From 058b66de3d69d126aee3693a92955f9451b14b6f Mon Sep 17 00:00:00 2001
From: "@nieprzecietny_kowalski" <kowalski@nieprzecietny.pl>
Date: Wed, 20 May 2026 13:49:56 +0200
Subject: [PATCH] Fix bump-deps workflow YAML parser error

PR #37's squash merge landed an earlier draft of this workflow. The
inline ${{ inputs.allowed-licenses || ''MIT,Apache-2.0'' }} expression
inside a multi-line PowerShell run: block fails GitHub Actions YAML
parsing with:

  (Line: 39, Col: 14): Unexpected symbol: '0'''. Located at position 43
  within expression: inputs.allowed-licenses || ''MIT,Apache-2.0''

Fix:
  - Hoist defaults to job-level env: so PowerShell reads plain $env:VAR
    without any ${{ }} interpolation inside the script body.
  - Use github.event.inputs.* (defined for workflow_dispatch, null on
    cron) so the || fallback works.
  - Switch the Verify build / Create pull request guards to env.DRY_RUN.
  - Rename $args -> $scriptArgs (PowerShell auto-variable collision).
---
 .github/workflows/bump-deps.yml | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/bump-deps.yml b/.github/workflows/bump-deps.yml
index 4d3fcfa..c442c7e 100644
--- a/.github/workflows/bump-deps.yml
+++ b/.github/workflows/bump-deps.yml
@@ -22,6 +22,9 @@ permissions:
 jobs:
   bump:
     runs-on: ubuntu-latest
+    env:
+      ALLOWED_LICENSES: ${{ github.event.inputs.allowed-licenses || 'MIT,Apache-2.0' }}
+      DRY_RUN: ${{ github.event.inputs.dry-run || 'false' }}
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -37,23 +40,23 @@ jobs:
         id: bump
         shell: pwsh
         run: |
-          $licenses = '${{ inputs.allowed-licenses || ''MIT,Apache-2.0'' }}' -split ','
-          $dryRun = '${{ inputs.dry-run }}' -eq 'true'
-          $args = @{
+          $licenses = $env:ALLOWED_LICENSES -split ','
+          $dryRun = $env:DRY_RUN -eq 'true'
+          $scriptArgs = @{
             AllowedLicenses = $licenses
             GithubOutput    = $true
           }
-          if ($dryRun) { $args.DryRun = $true }
-          ./scripts/Bump-Deps.ps1 @args
+          if ($dryRun) { $scriptArgs.DryRun = $true }
+          ./scripts/Bump-Deps.ps1 @scriptArgs
 
       - name: Verify build
-        if: steps.bump.outputs.bumped == 'true' && inputs.dry-run != 'true'
+        if: steps.bump.outputs.bumped == 'true' && env.DRY_RUN != 'true'
         run: |
           dotnet restore TailoredApps.Shared.sln
           dotnet build TailoredApps.Shared.sln --no-restore --nologo
 
       - name: Create pull request
-        if: steps.bump.outputs.bumped == 'true' && inputs.dry-run != 'true'
+        if: steps.bump.outputs.bumped == 'true' && env.DRY_RUN != 'true'
         uses: peter-evans/create-pull-request@v7
         with:
           commit-message: 'chore(deps): automated dependency bump'
@@ -61,7 +64,7 @@ jobs:
           body: |
             Automated bump produced by `.github/workflows/bump-deps.yml`.
 
-            Allowed licenses: `${{ inputs.allowed-licenses || 'MIT,Apache-2.0' }}`
+            Allowed licenses: `${{ env.ALLOWED_LICENSES }}`
 
             ### Bumps and skips
             See workflow run log for the full BUMP/SKIP report.