Jenkinsfile.ci

@@ -133,20 +133,26 @@ post {
           def commentsUrl = "${giteaBase}/gitea/api/v1/repos/${owner}/${repo}/issues/${pr}/comments"
 
           withCredentials([usernamePassword(credentialsId: 'jenkins-bot-api',
-                                usernameVariable: 'GITEA_USER',
-                                passwordVariable: 'GITEA_TOKEN')]) {
-          sh """
-            set -e
-            curl -sS -X POST \
-              -H "Authorization: token ${GITEA_TOKEN}" \
-              -H "Content-Type: application/json" \
-              --data @- \
-              '${commentsUrl}' <<'JSON'
-              {"body":"${msg.replace('\\', '\\\\').replace('"','\\"')}"}
-              JSON
-          """
-        }
+                                  usernameVariable: 'GITEA_USER',
+                                  passwordVariable: 'GITEA_TOKEN')]) {
 
+          def body = msg.replace('\\', '\\\\').replace('"','\\"').replace('\n','\\n')
+
+          // Avoid interpolation of secret variables (https://www.jenkins.io/doc/book/pipeline/jenkinsfile/#string-interpolation)
+          withEnv(["GITEA_COMMENTS_URL=${commentsUrl}", "GITEA_BODY=${body}"]) {
+            sh(label: 'Comentar en PR (Gitea)', script: '''
+              set -euo pipefail
+
+              curl -sS -X POST \
+              -H "Authorization: token $GITEA_TOKEN" \
+              -H "Content-Type: application/json" \
+              --data-binary @- \
+                "$GITEA_COMMENTS_URL" <<JSON
+                {"body":"$GITEA_BODY"}
+                JSON
+            ''')
+            }
+        }
         } else {
           echo "No es build de PR (CHANGE_ID vacío); no comento."
         }