<<WORKFLOW_SYNC_SUMMARY\n"
+                "line one\n"
+                "line two\n"
+                "WORKFLOW_SYNC_SUMMARY\n",
+            )
+
     def test_mixed_result_summary_is_deterministic(self) -> None:
         summary = sync_module.render_summary(
             {

workflow-templates/sync-workflow-templates.yml

@@ -67,7 +67,7 @@ jobs:
 
       - name: Synchronize workflow templates
         id: sync
-        uses: LibreCodeCoop/github-workflows/actions/sync-workflows@57e644fe4882e942ac19bbe99729b4b7e3c9014e
+        uses: LibreCodeCoop/github-workflows/actions/sync-workflows@5006416b915ee2d0f10f6349b4762f588a899bcd
         with:
           source: source/workflow-templates
           target: target