What is the correct character escaping for workflow command values e.g. echo ::error::XXXX #26736

ben-spiller · 2020-06-17T12:55:39Z

ben-spiller
Jun 17, 2020

I’m using the “echo” approach to add annotations to give errors for test failures. I’m including the error message from the test which could contain arbitrary characters, and I couldn’t see from https://help.github.com/en/actions/reference/workflow-commands-for-github-actions what kind of escaping I need to perform on the command value?

From hacking around it looks like colons are OK but there’s something special going on with % characters (e.g. %0A produces a newline), maybe I should be doing URL encoding? But it doesn’t seem like other URL chars are encoded, so I’m not sure. Would be great if someone could definitively confirm what encoding is needed for safely representing string as workflow command values
e.g.
echo “::error::This is a message with chars !*’();:@&=+$,/?# with %25 and %0A in it”

Answered by ghost

Jul 8, 2020

Hi, sorry for the delay.

The actions/toolkit has a way to sanitize an input into a string – could you give these commands a try?

github.com

actions/toolkit/blob/cee7d92d1d02e3107c9b1387b9690b89096b67be/packages/core/src/command.ts#L92-L105


function escapeData(s: any): string {
  return toCommandValue(s)
    .replace(/%/g, '%25')
    .replace(/\r/g, '%0D')
    .replace(/\n/g, '%0A')
}


function escapeProperty(s: any): string {
  return toCommandValue(s)
    .replace(/%/g, '%25')
    .replace(/\r/g, '%0D')
    .replace(/\n/g, '%0A')
    .replace(/:/g, '%3A')
    .replace(/,/g, '%2C')

View full answer

ghost · 2020-06-22T17:17:15Z

ghost
Jun 22, 2020

Hello – we’re trying to reproduce this on our end:

Are you able to share a copy of your workflow file?

If the repository is public, could you link that to us as well?

For more context, could you let us know what the expected behaviour of the workflow run is versus what is being outputted now?

Thank you!

0 replies

ben-spiller · 2020-06-23T19:18:16Z

ben-spiller
Jun 23, 2020
Author

Hi this isn’t a bug report so there’s nothing to repo really - I’m asking a question about how your API works so that I can make sure when I output a message using echo “::error::XXXXX" syntax the XXXXX shows up as I expect. Clearly there is some special handling for % escape sequences otherwise
echo “::error::This is a message with chars !*’();:@&=+$,/?# with %25 and %0A in it”
would result in a message containing “%25 and %0A” rather than what it actually does which is to convert %25 to a % and %0A to a newline. I don’t think that’s a bug, but I do what to know the specification for exactly what GitHub is doing with these strings as it’s not obvious. And because I don’t want to start relying on behaviour that is not officially supported. Thanks

0 replies

ben-spiller · 2020-06-30T15:34:36Z

ben-spiller
Jun 30, 2020
Author

Hi there, any input on this? Really need a definitive answer from GitHub on how this works, thanks.

0 replies

ghost · 2020-07-08T18:15:45Z

ghost
Jul 8, 2020

Hi, sorry for the delay.

The actions/toolkit has a way to sanitize an input into a string – could you give these commands a try?

github.com

actions/toolkit/blob/cee7d92d1d02e3107c9b1387b9690b89096b67be/packages/core/src/command.ts#L92-L105


function escapeData(s: any): string {
  return toCommandValue(s)
    .replace(/%/g, '%25')
    .replace(/\r/g, '%0D')
    .replace(/\n/g, '%0A')
}


function escapeProperty(s: any): string {
  return toCommandValue(s)
    .replace(/%/g, '%25')
    .replace(/\r/g, '%0D')
    .replace(/\n/g, '%0A')
    .replace(/:/g, '%3A')
    .replace(/,/g, '%2C')

0 replies

dave99galloway · 2021-11-25T13:38:05Z

dave99galloway
Nov 25, 2021

Hi team - can you please give an example of how this might work in a workflow yml? I haven’t been able to figure it out from the docs

# Manually trigger a workflow to test the called workflow actions name: Manual workflow Controls when the action will run. Workflow runs when manually triggered using the UI or API. (or push if not commented out) on: workflow_dispatch: # Inputs the workflow accepts. inputs: reason: # Friendly description to be shown in the UI instead of 'reason' description: 'Reason for build' # Default value if no value is explicitly provided default: 'Test' # Input has to be provided for the workflow to run required: false jobs: call-workflow: uses: my-org/my-repo/.github/workflows/my-called-workflow.yml@MY-BRANCH with: BUILD_REASON: ${{ github.event.inputs.reason }}

from here I see I need to do something like

echo '::escapeData::${{ github.event.inputs.reason }}'

but this gives the literal value in the called wf:-

  env:
    BUILD_REASON: echo '::escapeData::Test I've escaped this'

if I remove the echo, the workflow file can’t be run at all:-

      BUILD_REASON: ::escapeData::${{ github.event.inputs.reason }}

gives

Use workflow from
Workflow does not exist or does not have a workflow_dispatch trigger in this branch.

putting the command inside the deference of the env var gives:

BUILD_REASON: ${{ ::escapeData::github.event.inputs.reason }} Check failure on line 39 in .github/workflows/manual.yml

GitHub Actions / Manual workflow Invalid workflow file The workflow is not valid. .github/workflows/manual.yml (Line: 39, Col: 21): Unexpected symbol: '::escapeData::github'. Located at position 1 within expression: ::escapeData::github.event.inputs.reason

this also fails:-

BUILD_REASON: ${{ echo '::escape-data::github.event.inputs.reason' }} Check failure on line 39 in .github/workflows/manual.yml

GitHub Actions / Manual workflow Invalid workflow file The workflow is not valid. .github/workflows/manual.yml (Line: 39, Col: 21): Unrecognized named-value: 'echo'. Located at position 1 within expression: echo '::escape-data::github.event.inputs.reason'

0 replies

airtower-luna · 2021-11-25T15:35:42Z

airtower-luna
Nov 25, 2021

If you’re trying to pre-process the input value, you can do that in a separate job that creates an output with the escaped data. However I’d rather do any escaping that may be necessary in the called workflow, to make it more robust.

0 replies

dave99galloway · 2021-11-26T13:32:59Z

dave99galloway
Nov 26, 2021

hi @airtower-luna - could you please give an example ? the syntax seems weird in the examples in the doc. happy to move into the called workflow to do this, but what does that look like?

TIA :slight_smile:

0 replies

airtower-luna · 2021-11-26T23:10:44Z

airtower-luna
Nov 26, 2021

Something like this, I used actions/github-script to directly run Javascript code. You could do the same in any other programming language via run, but this way I could just copy the escape code from actions/toolkit. I’d have preferred to call the function, but the “For internal use, subject to change” comment made that look questionable. 😉

  <a href="https://github.com/airtower-luna/hello-github-actions/blob/485336f405d869bee8051f0bbfdeabedd9e4ae7f/.github/workflows/reusable-echo.yaml" target="_blank" rel="noopener">github.com</a>

airtower-luna/hello-github-actions/blob/485336f405d869bee8051f0bbfdeabedd9e4ae7f/.github/workflows/reusable-echo.yaml

<pre><code class="lang-yaml">name: Reusable echo example with input

on:
workflow_call:
inputs:
test:
required: true
type: string

jobs:
echo:
runs-on: ubuntu-latest
steps:
- uses: actions/github-script@v5.0.0
id: pre-process
env:
TEST: ${{ inputs.test }}
with:
script: |
const { TEST } = process.env

This file has been truncated. show original

0 replies

dave99galloway · 2021-12-03T11:34:36Z

dave99galloway
Dec 3, 2021

@airtower-luna
thank you, I’m going to give this a try now. Just for my knowledge on how to use toolkit actions though, let’s say I wasn’t worried about the “For internal use, subject to change” comment

what would the correct workflow call loo like using the built in function?

tia!

0 replies

dave99galloway · 2021-12-03T11:54:33Z

dave99galloway
Dec 3, 2021

@airtower-luna - i tried your example and the echo was empty

  <a href="https://github.com/dave99galloway/github-actions-issues/runs/4407583438?check_suite_focus=true" target="_blank" rel="noopener nofollow ugc">GitHub</a>

Create call-sanitiser.yml · dave99galloway/github-actions-issues@a58876b

reproduction of github actions issues. Contribute to dave99galloway/github-actions-issues development by creating an account on GitHub.

where are the step outputs supposed to be set?

TIA!

0 replies

dave99galloway · 2021-12-03T14:35:20Z

dave99galloway
Dec 3, 2021

Hi Support! do you have an example of this being used somewhere?

0 replies

airtower-luna · 2021-12-03T16:46:27Z

airtower-luna
Dec 3, 2021

The TEST environment variable is empty when the replacement is done, so of course the output will be empty, too:

  <a href="https://github.com/dave99galloway/github-actions-issues/runs/4407583438?check_suite_focus=true#step:2:13" target="_blank" rel="noopener">GitHub</a>

Create call-sanitiser.yml · dave99galloway/github-actions-issues@a58876b

reproduction of github actions issues. Contribute to dave99galloway/github-actions-issues development by creating an account on GitHub.

The reason is here, where the parameter for the reusable workflow is set. github.events doesn’t exist, I assume you mean github.event, as in the example.

  <a href="https://github.com/dave99galloway/github-actions-issues/actions/runs/1535065589/workflow#L21" target="_blank" rel="noopener">github.com</a>

Create call-sanitiser.yml

  <div class="github-info">
    Calling Sanitiser <span class="github-run-number">#1</span>
  </div>

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

GitHub Community

What is the correct character escaping for workflow command values e.g. echo ::error::XXXX #26736

{{title}}

Replies: 12 comments

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Controls when the action will run. Workflow runs when manually triggered using the UI

or API. (or push if not commented out)

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

{{title}}

Create call-sanitiser.yml

Select a reply

What is the correct character escaping for workflow command values e.g. echo ::error::XXXX #26736

Replies: 12 comments

ben-spiller Jun 23, 2020 Author

ben-spiller Jun 30, 2020 Author

Controls when the action will run. Workflow runs when manually triggered using the UI

or API. (or push if not commented out)

ben-spiller
Jun 23, 2020
Author

ben-spiller
Jun 30, 2020
Author