From 0683f9c2e7ae77dd8ebed6dde0ad750c8060ace3 Mon Sep 17 00:00:00 2001
From: Jason Murray <jason@chaosaffe.io>
Date: Thu, 30 Jul 2026 17:03:19 -0700
Subject: [PATCH] Harden action.yml: env-var quoting, set -euo pipefail, fix
 line-count bug

- Route all inputs through env: instead of interpolating ${{ }} directly
  into run:, closing the GitHub Actions script-injection anti-pattern.
- Build split_tests arguments as bash arrays instead of unquoted strings,
  so quoting can't be lost on re-expansion (same class of bug fixed for
  exclude-glob in #9, now fixed structurally for every argument).
- Add set -euo pipefail to both composite steps so a failed download or
  failed split_tests run fails the job loudly instead of silently
  emitting an empty test-suite output.
- Fix line-count: false being treated as truthy (-n check on the string
  "false" is true); now compared against the literal string "true".
- Switch $GITHUB_OUTPUT to the multiline-safe heredoc form.
---
 action.yml | 40 ++++++++++++++++++++++++++++------------
 1 file changed, 28 insertions(+), 12 deletions(-)

diff --git a/action.yml b/action.yml
index 0b64483..a0cd550 100644
--- a/action.yml
+++ b/action.yml
@@ -36,33 +36,49 @@ runs:
   using: composite
   steps:
     - name: Install split_tests
-      run: curl -L "https://github.com/leonid-shevtsov/split_tests/releases/latest/download/split_tests.linux.gz" | gunzip -v > split_tests && chmod +x split_tests
+      run: |
+        set -euo pipefail
+        curl -fL "https://github.com/leonid-shevtsov/split_tests/releases/latest/download/split_tests.linux.gz" | gunzip -v > split_tests
+        chmod +x split_tests
       shell: bash
     - name: Split Tests
       id: split-tests
+      env:
+        SPLIT_TOTAL: ${{ inputs.split-total }}
+        SPLIT_INDEX: ${{ inputs.split-index }}
+        GLOB: ${{ inputs.glob }}
+        EXCLUDE_GLOB_INPUT: ${{ inputs.exclude-glob }}
+        JUNIT_PATH: ${{ inputs.junit-path }}
+        LINE_COUNT: ${{ inputs.line-count }}
       run: |
+        set -euo pipefail
+
         # setup split type
-        if [ -n "${{ inputs.junit-path }}" ]; then
+        if [ -n "$JUNIT_PATH" ]; then
           echo "junit-path set. Splitting based on JUnit timings"
-          SPLIT_BY="-junit -junit-path=${{ inputs.junit-path }}"
-        elif [ -n "${{ inputs.line-count }}" ]; then
+          SPLIT_BY=(-junit -junit-path="$JUNIT_PATH")
+        elif [ "$LINE_COUNT" = "true" ]; then
           echo "line-count set. Splitting based on test line count"
-          SPLIT_BY="-line-count"
+          SPLIT_BY=(-line-count)
         else
           echo "No split type arguments set. Using default"
-          SPLIT_BY=""
+          SPLIT_BY=()
         fi
 
-        EXCLUDE_GLOB=""
-        if [ -n "${{ inputs.exclude-glob }}" ]; then
-          EXCLUDE_GLOB="-exclude-glob=${{ inputs.exclude-glob }}"
+        EXCLUDE_GLOB=()
+        if [ -n "$EXCLUDE_GLOB_INPUT" ]; then
+          EXCLUDE_GLOB=(-exclude-glob="$EXCLUDE_GLOB_INPUT")
         fi
 
-        TESTS=$(./split_tests ${SPLIT_BY} -split-index=${{ inputs.split-index }} -split-total=${{ inputs.split-total }} -glob='${{ inputs.glob }}' ${EXCLUDE_GLOB})
+        TESTS=$(./split_tests "${SPLIT_BY[@]}" -split-index="$SPLIT_INDEX" -split-total="$SPLIT_TOTAL" -glob="$GLOB" "${EXCLUDE_GLOB[@]}")
 
-        echo $TESTS
+        echo "$TESTS"
 
-        echo "test-suite=${TESTS}" >> $GITHUB_OUTPUT          
+        {
+          echo "test-suite<<SPLIT_TESTS_EOF"
+          echo "$TESTS"
+          echo "SPLIT_TESTS_EOF"
+        } >> "$GITHUB_OUTPUT"
       shell: bash
 branding:
   icon: shuffle