From 1a13239fb68b5ecbaba6a21e2bfb6bbaeb91c09b Mon Sep 17 00:00:00 2001
From: Miles Ward <miles.ward@pattern.com>
Date: Thu, 10 Sep 2026 15:39:33 -0400
Subject: [PATCH] CI: build release body with printf (heredoc broke the YAML
 block scalar)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .gitea/workflows/sync-upstream.yml | 57 +++++++++++++++---------------
 1 file changed, 28 insertions(+), 29 deletions(-)

diff --git a/.gitea/workflows/sync-upstream.yml b/.gitea/workflows/sync-upstream.yml
index 7af5930200..5b06b2fafe 100644
--- a/.gitea/workflows/sync-upstream.yml
+++ b/.gitea/workflows/sync-upstream.yml
@@ -214,35 +214,34 @@ jobs:
               *) TOKEN_NOTE="> **Launch-token auth (dsh 0.1.2+):** the Web UI requires a one-time token printed in \`docker logs\`; it rotates on every restart and is exchanged for a ~30-day cookie bound to the origin you open it on. \`@goodandready/dsh-lanmode\` ≤0.6.8 is incompatible with this line.";;
             esac
 
-            BODY=$(cat <<EOF
-${KIND}
-
-\`\`\`
-docker pull gitea.milesward.dev/mward4/deepseek-harness:${TAG}
-\`\`\`
-
-### What's inside
-
-| | |
-|---|---|
-| dsh | \`${VER}\` — [upstream release notes](https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v${VER}) |
-| pnpm | \`${PNPMV:-unknown}\` |
-| base image | \`${BASEV:-unknown}\` |
-| image digest | \`${DIGEST}\` |
-| built from | \`main@${MAIN_SHA}\` (published by CI run #${RUN_NUMBER}) |
-
-### Deploy on Unraid
-
-- **Repository:** \`gitea.milesward.dev/mward4/deepseek-harness:${TAG}\`
-- **Post Arguments** (replace the image command entirely):
-  \`web --patch /opt/deepseek-harness/web.cordis.patch.yml --no-open --trusted-host <host> [--trusted-host <host2>]\`
-- First run: \`chown -R 1000:1000 /mnt/user/appdata/deepseek-harness\`
-
-${TOKEN_NOTE}
-
-Image tags are immutable — this release will never be rebuilt or moved. See the [README](https://gitea.milesward.dev/mward4/deepseek-harness#versions-and-upgrades) for the upgrade procedure.
-EOF
-)
+            # Body assembled line-by-line (a heredoc's column-0 lines would
+            # terminate this YAML block scalar).
+            BODY=$(printf '%s\n' \
+              "${KIND}" \
+              "" \
+              '```' \
+              "docker pull gitea.milesward.dev/mward4/deepseek-harness:${TAG}" \
+              '```' \
+              "" \
+              "### What's inside" \
+              "" \
+              "| | |" \
+              "|---|---|" \
+              "| dsh | \`${VER}\` — [upstream release notes](https://github.com/deepseek-ai/deepseek-harness/releases/tag/dsh-v${VER}) |" \
+              "| pnpm | \`${PNPMV:-unknown}\` |" \
+              "| base image | \`${BASEV:-unknown}\` |" \
+              "| image digest | \`${DIGEST}\` |" \
+              "| built from | \`main@${MAIN_SHA}\` (published by CI run #${RUN_NUMBER}) |" \
+              "" \
+              "### Deploy on Unraid" \
+              "" \
+              "- **Repository:** \`gitea.milesward.dev/mward4/deepseek-harness:${TAG}\`" \
+              "- **Post Arguments** (replace the image command entirely): \`web --patch /opt/deepseek-harness/web.cordis.patch.yml --no-open --trusted-host <host> [--trusted-host <host2>]\`" \
+              "- First run: \`chown -R 1000:1000 /mnt/user/appdata/deepseek-harness\`" \
+              "" \
+              "${TOKEN_NOTE}" \
+              "" \
+              "Image tags are immutable — this release will never be rebuilt or moved. See the [README](https://gitea.milesward.dev/mward4/deepseek-harness#versions-and-upgrades) for the upgrade procedure.")
             BODY_JSON=$(printf '%s' "$BODY" | json_escape)
 
             # Tag main at the commit that built the image (ignore "already exists").