fix(git): use env vars for safe commit message handling (#6)

## Summary

Fixed shell expansion issues in `git-commit` workflow by adopting the
GitHub Actions security pattern for handling user-provided content.

## Problem

Commit messages containing special characters were being corrupted:
- ❌ Backticks (`` ` ``) were stripped or executed as command
substitution
- ❌ Dollar signs (`$`) triggered variable expansion
- ❌ Quotes could break shell parsing

Example of broken message:
```
fix: handle `backticks` and $variables
```

Would become:
```
fix: handle  and
```

## Background: Variable Syntax Migration

This fix builds on commit c234599 which migrated all workflow variables
from `${...}` to `{{...}}` syntax:

- **Previous syntax**: `${inputs.commit_message}` (ambiguous with shell
variables)
- **New syntax**: `{{inputs.commit_message}}` (clear separation from
shell)
- **Benefits**: Matches Jinja2 standard, eliminates shell expansion
ambiguity
- **Scope**: Complete migration of 32 template workflows, 25 test
workflows, all docs

However, even with `{{...}}` syntax, the variable content was still
vulnerable to shell expansion when resolved into command strings.

## Root Cause

The `select_message` block passed commit message content directly in
shell command strings with double quotes:

```yaml
command: |
  printf '%s' "{{inputs.commit_message}}" > "$SCRATCH/message.txt"
```

**Execution flow:**
1. Workflow engine resolves `{{inputs.commit_message}}` → `"fix: handle
\`backticks\` here"`
2. String inserted into command: `printf '%s' "fix: handle \`backticks\`
here" > ...`
3. Shell executes backticks as command substitution → content stripped

The `{{...}}` syntax change separated workflow vars from shell vars
syntactically, but didn't prevent shell expansion of the **content**
itself.

## Solution

Adopted the **GitHub Actions security pattern**: Pass sensitive content
via environment variables instead of inline shell substitution.

**Before:**
```yaml
command: |
  if [ -n "{{inputs.commit_message}}" ]; then
    printf '%s' "{{inputs.commit_message}}" > "$SCRATCH/message.txt"
  else
    printf '%s' "{{blocks.llm_generate_message.outputs.response}}" > "$SCRATCH/message.txt"
  fi
```

**After:**
```yaml
env:
  MANUAL_MESSAGE: "{{inputs.commit_message}}"
  LLM_MESSAGE: "{{blocks.llm_generate_message.outputs.response}}"
command: |
  # Use environment variables to safely pass content (GitHub Actions pattern)
  # This prevents shell expansion of special chars (backticks, $, quotes)
  if [ -n "$MANUAL_MESSAGE" ]; then
    printf '%s' "$MANUAL_MESSAGE" > "$SCRATCH/message.txt"
  else
    printf '%s' "$LLM_MESSAGE" > "$SCRATCH/message.txt"
  fi
```

## How It Works

1. **Workflow engine** resolves `{{...}}` variables at YAML level (from
commit c234599)
2. **Python** sets environment variables through the OS (no shell
interpretation)
3. **Shell** reads `$VAR` from environment safely without expanding
content

This completes the security model:
- ✅ **Syntax level**: `{{...}}` (workflow) vs `${...}` (shell) - clear
separation
- ✅ **Content level**: Environment variables prevent shell expansion of
user content

## How Industry Standards Handle This

**GitHub Actions:**
```yaml
# UNSAFE: Content in command string
run: echo "${{ github.event.issue.title }}"

# SAFE: Content via environment variable
env:
  TITLE: ${{ github.event.issue.title }}
run: echo "$TITLE"
```

**GitLab CI:** Uses same pattern with `variables:` block

**Argo Workflows:** Uses `env:` fields for parameter passing

This is the industry-standard security practice for CI/CD systems.

## Testing

Tested with commit message containing all special characters:
```
fix(git): use env vars for safe message handling

Changed `select_message` block with `backticks`, $variables, and user's quotes.
Pattern: set `$MESSAGE` via env, read $VAR safely.
```

**Result**: All special characters preserved correctly in the final
commit! ✅

Both commits in this PR were created using the fixed workflow,
demonstrating it works correctly.

## Changes

- Modified `src/workflows_mcp/templates/git/git-commit.yaml`:
- Added `env` field to `select_message` block with `MANUAL_MESSAGE` and
`LLM_MESSAGE`
  - Moved message content from command string to environment variables
- Updated shell command to reference `$MANUAL_MESSAGE` and
`$LLM_MESSAGE` instead of inline substitution
  - Added comments explaining the GitHub Actions security pattern

## Benefits

- ✅ Prevents shell expansion of backticks, dollar signs, and quotes
- ✅ Matches industry-standard CI/CD security practices (GitHub Actions,
GitLab CI)
- ✅ Uses existing Shell executor capabilities (no new executors needed)
- ✅ Maintains the file-based commit approach (`git commit -F`)
- ✅ Completes the security model started by commit c234599

## References

- Variable syntax migration: commit c234599
- GitHub Actions Security: [Preventing script injection
attacks](https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-an-intermediate-environment-variable)
- Shell executor env support:
`src/workflows_mcp/engine/executors_core.py` lines 276-279

Author: ibacalu

README.md

@@ -133,10 +133,10 @@ blocks:
   - id: greet
     type: Shell
     inputs:
-      command: printf "Hello, ${inputs.name}!"
+      command: printf "Hello, {{inputs.name}}!"
 
 outputs:
-  greeting: "${blocks.greet.outputs.stdout}"
+  greeting: "{{blocks.greet.outputs.stdout}}"
 ```
 
 ### Key Features
@@ -147,9 +147,9 @@ Reference inputs, block outputs, and metadata anywhere in your workflow.
 
 Examples:
 
-- [Using workflow inputs](tests/workflows/core/variable-resolution/inputs.yaml) - `${inputs.field_name}`
-- [Using block outputs](tests/workflows/core/variable-resolution/block-outputs.yaml) - `${blocks.block_id.outputs.field}`
-- [Using metadata](tests/workflows/core/variable-resolution/metadata.yaml) - `${metadata.workflow_name}`
+- [Using workflow inputs](tests/workflows/core/variable-resolution/inputs.yaml) - `{{inputs.field_name}}`
+- [Using block outputs](tests/workflows/core/variable-resolution/block-outputs.yaml) - `{{blocks.block_id.outputs.field}}`
+- [Using metadata](tests/workflows/core/variable-resolution/metadata.yaml) - `{{metadata.workflow_name}}`
 - [Variable shortcuts](tests/workflows/core/variable-resolution/shortcuts.yaml) - convenient shorthand syntax
 
 **Conditionals:**
@@ -167,9 +167,9 @@ Use simple shortcuts to check if blocks succeeded, failed, or were skipped.
 
 Examples:
 
-- [Success detection](tests/workflows/core/block-status/success-detection.yaml) - `${blocks.id.succeeded}`
-- [Failure detection](tests/workflows/core/block-status/failure-detection.yaml) - `${blocks.id.failed}`
-- [Skip detection](tests/workflows/core/block-status/skip-detection.yaml) - `${blocks.id.skipped}`
+- [Success detection](tests/workflows/core/block-status/success-detection.yaml) - `{{blocks.id.succeeded}}`
+- [Failure detection](tests/workflows/core/block-status/failure-detection.yaml) - `{{blocks.id.failed}}`
+- [Skip detection](tests/workflows/core/block-status/skip-detection.yaml) - `{{blocks.id.skipped}}`
 
 **Parallel Execution:**
 

schema.json

@@ -650,7 +650,7 @@
     },
     "WorkflowInput": {
       "additionalProperties": false,
-      "description": "Input model for Workflow executor.\n\nSupports variable references from parent context:\n- ${inputs.field}: Parent workflow inputs\n- ${blocks.block_id.outputs.field}: Parent block outputs\n- ${metadata.field}: Parent workflow metadata\n\nVariable resolution happens in parent context before passing to child.",
+      "description": "Input model for Workflow executor.\n\nSupports variable references from parent context:\n- {{inputs.field}}: Parent workflow inputs\n- {{blocks.block_id.outputs.field}}: Parent block outputs\n- {{metadata.field}}: Parent workflow metadata\n\nVariable resolution happens in parent context before passing to child.",
       "properties": {
         "workflow": {
           "description": "Workflow name to execute",

src/workflows_mcp/engine/executors_interactive.py

@@ -85,7 +85,7 @@ class PromptExecutor(BlockExecutor):
           type: Shell
           inputs:
             command: "./deploy.sh"
-          condition: ${blocks.confirm_deploy.outputs.response} == 'yes'
+          condition: "{{blocks.confirm_deploy.outputs.response}} == 'yes'"
           depends_on: [confirm_deploy]
 
     Example YAML - Multiple Choice:
@@ -106,7 +106,7 @@ class PromptExecutor(BlockExecutor):
           type: Shell
           inputs:
             command: "./deploy.sh dev"
-          condition: ${blocks.select_env.outputs.response} == '1'
+          condition: "{{blocks.select_env.outputs.response}} == '1'"
           depends_on: [select_env]
 
     Example YAML - Free-form Input:
@@ -124,7 +124,7 @@ class PromptExecutor(BlockExecutor):
         - id: create_commit
           type: Shell
           inputs:
-            command: git commit -m "${blocks.get_commit_msg.outputs.response}"
+            command: git commit -m "{{blocks.get_commit_msg.outputs.response}}"
           depends_on: [get_commit_msg]
 
     Benefits of Simplified Design:

src/workflows_mcp/engine/executors_workflow.py

@@ -24,9 +24,9 @@ class WorkflowInput(BlockInput):
     Input model for Workflow executor.
 
     Supports variable references from parent context:
-    - ${inputs.field}: Parent workflow inputs
-    - ${blocks.block_id.outputs.field}: Parent block outputs
-    - ${metadata.field}: Parent workflow metadata
+    - {{inputs.field}}: Parent workflow inputs
+    - {{blocks.block_id.outputs.field}}: Parent block outputs
+    - {{metadata.field}}: Parent workflow metadata
 
     Variable resolution happens in parent context before passing to child.
     """
@@ -53,7 +53,7 @@ class WorkflowExecutor(BlockExecutor):
     Architecture:
     - Returns full child Execution (includes child's blocks!)
     - Orchestrator stores child Execution in parent.blocks[block_id]
-    - Enables deep access: ${blocks.run_tests.blocks.pytest.outputs.exit_code}
+    - Enables deep access: {{blocks.run_tests.blocks.pytest.outputs.exit_code}}
     - Uses ExecutionContext for workflow registry access
     - Uses WorkflowRunner for child workflow execution
     - Recursion depth limiting via context.check_recursion_depth()
@@ -72,8 +72,8 @@ class WorkflowExecutor(BlockExecutor):
         }
 
     Variable Access:
-        ${blocks.run_tests.outputs.test_passed}  # Child's workflow output
-        ${blocks.run_tests.blocks.pytest.outputs.exit_code}  # Drill down!
+        {{blocks.run_tests.outputs.test_passed}}  # Child's workflow output
+        {{blocks.run_tests.blocks.pytest.outputs.exit_code}}  # Drill down!
 
     Pause Propagation:
         If child workflow pauses (Prompt block), ExecutionPaused exception
@@ -86,7 +86,7 @@ class WorkflowExecutor(BlockExecutor):
             inputs:
               workflow: python-ci-pipeline
               inputs:
-                project_path: "${inputs.project_path}"
+                project_path: "{{inputs.project_path}}"
     """
 
     type_name: ClassVar[str] = "Workflow"

src/workflows_mcp/engine/schema.py

@@ -13,7 +13,7 @@
 - Required fields and types
 - Block type existence in registry
 - Dependency validity (no cycles, valid references)
-- Variable substitution syntax (${block_id.field})
+- Variable substitution syntax ({{block_id.field}})
 """
 
 import re
@@ -40,7 +40,7 @@ class ValueType(str, Enum):
     - Output parsing logic
 
     These match Python's built-in types for consistency with:
-    - isinstance() checks in conditions: isinstance(${inputs.name}, str)
+    - isinstance() checks in conditions: isinstance({{inputs.name}}, str)
     - Type annotations in executor models: Field(default="", description="...")
     - Variable resolution return types
 
@@ -293,14 +293,14 @@ class BlockDefinition(BaseModel):
             type: CreateWorktree
             description: "Create isolated git worktree for feature development"
             inputs:
-              branch: "feature/${issue_number}"
+              branch: "feature/{{issue_number}}"
               base_branch: "main"
 
           - id: create_file
             type: CreateFile
             description: "Create initial README file in worktree"
             inputs:
-              path: "${create_worktree.worktree_path}/README.md"
+              path: "{{create_worktree.worktree_path}}/README.md"
               content: "# Feature"
             depends_on:
               - create_worktree
@@ -321,7 +321,7 @@ class BlockDefinition(BaseModel):
             description: "Deploy to production if tests pass"
             inputs:
               command: "echo 'Deploying...'"
-            condition: "${run_tests.exit_code} == 0"
+            condition: "{{run_tests.exit_code}} == 0"
             depends_on:
               - run_tests
     """
@@ -407,18 +407,18 @@ class WorkflowOutputSchema(BaseModel):
     expressions that reference block outputs.
 
     Attributes:
-        value: Expression (e.g., "${block.outputs.field}" or "${block.exit_code}")
+        value: Expression (e.g., "{{block.outputs.field}}" or "{{block.exit_code}}")
         type: Output type (str, int, float, bool, json)
         description: Optional human-readable output description
 
     Example:
         outputs:
           test_results:
-            value: "${run_tests.outputs.test_results}"
+            value: "{{run_tests.outputs.test_results}}"
             type: json
             description: "Test execution results"
           success:
-            value: "${run_tests.exit_code}"
+            value: "{{run_tests.exit_code}}"
             type: int
             description: "Test exit code"
     """
@@ -466,17 +466,17 @@ class WorkflowSchema(BaseModel):
           - id: block1
             type: Shell
             inputs:
-              command: 'printf "Hello ${input_name}"'
+              command: 'printf "Hello {{input_name}}"'
 
           - id: block2
             type: Shell
             inputs:
-              command: 'printf "Output: ${blocks.block1.outputs.stdout}"'
+              command: 'printf "Output: {{blocks.block1.outputs.stdout}}"'
             depends_on:
               - block1
 
         outputs:
-          final_message: "${blocks.block2.outputs.stdout}"
+          final_message: "{{blocks.block2.outputs.stdout}}"
     """
 
     # Metadata fields (flattened for YAML convenience)
@@ -602,8 +602,8 @@ def validate_no_cyclic_dependencies(self) -> "WorkflowSchema":
     @model_validator(mode="after")
     def validate_variable_substitution_syntax(self) -> "WorkflowSchema":
         """Validate variable substitution syntax in all string values."""
-        # Pattern: ${namespace.path.to.field} - captures full dotted path
-        var_pattern = re.compile(r"\$\{([a-z_][a-z0-9_.]*)\}")
+        # Pattern: {{namespace.path.to.field}} - captures full dotted path
+        var_pattern = re.compile(r"\{\{([a-z_][a-z0-9_.]*)\}\}")
 
         block_ids = {block.id for block in self.blocks}
         input_names = set(self.inputs.keys())
@@ -614,38 +614,38 @@ def validate_string_value(value: str, context: str) -> None:
             for var_path in matches:
                 parts = var_path.split(".")
 
-                # ${inputs.field} - workflow input
+                # {{inputs.field}} - workflow input
                 if parts[0] == "inputs":
                     if len(parts) < 2:
                         raise ValueError(
-                            f"{context}: Invalid variable reference '${{{var_path}}}'. "
-                            f"Input reference must include field name: ${{inputs.field_name}}"
+                            f"{context}: Invalid variable reference '{{{{{var_path}}}}}'. "
+                            f"Input reference must include field name: {{{{inputs.field_name}}}}"
                         )
                     field_name = parts[1]
                     if field_name not in input_names:
                         raise ValueError(
-                            f"{context}: Invalid variable reference '${{{var_path}}}'. "
+                            f"{context}: Invalid variable reference '{{{{{var_path}}}}}'. "
                             f"Input '{field_name}' does not exist. "
                             f"Available inputs: {sorted(input_names)}"
                         )
 
-                # ${blocks.block_id.namespace.field} - block outputs/metadata
-                # Also supports shortcut: ${blocks.block_id.field} -> outputs.field
+                # {{blocks.block_id.namespace.field}} - block outputs/metadata
+                # Also supports shortcut: {{blocks.block_id.field}} -> outputs.field
                 elif parts[0] == "blocks":
                     if len(parts) < 3:
                         raise ValueError(
-                            f"{context}: Invalid variable reference '${{{var_path}}}'. "
+                            f"{context}: Invalid variable reference '{{{{{var_path}}}}}'. "
                             f"Block reference must be: "
-                            f"${{blocks.block_id.outputs.field}}, "
-                            f"${{blocks.block_id.metadata.field}}, or "
-                            f"${{blocks.block_id.field}} (shortcut for outputs)"
+                            f"{{{{blocks.block_id.outputs.field}}}}, "
+                            f"{{{{blocks.block_id.metadata.field}}}}, or "
+                            f"{{{{blocks.block_id.field}}}} (shortcut for outputs)"
                         )
                     block_id = parts[1]
 
                     # Check if block exists
                     if block_id not in block_ids:
                         raise ValueError(
-                            f"{context}: Invalid variable reference '${{{var_path}}}'. "
+                            f"{context}: Invalid variable reference '{{{{{var_path}}}}}'. "
                             f"Block '{block_id}' does not exist. "
                             f"Available blocks: {sorted(block_ids)}"
                         )
@@ -654,18 +654,18 @@ def validate_string_value(value: str, context: str) -> None:
                     # - Standard namespaces: outputs, metadata, inputs
                     # - Custom output fields: any valid identifier
                     # Both are valid, so no validation needed beyond block existence
-                    # If 3 parts, it's shortcut form ${blocks.block_id.field}
+                    # If 3 parts, it's shortcut form {{blocks.block_id.field}}
                     # This is valid and will be auto-expanded to outputs.field
 
-                # ${metadata.field} - workflow metadata
+                # {{metadata.field}} - workflow metadata
                 elif parts[0] == "metadata":
                     # Metadata references are valid (read-only workflow metadata)
                     pass
 
                 # Unknown namespace
                 else:
                     raise ValueError(
-                        f"{context}: Invalid variable reference '${{{var_path}}}'. "
+                        f"{context}: Invalid variable reference '{{{{{var_path}}}}}'. "
                         f"Unknown namespace '{parts[0]}'. "
                         f"Valid namespaces: 'inputs', 'blocks', 'metadata'"
                     )