Skip to content

Commit a5b1659

Browse files
panvaaduh95
panva
authored and
aduh95
committed
tools: avoid workflow shell interpolation
Pass input, output, and version values through environment variables instead of expanding them into shell source. Split benchmark categories and PR numbers into arrays to retain separate arguments. Signed-off-by: Filip Skokan <[email protected]> Assisted-by: Codex PR-URL: #66013 Reviewed-By: Antoine du Hamel <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Xuguang Mei <[email protected]> Reviewed-By: Ulises Gascón <[email protected]>
1 parent caf0ee0 commit a5b1659

6 files changed

Lines changed: 26 additions & 12 deletions

File tree

‎.github/workflows/auto-start-ci.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,9 @@ jobs:
7272

7373
- name: Start the CI
7474
run: |
75+
read -r -a numbers <<< "$PULL_REQUESTS"
7576
curl -fsSL "https://github.com/${GITHUB_REPOSITORY}/raw/${GITHUB_SHA}/tools/actions/start-ci.sh" \
76-
| sh -s -- ${{ needs.get-prs-for-ci.outputs.numbers }}
77+
| sh -s -- "${numbers[@]}"
7778
env:
7879
GH_TOKEN: ${{ github.token }}
80+
PULL_REQUESTS: ${{ needs.get-prs-for-ci.outputs.numbers }}

‎.github/workflows/benchmark.yml‎

Lines changed: 12 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,9 @@ jobs:
4747
steps:
4848
- name: Mark token input as sensitive
4949
if: inputs.token != ''
50-
run: echo "::add-mask::${{ inputs.token }}"
50+
run: printf '::add-mask::%s\n' "$COMMENT_TOKEN"
51+
env:
52+
COMMENT_TOKEN: ${{ inputs.token }}
5153
- name: Add link to the current run
5254
id: comment
5355
run: |
@@ -155,19 +157,20 @@ jobs:
155157
run: |
156158
nix-shell \
157159
-I nixpkgs=./tools/nix/pkgs.nix \
158-
--pure --keep FILTER --keep LC_ALL --keep LANG \
160+
--pure --keep CATEGORIES --keep FILTER --keep RUNS --keep LC_ALL --keep LANG \
159161
--arg loadJSBuiltinsDynamically false \
160162
--arg ccache 'null' \
161163
--arg icu 'null' \
162164
--arg sharedLibDeps '{}' \
163165
--arg devTools '[]' \
164166
--run '
165167
set -o pipefail
168+
read -r -a categories <<< "$CATEGORIES"
166169
./base_node benchmark/compare.js \
167170
--filter "$FILTER" \
168-
--runs ${{ inputs.runs }} \
171+
--runs "$RUNS" \
169172
--old ./base_node --new ./node \
170-
-- ${{ inputs.category }} \
173+
-- "${categories[@]}" \
171174
| tee /dev/stderr \
172175
> ${{ matrix.system }}.csv
173176
echo "> [!WARNING] "
@@ -185,7 +188,9 @@ jobs:
185188
echo "> using a dedicated machine, e.g. Jenkins CI."
186189
' | tee /dev/stderr >> "$GITHUB_STEP_SUMMARY"
187190
env:
191+
CATEGORIES: ${{ inputs.category }}
188192
FILTER: ${{ inputs.filter }}
193+
RUNS: ${{ inputs.runs }}
189194

190195
- name: Upload raw benchmark results
191196
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
@@ -246,7 +251,9 @@ jobs:
246251
' | tee /dev/stderr ${{ inputs.post-comment && 'body.txt' || '' }} >> "$GITHUB_STEP_SUMMARY"
247252
- name: Mark token input as sensitive
248253
if: inputs.token != ''
249-
run: echo "::add-mask::${{ inputs.token }}"
254+
run: printf '::add-mask::%s\n' "$COMMENT_TOKEN"
255+
env:
256+
COMMENT_TOKEN: ${{ inputs.token }}
250257
- name: Edit comment
251258
if: inputs.post-comment
252259
run: |

‎.github/workflows/commit-queue.yml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -196,6 +196,8 @@ jobs:
196196
git config --local user.email "[email protected]"
197197
git config --local user.name "Node.js GitHub Bot"
198198
ncu-config set token "$GH_TOKEN"
199-
./tools/actions/commit-queue.sh ${{ steps.get_mergeable_prs.outputs.numbers }}
199+
read -r -a numbers <<< "$PULL_REQUESTS"
200+
./tools/actions/commit-queue.sh "${numbers[@]}"
200201
env:
201202
GH_TOKEN: ${{ secrets.GH_USER_TOKEN }}
203+
PULL_REQUESTS: ${{ steps.get_mergeable_prs.outputs.numbers }}

‎.github/workflows/daily-wpt-fyi.yml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -122,7 +122,9 @@ jobs:
122122
- name: Clone report for upload
123123
if: ${{ env.WPT_REPORT != '' }}
124124
working-directory: out/wpt
125-
run: cp wptreport.json wptreport-${{ steps.setup-node.outputs.node-version }}.json
125+
run: cp wptreport.json "wptreport-$NODE_VERSION.json"
126+
env:
127+
NODE_VERSION: ${{ steps.setup-node.outputs.node-version }}
126128
- name: Upload GitHub Actions artifact
127129
if: ${{ env.WPT_REPORT != '' }}
128130
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
@@ -133,12 +135,13 @@ jobs:
133135
- name: Upload WPT Report to wpt.fyi API
134136
if: ${{ env.WPT_REPORT != '' }}
135137
env:
138+
NODE_VERSION: ${{ steps.setup-node.outputs.node-version }}
136139
WPT_FYI_USERNAME: ${{ vars.WPT_FYI_USERNAME }}
137140
WPT_FYI_PASSWORD: ${{ secrets.WPT_FYI_PASSWORD }}
138141
working-directory: out/wpt
139142
run: |
140143
gzip wptreport.json
141-
echo "## Node.js ${{ steps.setup-node.outputs.node-version }}" >> $GITHUB_STEP_SUMMARY
144+
echo "## Node.js $NODE_VERSION" >> $GITHUB_STEP_SUMMARY
142145
echo "" >> $GITHUB_STEP_SUMMARY
143146
echo "WPT Revision: [\`${WPT_REVISION:0:7}\`](https://github.com/web-platform-tests/wpt/commits/$WPT_REVISION)" >> $GITHUB_STEP_SUMMARY
144147
for WPT_FYI_ENDPOINT in "https://wpt.fyi/api/results/upload" "https://staging.wpt.fyi/api/results/upload"

‎.github/workflows/timezone-update.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40,14 +40,14 @@ jobs:
4040

4141
- name: Compare versions
4242
run: |
43-
echo "Comparing current version ${{ env.current_version }} to new version ${{ env.new_version }}"
43+
echo "Comparing current version $current_version to new version $new_version"
4444
4545
- run: ./tools/dep_updaters/update-timezone.mjs
4646
if: ${{ env.new_version != env.current_version }}
4747

4848
- name: Update the expected timezone version in test
4949
if: ${{ env.new_version != env.current_version }}
50-
run: echo "${{ env.new_version }}" > test/fixtures/tz-version.txt
50+
run: printf '%s\n' "$new_version" > test/fixtures/tz-version.txt
5151

5252
- name: Open Pull Request
5353
if: ${{ env.new_version != env.current_version }}

‎.github/workflows/tools.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -338,7 +338,7 @@ jobs:
338338
- name: Generate commit message if not set
339339
if: env.COMMIT_MSG == '' && (github.event_name == 'schedule' || inputs.id == 'all' || inputs.id == matrix.id)
340340
run: |
341-
echo "COMMIT_MSG=${{ matrix.subsystem }}: update ${{ matrix.id }} to ${{ env.NEW_VERSION }}" >> "$GITHUB_ENV"
341+
echo "COMMIT_MSG=${{ matrix.subsystem }}: update ${{ matrix.id }} to $NEW_VERSION" >> "$GITHUB_ENV"
342342
- uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
343343
if: github.event_name == 'schedule' || inputs.id == 'all' || inputs.id == matrix.id
344344
# Creates a PR or update the Action's existing PR, or

0 commit comments

Comments
 (0)