Comment by fizlebit

yeah it is so mad:

TITLE=$(echo '${{ github.event.issue.title }}' | sed 's/"/\\"/g' | sed "s/'/\\\'/g")

Even in ruby it would have been something like

TITLE=shell_escape(github.event.issue.title)

where shell_escape could at least have unit tests. I don't know anything about github actions, but anything that takes user input needs to be processed with a language that uses static typing I believe to help ensure that the user input doesn't get into expressions given to other programs, shell, sql, or whatever.

Unix was just not made for this sort of thing. It was made for in-house people to write patent applications.