[AUH] [PATCH 1/2] git: use temp file for commit message to avoid shell escaping issues

From: Daniel Turull <[email protected]>

Passing the commit message via -m "..." interpolates it directly into
a shell command, causing a syntax error when the message contains special
characters such as backticks, double quotes, or shell metacharacters.

Use a temporary file with -F instead, which bypasses shell interpretation
entirely.

AI-Generated: kiro with claude-opus-4.6 model
Signed-off-by: Daniel Turull <[email protected]>
---
 modules/utils/git.py | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/modules/utils/git.py b/modules/utils/git.py
index b383049..b732cdb 100644
--- a/modules/utils/git.py
+++ b/modules/utils/git.py
@@ -54,10 +54,17 @@ class Git(object):
         return self._cmd("add " + src)
 
     def commit(self, commit_message, author=None):
-        if author is None:
-            return self._cmd("commit -a -s -m \"" + commit_message + "\"")
-        else:
-            return self._cmd("commit -a --author=\"" + author + "\" -m \"" + commit_message + "\"")
+        import tempfile
+        with tempfile.NamedTemporaryFile(mode='w', suffix='.txt', delete=False) as f:
+            f.write(commit_message)
+            tmp = f.name
+        try:
+            if author is None:
+                return self._cmd("commit -a -s -F " + tmp)
+            else:
+                return self._cmd("commit -a --author=\"" + author + "\" -F " + tmp)
+        finally:
+            os.unlink(tmp)
 
     def revert(self, commit):
         return self._cmd("revert --no-edit " + commit)