From f1bd0e47a9dea4e5494a348fecd36970f6bf6407 Mon Sep 17 00:00:00 2001
From: Jim Martens <github@2martens.de>
Date: Sun, 3 Aug 2025 00:36:36 +0200
Subject: [PATCH] fix: Prevent garbage connection string

---
 .github/workflows/deploy.yaml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/deploy.yaml b/.github/workflows/deploy.yaml
index 2d19901..c7e56ab 100644
--- a/.github/workflows/deploy.yaml
+++ b/.github/workflows/deploy.yaml
@@ -57,7 +57,8 @@ jobs:
         env:
           WAHLRECHT_MONGODB_CONNECTION_STRING: ${{ secrets.WAHLRECHT_MONGODB_CONNECTION_STRING }}
         run: |
-          sed -i "s|<wahlrecht_mongodb_connection_string>|$WAHLRECHT_MONGODB_CONNECTION_STRING|g" docker/${{ matrix.env }}/stack-config/wahlrecht.yaml
+          ESCAPED=$(printf '%s' "$WAHLRECHT_MONGODB_CONNECTION_STRING" | sed 's/&/\\&/g')
+          sed -i "s|<wahlrecht_mongodb_connection_string>|$ESCAPED|g" docker/${{ matrix.env }}/stack-config/wahlrecht.yaml
       - name: Copy files to remote
         if: steps.check.outputs.should_deploy == 'true'
         uses: burnett01/rsync-deployments@7.0.2