Release notes are published with literal `%0A` escapes; `actions/create-release` is archived

[sequoiap]

.github/workflows/release.yml:31-38:

- name: Load Release text
  id: get_text
  run: |
    BODY=$(cat ./docs/changelog/${{ env.VERSION }}-changelog.md)
    BODY="${BODY//'%'/'%25'}"
    BODY="${BODY//$'\n'/'%0A'}"
    BODY="${BODY//$'\r'/'%0D'}"
    echo "BODY=$BODY" >> $GITHUB_OUTPUT

The percent-encoding is the workaround for the old ::set-output command, which could not carry newlines. $GITHUB_OUTPUT does not decode it -- it supports real multiline values via a delimiter instead. So every release body is written as one line with literal %0A between what should be separate lines.

Fix -- use a heredoc delimiter and drop the escaping:

run: |
  {
    echo "BODY<<PYROLAB_EOF"
    cat ./docs/changelog/${{ env.VERSION }}-changelog.md
    echo "PYROLAB_EOF"
  } >> "$GITHUB_OUTPUT"

Two further points in the same workflow:

• actions/create-release@v1 (line 46) is archived and unmaintained. Replace with softprops/action-gh-release or a gh release create step.
• ${{ env.BODY }} on line 52 reads the wrong reference. The body was written to $GITHUB_OUTPUT under id: get_text, so it should be ${{ steps.get_text.outputs.BODY }}. env.BODY is never set -- only env.VERSION is (line 30). This means the release body is likely empty today, independent of the escaping bug. Worth checking the last release to confirm.
• Consider PyPI Trusted Publishing instead of the long-lived PYPI_PASSWORD token, and bump pypa/gh-action-pypi-publish from v1.5.0.

---

Found in a full-codebase audit at v0.4.0 (commit 1ce3146).