Surfaced during triage of #16 (merged in 7314914).
`.github/workflows/template-init.yml` does:
```bash
sed -i "s/Add your description here/${repo_desc}/" pyproject.toml
```
The forward-slash delimiter breaks if `repo_desc` contains `/` (very common — e.g. "Library for X / Y"). The workflow step will print a sed syntax error and the description will stay as the placeholder.
Suggested fix
Use a delimiter unlikely to appear in descriptions and escape backslashes:
```bash
desc_escaped=$(printf '%s' "$repo_desc" | sed 's/[&|]/\&/g')
sed -i "s|Add your description here|${desc_escaped}|" pyproject.toml
```
(Or shell out to python/jq for a more robust approach.)
Secondary concern
`repo_desc="${{ github.event.repository.description }}"` interpolates the description directly into the shell command. A description like `"; rm something;` would execute. Self-injection only (user controls their own template repo description), but worth noting.
Surfaced during triage of #16 (merged in 7314914).
`.github/workflows/template-init.yml` does:
```bash
sed -i "s/Add your description here/${repo_desc}/" pyproject.toml
```
The forward-slash delimiter breaks if `repo_desc` contains `/` (very common — e.g. "Library for X / Y"). The workflow step will print a sed syntax error and the description will stay as the placeholder.
Suggested fix
Use a delimiter unlikely to appear in descriptions and escape backslashes:
```bash
desc_escaped=$(printf '%s' "$repo_desc" | sed 's/[&|]/\&/g')
sed -i "s|Add your description here|${desc_escaped}|" pyproject.toml
```
(Or shell out to python/jq for a more robust approach.)
Secondary concern
`repo_desc="${{ github.event.repository.description }}"` interpolates the description directly into the shell command. A description like `"; rm something;` would execute. Self-injection only (user controls their own template repo description), but worth noting.