From 2dbe2e317946cc28ef27e18523fcc5ea46bf9e91 Mon Sep 17 00:00:00 2001
From: Justus Magin <keewis@posteo.de>
Date: Wed, 20 Sep 2023 09:16:45 +0200
Subject: [PATCH] use an environment variable to print the detected commit
 message

This avoids expanding (and potentially executing) the commit message.
---
 action.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/action.yml b/action.yml
index 615e37a..75763be 100644
--- a/action.yml
+++ b/action.yml
@@ -22,11 +22,13 @@ runs:
     - name: show detection result
       run: |
         echo "::group::final summary"
-        echo "commit message: ${{ steps.detect-trigger.outputs.COMMIT_MESSAGE }}"
+        echo "commit message: $COMMIT_MESSAGE"
         echo "trigger keyword: ${{ inputs.keyword }}"
         echo "trigger found: ${{ steps.detect-trigger.outputs.CI_TRIGGERED }}"
         echo "::endgroup::"
       shell: bash
+      env:
+        COMMIT_MESSAGE: "${{ steps.detect-trigger.outputs.COMMIT_MESSAGE }}"
 branding:
   color: 'orange'
   icon: 'git-commit'