fjord/apple-codesign-action
Watch
2
0
Fork
You've already forked apple-codesign-action
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Scrub runner event env in test harness #1

Merged
stephen merged 1 commit from fix/harness-event-path-scrub into main 2026-08-06 00:02:28 +00:00
Conversation 0 Commits 1 Files changed 1 +2 -2
stephen commented 2026-08-05 23:07:35 +00:00
Owner
Copy link

What changed:

  • Scrubbed ambient runner GITHUB_* context from tests/run.sh child process environments before invoking the action or helper under test.
  • Scrubbed variables: GITHUB_EVENT_PATH, GITHUB_REPOSITORY, GITHUB_REF, GITHUB_REF_NAME, GITHUB_SHA, GITHUB_RUN_ID, GITHUB_RUN_NUMBER, GITHUB_ACTIONS, GITHUB_WORKSPACE, GITHUB_OUTPUT, GITHUB_STATE, GITHUB_STEP_SUMMARY, GITHUB_PATH, GITHUB_ENV.
  • Harness-owned values are deliberately set back where needed, for example fixture GITHUB_OUTPUT/GITHUB_STATE/GITHUB_PATH/GITHUB_ENV files, GITHUB_WORKSPACE for cache-key tests, and repo/ref/sha/run metadata fixtures.

Why:

  • A real runner can export GITHUB_EVENT_PATH and other GITHUB_* values. The harness should not let those ambient values override its fixtures.

Verification:

  • Preventative: the leaked-event run and the normal bash tests/run.sh run were green before and after this change; no behaviour change was observed today because this action does not currently depend on context.payload.
What changed: - Scrubbed ambient runner GITHUB_* context from tests/run.sh child process environments before invoking the action or helper under test. - Scrubbed variables: GITHUB_EVENT_PATH, GITHUB_REPOSITORY, GITHUB_REF, GITHUB_REF_NAME, GITHUB_SHA, GITHUB_RUN_ID, GITHUB_RUN_NUMBER, GITHUB_ACTIONS, GITHUB_WORKSPACE, GITHUB_OUTPUT, GITHUB_STATE, GITHUB_STEP_SUMMARY, GITHUB_PATH, GITHUB_ENV. - Harness-owned values are deliberately set back where needed, for example fixture GITHUB_OUTPUT/GITHUB_STATE/GITHUB_PATH/GITHUB_ENV files, GITHUB_WORKSPACE for cache-key tests, and repo/ref/sha/run metadata fixtures. Why: - A real runner can export GITHUB_EVENT_PATH and other GITHUB_* values. The harness should not let those ambient values override its fixtures. Verification: - Preventative: the leaked-event run and the normal bash tests/run.sh run were green before and after this change; no behaviour change was observed today because this action does not currently depend on context.payload.
Scrub runner event env in test harness
All checks were successful
test / unit (pull_request) Successful in 25s
Details
3e9b9c1159
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
backlog
Accepted but not scheduled

  
blocked
Blocked or stalled waiting on external progress

  
converted
Converted into tracked work

  
opportunity
Potential product or business opportunity

  
p1
Priority 1

  
p2
Priority 2

  
p3
Priority 3

  
parked
Paused intentionally until later

No labels
backlog
blocked
converted
opportunity
p1
p2
p3
parked
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
fjord/apple-codesign-action!1
No description provided.