mirror of
https://github.com/nektos/act.git
synced 2026-04-26 09:25:54 +03:00
[GH-ISSUE #2019] github.action_ref is empty when accessed within env in a composite action #967
Labels
No labels
area/action
area/cli
area/docs
area/image
area/runner
area/workflow
backlog
confirmed/not-planned
kind/bug
kind/discussion
kind/external
kind/feature-request
kind/question
meta/duplicate
meta/invalid
meta/need-more-info
meta/resolved
meta/wontfix
meta/workaround
needs-work
pull-request
review/not-planned
size/M
size/XL
size/XXL
stale
stale-exempt
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/act#967
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @jenseng on GitHub (Sep 22, 2023).
Original GitHub issue: https://github.com/nektos/act/issues/2019
Bug report info
Command used with act
Describe issue
When using
github.action_refwithinenvinside a composite action, it always comes back as blank. The simple jenseng/dynamic-uses/action_ref_example@debug-act-bug action demonstrates the problem:This is inconsistent with actions/runner, which does correctly resolve
github.action_refwhen used withinenv:On a related note, it would be ideal to have access to
github.action_refwithinrunand elsewhere, but even actions/runner doesn't support that, so keeping this bug report scoped to just theenvcontext inconsistency.Link to GitHub repository
No response
Workflow content
Relevant log output
Additional information
No response
@jenseng commented on GitHub (Sep 22, 2023):
Here's a verbose log. What's interesting is that if you look at the 4
[DEBUG] setupEnv =>lines, you'll see thatGITHUB_ACTION_REFhas the expected value the first two times and last time, but is blank the third time, soaction_refends up being empty. Also interesting that on the third timeGITHUB_ACTION_PATHis set to the local checkout of the action (whereas it's blank the other times).@ChristopherHX commented on GitHub (Sep 22, 2023):
Believe me you don't want to allow script injection. I think you are refering here to the absense of the feature of nektos/act to access locally defined envs via action expressions.
More secure, less likely broken in act
@ChristopherHX commented on GitHub (Sep 22, 2023):
Ok also the more secure variant is broken...
@jenseng commented on GitHub (Sep 22, 2023):
good point on the script injection (😆 😬)... that being said, there is something odd here specifically around
github.action_ref(andgithub.action_repository) being blank, since locally set env variables do generally seem to work with either approach (echo {{ env.foo }}orecho "$foo")@jenseng commented on GitHub (Sep 22, 2023):
Still new to the codebase, but it appears this bug might be caused by the
compositeRunContextcreating aExpressionEvaluatorthat doesn't considersar.getGithubContext's additions ofActionRepository/ActionRef; it's just usingrc.getGithubContext@jenseng commented on GitHub (Sep 22, 2023):
The other places in the verbose log where those variables appear correctly, it seems the code is explicitly calling the step's
getGithubContext@ChristopherHX commented on GitHub (Sep 22, 2023):
I always burn my fingers if I touch composite actions in act again. My contributed code has been refactored in the past and got buggy, due to my lazyiness in writing tests in the past...