Skip to content

fix(ci): harden composite action inputs in run scripts - #3534

Open
SashaMIT wants to merge 1 commit into
e2b-dev:mainfrom
SashaMIT:fix/ci-harden-composite-action-inputs
Open

fix(ci): harden composite action inputs in run scripts#3534
SashaMIT wants to merge 1 commit into
e2b-dev:mainfrom
SashaMIT:fix/ci-harden-composite-action-inputs

Conversation

@SashaMIT

@SashaMIT SashaMIT commented Aug 5, 2026

Copy link
Copy Markdown

Summary

  • CI hygiene for .github/actions/integration-tests and unit-tests composites.
  • Bind free-string inputs (orchestrator-make-path, test-path) under env: before run: script use.
  • working-directory: / with: / if: expressions left as-is (not shell script text).
  • Defense-in-depth for Actions composites — not framed as a vulnerability ticket.

Test plan

  • Workflow YAML review
  • Existing integration/unit workflows still invoke the composites

Made with Cursor

Bind orchestrator-make-path and test-path under env: before use in run:
so composite inputs are not interpolated into script text.
@cla-bot

cla-bot Bot commented Aug 5, 2026

Copy link
Copy Markdown

We require contributors to sign our Contributor License Agreement, and we don't have @SashaMIT on file. You can sign our CLA at https://e2b.dev/docs/cla . Once you've signed, post a comment here that says '@cla-bot check'

@SashaMIT

SashaMIT commented Aug 5, 2026

Copy link
Copy Markdown
Author

@cla-bot check

@cla-bot cla-bot Bot added the cla-signed label Aug 5, 2026
@cla-bot

cla-bot Bot commented Aug 5, 2026

Copy link
Copy Markdown

The cla-bot has been summoned, and re-checked this pull request!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant