An `echo X=… >> $GITHUB_ENV` inside a shell `if` branch is taken as unconditional, and later steps with `if: env.X != …` are dropped silently

オープン
  • 何か問題がありますか？
#284 コメント 0 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
3/5
見積もり時間
1〜2日
初心者へのやさしさ
35/100
issue の種類
バグ
明瞭さ
おおむね明確
活発さ
活発
技術スタック
github-actions, python, shell
領域
ci-cd

調査の方向性

The bug is in project_validator/ci/github_actions.py: _exported (around lines 139-145) records every echo NAME=value >> $GITHUB_ENV without checking the shell if around it, and the step-skip check near lines 268-270 drops steps whose if: depends on that value. Start by reproducing with the small workflow described in the issue and run --facts on it. Done means a step whose if: depends on a conditionally exported variable is either evaluated correctly or recorded as unknown rather than silently skipped, with a test covering it.

索引モデルが issue の本文から書いたものです。

説明

zigtools/zls: a step sets SKIP_DEPLOY=true in $GITHUB_ENV only inside an if branch; the validator records the assignment unconditionally, every later step guarded by if: env.SKIP_DEPLOY != 'true' is dropped with no ERROR, and the zig build release -Doptimize=ReleaseSafe build is never seen (hardening FAIL "no ReleaseSafe build", ci-build-types "missing Release"). A value set under a condition is unknown; a step whose if: depends on it should be read (or recorded as unknown), not dropped.

Evidence from the corpus audit

zigtools/zls / hardening (also ci-build-types)
  • kind: FALSE_NEGATIVE
  • actual: FAIL: release builds drop Zig's safety checks: no ReleaseSafe build (ci-build-types: "linux / master: missing
    ... Release")
  • expected: PASS: the release workflow builds with -Doptimize=ReleaseSafe.
  • evidence: .github/workflows/artifacts.yml:23: if: github.event_name == 'schedule' (the step that may export);
    :32: echo "SKIP_DEPLOY=true" >> $GITHUB_ENV (inside if [ -n "$(git tag --points-at HEAD)" ]; then);
    :61: if: env.SKIP_DEPLOY != 'true'; :64: zig build release -Drelease-minisign -Doptimize=ReleaseSafe --summary all.
    Validator: project_validator/ci/github_actions.py:139-145 (_exported takes every echo NAME=value >> $GITHUB_ENV
    in the script, ignoring the shell if it sits in and the step's own unknown if:); :259-261 merges it into
    known.env; :268-270 runs = self.runs(step.get("if"), known); if runs is False: return drops the step with no
    fact and no "not read". --facts confirms: artifacts.yml yields facts for steps[0..1] only; no ActionStep for
    mlugg/setup-zig, no Command for step 7.
  • repro: .github/workflows/r.yml: job with steps run: |\n if [ -n "$X" ]; then\n echo "SKIP=true" >> $GITHUB_ENV\n fi
    then - uses: mlugg/setup-zig@v2\n if: env.SKIP != 'true' then - run: zig build -Doptimize=ReleaseSafe\n if: env.SKIP != 'true';
    build.zig with addExecutable. Reproduced in
    <scratch>/audit/repro-hard-githubenv
    (FAIL; the same workflow without the export PASSes).
  • confidence: high

Found by the regression-corpus audit (235 real repositories, one or more per ecosystem profile; corpus and expected results in corpus/). Evidence is quoted from the audited checkouts at the commits pinned in corpus/projects.toml; <checkouts>/<owner>__<repo> is such a checkout.

🤖 Generated with Claude Code

https://claude.ai/code/session_01ByTXNqDWdM7HzezrFtEvQt

主要言語
Python
スター
4
フォーク
1
平均マージ
10時間 41分
マージ済み PR（30日）
79

環境構築

このプロジェクトには開発コンテナ、Dockerfile、コントリビューションガイドがありません。まず README を読み、一般的な手順ははじめてのコントリビューションガイドを参照してください。

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

cpp-best-practices/project_validator のほかの issue

cpp-best-practices/project_validator の issue をすべて見る

似ている issue

Python の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。