Harden action.yml: env-var quoting, set -euo pipefail, fix line-count bug - #11
Merged
scruplelesswizard merged 2 commits intoJul 31, 2026
Merged
Conversation
… bug
- Route all inputs through env: instead of interpolating ${{ }} directly
into run:, closing the GitHub Actions script-injection anti-pattern.
- Build split_tests arguments as bash arrays instead of unquoted strings,
so quoting can't be lost on re-expansion (same class of bug fixed for
exclude-glob in #9, now fixed structurally for every argument).
- Add set -euo pipefail to both composite steps so a failed download or
failed split_tests run fails the job loudly instead of silently
emitting an empty test-suite output.
- Fix line-count: false being treated as truthy (-n check on the string
"false" is true); now compared against the literal string "true".
- Switch $GITHUB_OUTPUT to the multiline-safe heredoc form.
…uoting-and-error-handling
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up from the maintainer audit in REVIEW.adoc. Bundles the remaining shell-hardening fixes for
action.ymlinto one PR since they're all in the same file and the same run steps:${{ inputs.* }}reference is now routed throughenv:instead of being interpolated directly intorun:. Previously a caller-controlled input value became literal bash source at template-substitution time (before bash ever parsed the script) — GitHub's documented script-injection anti-pattern.split_testsarguments are now built as bash arrays (SPLIT_BY=(...),EXCLUDE_GLOB=(...)) instead of unquoted strings. This is the same category of bug that brokeexclude-glob(fixed in Exclude Glob doesn't exclude #9) — arrays make it structurally impossible to lose quoting on re-expansion, for every argument, not just the one that happened to get reported.set -euo pipefailadded to both composite steps (pluscurl -f), so a failed download or a failedsplit_testsrun now fails the job loudly instead of possibly emitting an emptytest-suiteoutput that a downstream job would silently treat as "0 tests, all green."line-count: falsebug: the old check ([ -n "${{ inputs.line-count }}" ]) was true for the literal string"false", so explicitly disabling line-count mode didn't work. Now compares against the literal string"true".$GITHUB_OUTPUTnow uses the heredoc form instead of single-linename=value, which would silently break if the test-suite list ever contained a newline.Verified the argument-building logic locally (bash array expansion keeps glob patterns as single, correctly-quoted arguments;
line-count: falsetakes the default path instead of the line-count path) before opening this.