fix(github-workflows): replace --body-file temp files with inline heredoc (#233)

* fix(github-workflows): replace --body-file temp files with inline heredoc

Skill instructions were directing agents to write PR bodies to temp files
(mktemp + Write tool + --body-file + rm) before passing them to gh commands.
Replace with the --body "$(cat <<'EOF' ... EOF)" pattern, which eliminates
the temp file lifecycle entirely. Add cspell word 'oneline' to fix a
pre-existing spell check failure on the git log --oneline command.

(claude)

* fix(finalize-pr): apply --title alongside --body in Phase 4.3

Phase 4.1 generates an updated title but Phase 4.3 was only applying
the body. Add --title to the gh pr edit command so both updates land.

(claude)

Author: JacobPEvans

cspell.json

@@ -22,6 +22,7 @@
     "mvexpand",
     "mvfilter",
     "nullglob",
+    "oneline",
     "pids",
     "recognises",
     "reinvocation",

github-workflows/skills/finalize-pr/SKILL.md

@@ -177,8 +177,16 @@ Steps 4.1 and 4.2 run sequentially within the agent. Step 4.3 runs after both.
 
 ### 4.3 Apply Updates
 
-After 4.1 and 4.2 complete, write the body to a temp file and apply with `gh pr edit --body-file`
-(safer than inline for multiline content).
+After 4.1 and 4.2 complete, apply title and body together — no temp files:
+
+```bash
+gh pr edit {number} --title "generated title" --body "$(cat <<'EOF'
+... generated body ...
+EOF
+)"
+```
+
+Single-quoted `'EOF'` prevents shell expansion. Closing `EOF` must be alone on its own line with no leading whitespace.
 
 Proceed to Phase 5.
 

github-workflows/skills/squash-merge-pr/SKILL.md

@@ -48,16 +48,12 @@ Generate:
 
 Types: `feat`, `fix`, `refactor`, `docs`, `test`, `chore`
 
-Store the title in a shell variable and write the body to a temp file using the Write tool
-(avoids shell quoting issues with multi-line text):
+Store the title in a shell variable:
 
 ```bash
 SQUASH_TITLE="<generated title>"
-SQUASH_BODY_FILE=$(mktemp)
 ```
 
-Use the Write tool to write the generated body text to the path stored in `$SQUASH_BODY_FILE`.
-
 ## Step 3: Execute Squash Merge
 
 Capture the branch name before merging (needed for cleanup):
@@ -66,13 +62,18 @@ Capture the branch name before merging (needed for cleanup):
 BRANCH=$(gh pr view {pr} --json headRefName --jq '.headRefName')
 ```
 
-Merge without `--delete-branch` (avoids `git switch` failure in bare+worktree repos):
+Merge without `--delete-branch` (avoids `git switch` failure in bare+worktree repos).
+Use a heredoc for the body — no temp files:
 
 ```bash
-gh pr merge {pr} --squash --subject "$SQUASH_TITLE" --body-file "$SQUASH_BODY_FILE"
-rm -f "$SQUASH_BODY_FILE"
+gh pr merge {pr} --squash --subject "$SQUASH_TITLE" --body "$(cat <<'EOF'
+... generated body ...
+EOF
+)"
 ```
 
+Single-quoted `'EOF'` prevents shell expansion. Closing `EOF` must be alone on its own line with no leading whitespace.
+
 Delete the remote branch (GitHub may have auto-deleted it on merge — `|| true` handles that):
 
 ```bash

tests/content-guards/enforce-issue-limits/enforce-issue-limits.bats

@@ -163,12 +163,12 @@ run_hook() {
   [ "$status" -eq 0 ]
 }
 
-@test "TC7b: gh pr edit with --body-file is always allowed" {
+@test "TC7b: gh pr edit with --body is always allowed" {
   local now
   now="$(utc_now)"
   export GH_RESPONSE="$(build_json_array '{"createdAt":"'"$now"'"}' 25)"
 
-  run_hook '{"tool_input":{"command":"gh pr edit 126 --body-file /tmp/pr-body.md"}}'
+  run_hook '{"tool_input":{"command":"gh pr edit 126 --body \"updated description\""}}'
   [ "$status" -eq 0 ]
 }