Compare boolean inputs instead of executing them - #21
Merged
Merged
Conversation
`if ${INPUT_FORCE}; then` did not compare the input, it ran it as a
command. `force: true` worked only because /usr/bin/true exists, while
`force: yes` ran `yes` and hung the job until the runner timed out, and
any other string was executed verbatim.
Both flags are now compared against the string "true". Values that are
not "true" are inert, which matches how the README documents them.
test_start.sh covers this with a stub `git` on PATH, so it needs no
token and no network. It hangs on the old code and passes on the new.
Also adds a .gitignore for .DS_Store/.idea and a read-only default
token scope for the CI workflow.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X1sz7entAqb4B2Hycm9YF4
test_start.sh was 55 lines of stub-git plumbing guarding two lines of
string comparison. It paid for itself while proving the bug and the
fix, but as a permanent fixture the ratio does not hold up.
The regression worth guarding is a syntax pattern, so a pygrep hook
catches it directly: it fails on `if ${INPUT_...}` and reports the
offending line numbers. Verified against the pre-fix start.sh.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X1sz7entAqb4B2Hycm9YF4
The pattern missed `if "${INPUT_X}"`, which still executes the input,
and the while/until forms. Widening it costs ten characters and no
readability, and it does not fire on the `[ "$x" = "true" ]` or
`[ -z "$x" ]` forms the script actually uses.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X1sz7entAqb4B2Hycm9YF4
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
1.
forceandtagswere executed, not comparedforce: true— worked only because/usr/bin/trueexits 0force: yes— ranyes, hanging the job until the runner timed outforce: 1—command not found, andset -eaborted the syncBoth are now compared against
"true". Anything else is inert, as the README already documents. Workflows passingtrue/falseare unaffected.A
pygreppre-commit hook fails the build if the executing form comes back.2.
.gitignore.DS_Storeand.idea/were untracked and onegit add -Afrom being committed.3. Read-only CI token
permissions: contents: read— neither job needs write.🤖 Generated with Claude Code
https://claude.ai/code/session_01X1sz7entAqb4B2Hycm9YF4