## Description
The `release-notes-pr-trigger` workflow was interpolating PR context
values
(`html_url`, `title`, `user.login`) directly into a shell heredoc. A
specially crafted PR title or author name could break out of the JSON
string
and execute arbitrary commands.
This change moves the GitHub context values into environment variables
and
uses `jq` to safely construct the JSON artifact, eliminating the
injection
vector.
## Related issues or tickets
None
## Reviews
- [x] Technical review
Signed-off-by: Lorena Rangel <lorena.rangel@docker.com>
## Description
The Slack notification workflow for Desktop release notes PRs fails when
the PR is opened from a fork because GitHub doesn't expose repository
secrets to `pull_request` events from forks.
This PR splits the workflow into two:
1. **Release Notes PR Trigger** — runs on `pull_request`, saves PR
details (URL, title, author) as an artifact. No secrets needed.
2. **Notify Slack on Desktop Release Notes PR** — runs on `workflow_run`
after the trigger completes, downloads the artifact, and sends the
Slack notification. Has access to secrets since `workflow_run` runs in
the context of the base repository.
## Related issues or tickets
Fixes the `SlackError: Missing input! A token must be provided` error
in the notify-release-notes-pr workflow.
## Reviews
- [x] Technical review
Signed-off-by: Lorena Rangel <lorena.rangel@docker.com>
