[abhalsod-sonata]

Description

Hardening fixes for .github/workflows/update-geolite-database.yml. The October scheduled run (36809399679) failed, and the rerun exposed these issues:

• Rerun collision: the generated branch name only used github.run_id, which stays the same across reruns. Attempt 2 failed with ! [rejected] ... (fetch first) because attempt 1 had already pushed that branch. The branch name now also includes github.run_attempt.
• Step summary: the no-change message was written to '$GITHUB_STEP_SUMMARY' (single-quoted), which creates a file with that literal name instead of writing to the job summary. Now uses "${GITHUB_STEP_SUMMARY}".
• PR body: the backticks around ${{ github.workflow }} were inside a double-quoted string, so bash tried to run Update GeoLite Database as a command and the name was dropped from the PR body. The backticks are now escaped.
• Job summary check: [[ -z '$PR_URL' ]] tested a literal string and was never true. Now quotes the variable so an empty URL is detected.

This PR does not fix the original failure (GraphQL: must be a collaborator (createPullRequest)). That comes from the GH_PAT_WITH_ORG personal access token, whose owner account was deactivated. The fix is in #508, which switches the workflow to a GitHub App token. SRE is creating the App and adding its secrets directly to this repo (DOS-7368).

Impacted roles: Developer / Operator (CI only, no runtime change).

Supporting information

• Jira (private): LP-1331, DOS-7368
• Failing run: https://github.com/edx/edx-platform/actions/runs/36809399679
• Related: fix: use a GitHub App token in the GeoLite update workflow #508 (GitHub App token fix for the same workflow). The two PRs touch different lines and merge cleanly in either order.

Testing instructions

1. Confirm the YAML parses: python3 -c "import yaml; yaml.safe_load(open('.github/workflows/update-geolite-database.yml'))".
2. Confirm the PR body string renders with backticks in bash:
   bash -c 'echo "PR generated by workflow \Update GeoLite Database` on behalf of @user."'`
3. After fix: use a GitHub App token in the GeoLite update workflow #508 is merged and the GitHub App secrets are in place (DOS-7368), trigger the workflow manually on release-ulmo and check that it opens a PR whose branch name ends in -<run_id>-<run_attempt>.

[abhalsod-sonata]

Converting to draft to hold the merge until the GitHub App secrets for #508 are in place (DOS-7368).

Merge order

1. fix: make GeoLite update workflow rerun-safe and fix shell quoting #501 (this PR): rerun and quoting fixes. Already approved.
2. fix: use a GitHub App token in the GeoLite update workflow #508: switches the workflow to the GitHub App token. Merge after fix: make GeoLite update workflow rerun-safe and fix shell quoting #501, once SRE confirms the GH_APP_CLIENT_ID and GH_APP_PRIVATE_KEY secrets exist.

The two PRs touch different lines and don't conflict. After both are merged, one manual run of the workflow verifies both changes. I'll mark this ready for review once DOS-7368 is done.