Description

Use quoted heredoc to safely write bake metadata to file before processing with jq. This prevents bash history expansion issues when metadata contains special characters like ! which can cause No such file or directory errors.

Problem

The original code:

echo '${{ steps.bake.outputs.metadata }}' | jq -r '...'

Even with single quotes, bash history expansion (!) is processed before quote parsing in some shell configurations. If the Docker build provenance metadata contained strings like !--..., bash would try to expand it as "last command starting with --".

Solution

Use a quoted heredoc (<<'DELIMITER') to write the metadata to a file first:

cat <<'METADATA_EOF' > $METADATA_FILE
${{ steps.bake.outputs.metadata }}
METADATA_EOF
cat $METADATA_FILE | jq -r '...'

The single quotes around the heredoc delimiter tell bash to treat the content as 100% literal - no variable expansion, no command substitution, no history expansion.

Related

Fixes flaky CI failures observed in ethereum-optimism/optimism#18488