An `echo X=… >> $GITHUB_ENV` inside a shell `if` branch is taken as unconditional, and later steps with `if: env.X != …` are dropped silently

Ouverte
  • Quelque chose ne va pas ?
#284 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub

Les mainteneurs répondent en général sous 1 jour

Personne n'a encore pris cette issue.

Évaluation

Difficulté
3/5
Temps estimé
1-2 jours
Accessibilité débutants
35/100
Type d'issue
Bug
Clarté
Plutôt claire
Activité
Active
Stack technique
github-actions, python, shell
Domaine
ci-cd

Piste de recherche

The bug is in project_validator/ci/github_actions.py: _exported (around lines 139-145) records every echo NAME=value >> $GITHUB_ENV without checking the shell if around it, and the step-skip check near lines 268-270 drops steps whose if: depends on that value. Start by reproducing with the small workflow described in the issue and run --facts on it. Done means a step whose if: depends on a conditionally exported variable is either evaluated correctly or recorded as unknown rather than silently skipped, with a test covering it.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

zigtools/zls: a step sets SKIP_DEPLOY=true in $GITHUB_ENV only inside an if branch; the validator records the assignment unconditionally, every later step guarded by if: env.SKIP_DEPLOY != 'true' is dropped with no ERROR, and the zig build release -Doptimize=ReleaseSafe build is never seen (hardening FAIL "no ReleaseSafe build", ci-build-types "missing Release"). A value set under a condition is unknown; a step whose if: depends on it should be read (or recorded as unknown), not dropped.

Evidence from the corpus audit

zigtools/zls / hardening (also ci-build-types)
  • kind: FALSE_NEGATIVE
  • actual: FAIL: release builds drop Zig's safety checks: no ReleaseSafe build (ci-build-types: "linux / master: missing
    ... Release")
  • expected: PASS: the release workflow builds with -Doptimize=ReleaseSafe.
  • evidence: .github/workflows/artifacts.yml:23: if: github.event_name == 'schedule' (the step that may export);
    :32: echo "SKIP_DEPLOY=true" >> $GITHUB_ENV (inside if [ -n "$(git tag --points-at HEAD)" ]; then);
    :61: if: env.SKIP_DEPLOY != 'true'; :64: zig build release -Drelease-minisign -Doptimize=ReleaseSafe --summary all.
    Validator: project_validator/ci/github_actions.py:139-145 (_exported takes every echo NAME=value >> $GITHUB_ENV
    in the script, ignoring the shell if it sits in and the step's own unknown if:); :259-261 merges it into
    known.env; :268-270 runs = self.runs(step.get("if"), known); if runs is False: return drops the step with no
    fact and no "not read". --facts confirms: artifacts.yml yields facts for steps[0..1] only; no ActionStep for
    mlugg/setup-zig, no Command for step 7.
  • repro: .github/workflows/r.yml: job with steps run: |\n if [ -n "$X" ]; then\n echo "SKIP=true" >> $GITHUB_ENV\n fi
    then - uses: mlugg/setup-zig@v2\n if: env.SKIP != 'true' then - run: zig build -Doptimize=ReleaseSafe\n if: env.SKIP != 'true';
    build.zig with addExecutable. Reproduced in
    <scratch>/audit/repro-hard-githubenv
    (FAIL; the same workflow without the export PASSes).
  • confidence: high

Found by the regression-corpus audit (235 real repositories, one or more per ecosystem profile; corpus and expected results in corpus/). Evidence is quoted from the audited checkouts at the commits pinned in corpus/projects.toml; <checkouts>/<owner>__<repo> is such a checkout.

🤖 Generated with Claude Code

https://claude.ai/code/session_01ByTXNqDWdM7HzezrFtEvQt

Langage dominant
Python
Étoiles
4
Forks
1
Merge moyen
10 h 41 min
PR mergées (30 j)
79

Préparer son environnement

Ce projet ne fournit ni conteneur de développement, ni Dockerfile, ni guide de contribution : l'installation est à votre charge. Commencez par son README, et consultez notre guide de la première contribution pour les étapes générales.

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de cpp-best-practices/project_validator

Toutes les issues de cpp-best-practices/project_validator

Issues similaires

Plus d'issues Python

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.