From 38c0a516603b7c764f661ec2f976de4895f05ab6 Mon Sep 17 00:00:00 2001
From: mmosarafO2 <mosraf@openobserve.ai>
Date: Mon, 26 Jan 2026 14:16:55 +0530
Subject: [PATCH] ci: fix github workflow vulnerability

---
 .github/workflows/log-issues-to-o2.yml | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/log-issues-to-o2.yml b/.github/workflows/log-issues-to-o2.yml
index 456ec8a107..1fcdf67975 100644
--- a/.github/workflows/log-issues-to-o2.yml
+++ b/.github/workflows/log-issues-to-o2.yml
@@ -18,11 +18,7 @@ jobs:
           ISSUE_BODY: ${{ github.event.issue.body }}
           COMMENT_BODY: ${{ github.event.comment.body }}
         run: |
-          # Process the body content safely (already in env vars)
-          ISSUE_BODY_PROCESSED=$(printf '%s' "$ISSUE_BODY" | tr '\n' ' ' | sed 's/"/\\"/g')
-          COMMENT_BODY_PROCESSED=$(printf '%s' "$COMMENT_BODY" | tr '\n' ' ' | sed 's/"/\\"/g')
-          
-          # Build payload using jq to properly handle JSON
+          # Build payload using jq to properly handle JSON (jq --arg handles all escaping safely)
           jq -n \
             --arg event_name "${{ github.event_name }}" \
             --arg action "${{ github.event.action }}" \
@@ -75,7 +71,7 @@ jobs:
             --arg issue_updated_at "${{ github.event.issue.updated_at }}" \
             --arg issue_closed_at "${{ github.event.issue.closed_at }}" \
             --arg issue_author_association "${{ github.event.issue.author_association }}" \
-            --arg issue_body "$ISSUE_BODY_PROCESSED" \
+            --arg issue_body "$ISSUE_BODY" \
             --arg comment_id "${{ github.event.comment.id }}" \
             --arg comment_node_id "${{ github.event.comment.node_id }}" \
             --arg comment_user_login "${{ github.event.comment.user.login }}" \
@@ -86,7 +82,7 @@ jobs:
             --arg comment_created_at "${{ github.event.comment.created_at }}" \
             --arg comment_updated_at "${{ github.event.comment.updated_at }}" \
             --arg comment_author_association "${{ github.event.comment.author_association }}" \
-            --arg comment_body "$COMMENT_BODY_PROCESSED" \
+            --arg comment_body "$COMMENT_BODY" \
             --arg sender_login "${{ github.event.sender.login }}" \
             --arg sender_id "${{ github.event.sender.id }}" \
             --arg sender_node_id "${{ github.event.sender.node_id }}" \