Fix release note extraction from Git tag annotation

[seifertm]

Closes #1113

[codecov-commenter]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 89.93%. Comparing base (0de9ba0) to head (3731094).
Report is 7 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1120   +/-   ##
=======================================
  Coverage   89.93%   89.93%           
=======================================
  Files           2        2           
  Lines         447      447           
  Branches       53       53           
=======================================
  Hits          402      402           
  Misses         30       30           
  Partials       15       15           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[webknjaz]

It'd be good to integrate zizmor...

[seifertm]

@webknjaz Agreed!

I followed up with 2adcf52.

[webknjaz]

@seifertm that still allows command injection just the same. The solution is to replace GH-level templating w/ Bash interpolation.

[webknjaz]

I made a zizmor workflow recently. Here's how to integrate it: https://github.com/aio-libs/aiobotocore/pull/1355/files#diff-662dff05c7dfe6681c1007ae601e8573d413a03f9f9d53d951c2cb99caba4fd4R72

[seifertm]

@seifertm that still allows command injection just the same. The solution is to replace GH-level templating w/ Bash interpolation.

Right… Due to the Github template interpolation, you could insert " and escape the quoting. Thanks for pointing that out @webknjaz !

According to the docs on default environment variables, we can simply use the GITHUB_REF env variable. This eliminates the Github template expression entirely: 0688d17

[webknjaz]

Yep, for many simple things there's built-in env vars. For some, you might need to compute and put those into env vars. Note that in some contexts (like nested composite actions), some of the env vars may be borked, though.