fix: feed curl auth config on stdin (no process substitution on Git Bash)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

catalogue-publish/publish-to-catalogue.sh

@@ -150,12 +150,13 @@ fi
 
 [ -n "${CATALOGUE_PUBLISH_KEY:-}" ] || die "CATALOGUE_PUBLISH_KEY is not set"
 
-# Pass the bearer header through a curl config read from a process
+# Pass the bearer header through a curl config on stdin (-K -), so the key never
-# substitution, so the key never lands in argv or the shell trace.
+# lands in argv or the shell trace. (Not process substitution: native Windows
+# curl under Git Bash cannot open /dev/fd paths.)
 BODY_FILE="$(mktemp)"
 trap 'rm -f "$BODY_FILE"' EXIT
-HTTP_CODE="$(curl -sS -o "$BODY_FILE" -w '%{http_code}' -X POST \
+HTTP_CODE="$(printf 'header = "Authorization: Bearer %s"\n' "$CATALOGUE_PUBLISH_KEY" |
-  -K <(printf 'header = "Authorization: Bearer %s"\n' "$CATALOGUE_PUBLISH_KEY") \
+  curl -sS -o "$BODY_FILE" -w '%{http_code}' -X POST -K - \
   "${FIELDS[@]}" "$URL")" || die "request to $URL failed"
 
 BODY="$(cat "$BODY_FILE")"

catalogue-publish/test.sh

@@ -20,4 +20,24 @@ OUT="$(GITHUB_ACTION_PATH="$HERE" INPUT_APP=silvermail INPUT_FILE="$TMP/App-1.0.
 for n in Platform=Windows Format=Nupkg VersionCode=1000000 AppSlug=silvermail; do
   printf '%s' "$OUT" | grep -qF -- "$n" && ok "dry-run has $n" || bad "dry-run missing $n"; done
 printf '%s' "$OUT" | grep -qF -- "$SECRET" && bad "key leaked" || ok "key not printed"
+
+# -K must not use process substitution (breaks native curl under Git Bash).
+grep -nE -- '-K[[:space:]]+<\(' "$HERE/publish-to-catalogue.sh" >/dev/null && bad "uses -K <(...)" || ok "no process substitution for -K"
+
+# Fake curl: header must arrive on stdin, never in argv.
+mkdir "$TMP/bin"
+cat > "$TMP/bin/curl" <<'F'
+#!/usr/bin/env bash
+out=""; k=""
+while [ $# -gt 0 ]; do case "$1" in -o) out="$2"; shift 2;; -K) k="$2"; shift 2;; *) printf '%s
+' "$1" >> "$FAKE_ARGS"; shift;; esac; done
+printf '%s' "$k" > "$FAKE_K"
+cat > "$FAKE_STDIN"
+echo '{}' > "$out"; printf 201
+F
+export FAKE_ARGS="$TMP/args" FAKE_K="$TMP/k" FAKE_STDIN="$TMP/stdin"; : > "$FAKE_ARGS"
+PATH="$TMP/bin:$PATH" CATALOGUE_PUBLISH_KEY="$SECRET" bash "$HERE/publish-to-catalogue.sh"   --slug a --platform windows --arch x64 --format nupkg --version 1.0.0 --version-code 1 --channel beta "$TMP/App-1.0.0.nupkg" >/dev/null 2>&1   && ok "fake-curl publish exit 0" || bad "fake-curl publish failed"
+[ "$(cat "$TMP/k")" = "-" ] && ok "-K -" || bad "-K arg is '$(cat "$TMP/k")'"
+grep -qF "Authorization: Bearer $SECRET" "$TMP/stdin" && ok "header on stdin" || bad "header not on stdin"
+grep -qF "$SECRET" "$TMP/args" && bad "key in argv" || ok "key not in argv"
 exit $FAILS