fix(ci): correctly extract rollback app/chart versions in promotion PRs

[yodem]

Problem

Auto-generated promotion PRs render the Rollback Reference as app=unknown, chart=unknown — e.g. #3447 and #3461 (preprod → prod, 2026-06-30). The "Current on prod" line should show the versions you'd roll back to.

Root cause

The version extraction used python3 -c "..." double-quoted inside $(...), so bash collapsed the [\"\''] quote class to ["\''] within the program text. Python then raised SyntaxError: closing parenthesis ']' does not match — which 2>&1 swallowed and || ="unknown" turned into unknown. Both app and chart failed identically, hence both showed unknown. Reproduced against the exact prod helmrelease that was live when #3447 was generated.

Fix

• Rewrite extraction with a single-quoted heredoc ('PYEOF') so bash performs no substitution on the regex, passing the YAML through an env var instead of the command line. Verified: now yields app=v6.101.14-prod.3, chart=0.85.12-prod.1 for the Promote to prod — 2026-06-28 07:33 UTC #3447 snapshot, and app=v6.103.0-prod.1, chart=0.86.0-prod.1 for current prod.

Hardening folded in (same file)

• Fetch refs with explicit forced refspecs (refs/heads/<b>:refs/remotes/origin/<b>) so origin/<target> is reliably the true remote tip for both the changelog and the rollback lookup.
• Randomize the GITHUB_OUTPUT heredoc delimiter for ai_summary so a model-generated summary containing a bare EOF line can't inject extra output keys (Actions output injection).
• Resolve the "already exists" PR URL by SOURCE→TARGET pair via gh pr list --base --head --jq '.[0].url // empty' instead of a bare gh pr view that returned the runner's current-branch PR.

Scope

build/ci/generate-promotion-pr.sh only — a focused fix so it can merge ahead of the larger reverse-promotion feature (#3382). The script content is identical to the copy on #3382, so the two converge cleanly (no conflict) whichever merges first.

Testing

• bash -n clean.
• Extraction verified end-to-end against real prod helmrelease snapshots (both the Promote to prod — 2026-06-28 07:33 UTC #3447-era and current).

🤖 Generated with Claude Code

[gitvelocity-reviewer]

📊 Code Quality Score: 3/100

29 × 0.1 (Nano ESF) = 2.9 → 3

Category	Score	Factors
🔭 Scope	4/20	Single CI script file, 4 distinct bug fixes, no new public APIs or subsystems, no cross-team coordination
🏗️ Architecture	3/20	No architectural changes; internal script improvements only; minor pattern change (heredoc vs -c flag)
⚙️ Implementation	8/20	Non-trivial shell scripting: bash quoting analysis, regex debugging, git refspec mechanics, GitHub Actions injection fix; multiple interacting failure modes correctly diagnosed
⚠️ Risk	5/20	CI-only script, easily reversible; fixes reduce existing risk; no production data or auth changes; mktemp temp file is minor concern
✅ Quality	6/15	Excellent inline comments explaining root causes with specific PR references; no automated tests; references failing PR #3447 as evidence
🔒 Perf / Security	3/5	Addresses real GitHub Actions output injection vulnerability (CVE-class issue); uses cryptographic randomness for delimiter; env var isolation for Python subprocess

Was this score accurate? 👍 Yes · 👎 No

_{Scored by GitVelocity · How are scores calculated?}

[gitvelocity-reviewer]

📊 Code Quality Score: 3/100

Base Score 27 × ESF 0.1 = 2.7, rounded to 3

Category	Score	Factors
🔭 Scope	4/20	Single CI shell script, multiple bug fixes within one file, operational impact on deployment pipeline but no cross-subsystem changes
🏗️ Architecture	2/20	No architectural changes; minor implementation pattern change (temp file for Python heredoc); bug fixes only
⚙️ Implementation	8/20	Solid shell scripting: git refspec semantics, bash quoting rules, heredoc behavior, GitHub Actions output format, Python regex consolidation; multiple distinct bug classes addressed cleanly
⚠️ Risk	5/20	CI/CD pipeline script with moderate operational risk; bugs caused silent failures (unknown versions in rollback references); fixes are well-reasoned and easily reversible
✅ Quality	6/15	No tests (typical for CI shell scripts); exceptionally detailed comments explaining root cause of each bug with references to specific affected PRs; good documentation of fix rationale
🔒 Perf / Security	2/5	Randomized heredoc delimiter addresses GitHub Actions output injection security concern; proactive security thinking for CI pipeline

Was this score accurate? 👍 Yes · 👎 No

_{Scored by GitVelocity · How are scores calculated?}