fix: pass ignore-policies input via env instead of interpolating into run - #352
Open
Omerg-Legit wants to merge 1 commit into
Open
Omerg-Legit wants to merge 1 commit into
Omerg-Legit wants to merge 1 commit into
Conversation
… run
The create_ignore_policies_file step substituted ${{ inputs.ignore-policies }}
directly into a bash command. Actions performs that substitution as text before
the shell parses the script, so a value containing a double quote could
terminate the echo and chain further commands in the runner context.
Pass the value through the step's env block and reference it as a shell
variable, which is the pattern the analyze step in this same file already uses.
This also fixes a latent correctness bug: inside double quotes, a policy list
containing $, backticks or backslashes was expanded rather than written
literally.
printf is used in place of echo so values beginning with '-' or containing
backslash escapes are written verbatim.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ignore-policiesthrough the step'senv:block instead of interpolating${{ }}into therun:script — the pattern theanalyzestep in this file already uses.echoand chain further commands in the runner context.printfoverechoso a value beginning with-is written verbatim rather than consumed as anechoflag.