From c4b2f6075a1f64fe7d3eb59ac92c50d4fbfc2ec2 Mon Sep 17 00:00:00 2001 From: SashaMIT Date: Wed, 5 Aug 2026 14:25:05 +0700 Subject: [PATCH] fix(ci): harden composite action inputs in run scripts Bind orchestrator-make-path and test-path under env: before use in run: so composite inputs are not interpolated into script text. --- .github/actions/integration-tests/action.yml | 10 +++++++--- .github/actions/unit-tests/action.yml | 8 ++++++-- 2 files changed, 13 insertions(+), 5 deletions(-) diff --git a/.github/actions/integration-tests/action.yml b/.github/actions/integration-tests/action.yml index cde0982032..4a67048596 100644 --- a/.github/actions/integration-tests/action.yml +++ b/.github/actions/integration-tests/action.yml @@ -87,7 +87,9 @@ runs: - name: Build alternate orchestrator if: inputs.orchestrator-make-path != 'packages/orchestrator' shell: bash - run: make -C "${{ inputs.orchestrator-make-path }}" build-debug + env: + ORCHESTRATOR_MAKE_PATH: ${{ inputs.orchestrator-make-path }} + run: make -C "$ORCHESTRATOR_MAKE_PATH" build-debug - name: Initialize Host uses: ./.github/actions/host-init @@ -121,9 +123,11 @@ runs: - name: Verify the alternate orchestrator is running if: inputs.orchestrator-make-path != 'packages/orchestrator' shell: bash + env: + ORCHESTRATOR_MAKE_PATH: ${{ inputs.orchestrator-make-path }} run: | - if ! sudo pgrep -af "${{ inputs.orchestrator-make-path }}/bin/"; then - echo "::error::No orchestrator process from ${{ inputs.orchestrator-make-path }} is running." + if ! sudo pgrep -af "$ORCHESTRATOR_MAKE_PATH/bin/"; then + echo "::error::No orchestrator process from $ORCHESTRATOR_MAKE_PATH is running." echo "::error::The start-services action probably ignored orchestrator-make-path (version without this input)." exit 1 fi diff --git a/.github/actions/unit-tests/action.yml b/.github/actions/unit-tests/action.yml index 72ba73f0af..510879f3a7 100644 --- a/.github/actions/unit-tests/action.yml +++ b/.github/actions/unit-tests/action.yml @@ -94,15 +94,19 @@ runs: if: inputs.sudo == 'true' shell: bash working-directory: ${{ inputs.package }} + env: + TEST_PATH: ${{ inputs.test-path }} run: | trap 'sudo chown "$(id -u):$(id -g)" coverage.txt junit.xml 2>/dev/null || true' EXIT sudo -E env "PATH=$PATH" gotestsum --junitfile=junit.xml --format=standard-verbose \ - -- -timeout 20m -coverprofile=coverage.txt -covermode=atomic ${{ inputs.test-path }} + -- -timeout 20m -coverprofile=coverage.txt -covermode=atomic $TEST_PATH - name: Run tests if: inputs.sudo != 'true' shell: bash working-directory: ${{ inputs.package }} + env: + TEST_PATH: ${{ inputs.test-path }} run: | gotestsum --junitfile=junit.xml --format=standard-verbose \ - -- -timeout 20m -coverprofile=coverage.txt -covermode=atomic ${{ inputs.test-path }} + -- -timeout 20m -coverprofile=coverage.txt -covermode=atomic $TEST_PATH