From 123c0dbb7b1aa0e0a68cbb3a65ac79fb0ee01a5c Mon Sep 17 00:00:00 2001
From: Keith Solomon <ksolomon@gmail.com>
Date: Tue, 11 Aug 2026 13:27:24 -0500
Subject: [PATCH] Fix bash heredoc-inside-command-substitution by writing to
 temp file

---
 .github/workflows/release.yml | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 143f506..67d0ebf 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -95,7 +95,8 @@ jobs:
               exit 1
             fi
 
-            payload=$(TAG="$TAG" GH_SHA="$GITHUB_SHA" python3 - <<'PYEOF'
+            # Build the JSON payload to a temp file via Python heredoc.
+            python3 - > /tmp/release-payload.json <<'PYEOF'
             import json, os
             print(json.dumps({
                 "tag_name": os.environ["TAG"],
@@ -110,13 +111,12 @@ jobs:
                 "generate_release_notes": True,
             }))
             PYEOF
-            )
 
             release_json=$(curl -fsS -X POST \
               -H "Authorization: token ${GITHUB_TOKEN}" \
               -H "Accept: application/vnd.github+json" \
               -H "Content-Type: application/json" \
-              -d "$payload" \
+              -d @/tmp/release-payload.json \
               "${GH_API_URL}/repos/${REPO}/releases")
             release_id=$(python3 -c 'import json,sys; print(json.loads(sys.stdin.read())["id"])' <<<"$release_json")
             upload_url=$(python3 -c 'import json,sys; print(json.loads(sys.stdin.read())["upload_url"])' <<<"$release_json")
@@ -144,7 +144,7 @@ jobs:
               API="${GH_API_URL%/}/api/v1"
             fi
 
-            payload=$(TAG="$TAG" GH_SHA="$GITHUB_SHA" python3 - <<'PYEOF'
+            python3 - > /tmp/release-payload.json <<'PYEOF'
             import json, os
             print(json.dumps({
                 "tag_name": os.environ["TAG"],
@@ -158,12 +158,11 @@ jobs:
                 "prerelease": False,
             }))
             PYEOF
-            )
 
             release_json=$(curl -fsS -X POST \
               -H "Authorization: token ${GITEA_TOKEN}" \
               -H "Content-Type: application/json" \
-              -d "$payload" \
+              -d @/tmp/release-payload.json \
               "${API}/repos/${REPO}/releases")
             release_id=$(python3 -c 'import json,sys; print(json.loads(sys.stdin.read())["id"])' <<<"$release_json")
             if [ -z "$release_id" ]; then