yossarian on Nostr: just had an interesting realization: one of the reasons people struggle to understand ...

just had an interesting realization: one of the reasons people struggle to understand template injection in GHA is probably because lines like this:

```
echo "hello: ${{ expr }}"
```

...get lexed mentally as "variable expansion, followed by Jinja template."

in other words, people think the `$` comes from the shell and the `{{ }}` is the template syntax, and therefore the entire thing is quoted correctly.

in reality of course the entire `${{ .. }}` is template syntax, and has nothing to do with shell quoting/expansion rules. but `$` is mentally overloaded!

i wonder how much easier this would be to teach people if GitHub had chosen `@{{ ... }}` or even just `{{ }}` as their template syntax instead.

#security #opensource