Scrub runner event env in test harness #1

Merged

stephen merged 2 commits from fix/harness-event-path-scrub into main 2026-08-07 21:51:15 +00:00

Conversation 0 Commits 2 Files changed 3 +88 -12

stephen commented 2026-08-05 23:07:40 +00:00

Owner

Copy link

What changed:

• Scrubbed ambient runner GITHUB_* context from tests/run.sh child process environments before invoking the action or helper under test.
• Scrubbed variables: GITHUB_EVENT_PATH, GITHUB_REPOSITORY, GITHUB_REF, GITHUB_REF_NAME, GITHUB_SHA, GITHUB_RUN_ID, GITHUB_RUN_NUMBER, GITHUB_ACTIONS, GITHUB_WORKSPACE, GITHUB_OUTPUT, GITHUB_STATE, GITHUB_STEP_SUMMARY, GITHUB_PATH, GITHUB_ENV.
• Harness-owned values are deliberately set back where needed, for example fixture GITHUB_OUTPUT/GITHUB_STATE/GITHUB_PATH/GITHUB_ENV files, GITHUB_WORKSPACE for cache-key tests, and repo/ref/sha/run metadata fixtures.

Why:

• A real runner can export GITHUB_EVENT_PATH and other GITHUB_* values. The harness should not let those ambient values override its fixtures.

Verification:

• Preventative: the leaked-event run and the normal bash tests/run.sh run were green before and after this change; no behaviour change was observed today because this action does not currently depend on context.payload.

What changed: - Scrubbed ambient runner GITHUB_* context from tests/run.sh child process environments before invoking the action or helper under test. - Scrubbed variables: GITHUB_EVENT_PATH, GITHUB_REPOSITORY, GITHUB_REF, GITHUB_REF_NAME, GITHUB_SHA, GITHUB_RUN_ID, GITHUB_RUN_NUMBER, GITHUB_ACTIONS, GITHUB_WORKSPACE, GITHUB_OUTPUT, GITHUB_STATE, GITHUB_STEP_SUMMARY, GITHUB_PATH, GITHUB_ENV. - Harness-owned values are deliberately set back where needed, for example fixture GITHUB_OUTPUT/GITHUB_STATE/GITHUB_PATH/GITHUB_ENV files, GITHUB_WORKSPACE for cache-key tests, and repo/ref/sha/run metadata fixtures. Why: - A real runner can export GITHUB_EVENT_PATH and other GITHUB_* values. The harness should not let those ambient values override its fixtures. Verification: - Preventative: the leaked-event run and the normal bash tests/run.sh run were green before and after this change; no behaviour change was observed today because this action does not currently depend on context.payload.

stephen added 1 commit 2026-08-05 23:07:40 +00:00

Scrub runner event env in test harness 7ecab4a279

stephen added 1 commit 2026-08-07 21:17:17 +00:00

Fix Go installer checksum extraction 3c32621512

stephen force-pushed fix/harness-event-path-scrub from 3c32621512 to 19ee1ef92c 2026-08-07 21:21:34 +00:00 Compare

stephen force-pushed fix/harness-event-path-scrub from 19ee1ef92c to 97b1451df1 2026-08-07 21:23:34 +00:00 Compare

stephen force-pushed fix/harness-event-path-scrub from 97b1451df1 to bb67188030 2026-08-07 21:26:03 +00:00 Compare

stephen force-pushed fix/harness-event-path-scrub from bb67188030 to 6bee837130 2026-08-07 21:28:39 +00:00 Compare

stephen force-pushed fix/harness-event-path-scrub from 6bee837130 to 3161b98c27 2026-08-07 21:31:07 +00:00 Compare

stephen force-pushed fix/harness-event-path-scrub from 3161b98c27 to 669de38e0d 2026-08-07 21:33:41 +00:00 Compare

stephen merged commit c4711dce84 into main 2026-08-07 21:51:15 +00:00

stephen referenced this pull request from a commit 2026-08-07 21:51:15 +00:00

Merge pull request 'Scrub runner event env in test harness' (#1) from fix/harness-event-path-scrub into main

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

backlog

Accepted but not scheduled

  

blocked

Blocked or stalled waiting on external progress

  

converted

Converted into tracked work

  

opportunity

Potential product or business opportunity

  

p1

Priority 1

  

p2

Priority 2

  

p3

Priority 3

  

parked

Paused intentionally until later

No labels

backlog

blocked

converted

opportunity

p1

p2

p3

parked

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

fjord/setup-go-action!1

No description provided.