mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-05 03:27:07 +09:00
Myasnikov Daniil
248b411725
The wrapper resolved the real git from BACKPORT_REAL_GIT, written to $GITHUB_ENV by its install step. That made it depend on an environment variable reaching a step the workflow does not control: `actions/checkout` declares `post: dist/index.js`, which runs git to unset its auth header after the action has finished, and by then the wrapper is on PATH. If that variable failed to arrive there, every git call in the post step would exit 127 and the job would go red at cleanup, with the backport PR already opened -- alarming, and unverifiable from here either way. Substituting the path into the installed copy has no equivalent question to answer. The install step already runs `command -v git` before putting the wrapper on PATH, so it knows the answer; it now `sed`s that into @REAL_GIT@ rather than exporting it. One consequence worth stating: the committed script is a template and not a runnable script, so it says so when run without the substitution, and exits 127 rather than 1 because the action reads 1 as a conflict. $GITHUB_ENV is no longer written at all, which narrows the inline zizmor suppression to the one $GITHUB_PATH write that has no alternative. hack/backport-git-shim.bats installs the wrapper exactly as the workflow does, and now covers both broken installs: the template copied without substitution, and a substituted path that has gone away. The workflow pin in hack/release-freeze-contract.bats asserts the `sed`, not merely that something is written, because a `cp` in its place leaves an unsubstituted template on PATH and breaks every git call in the job. Assisted-By: LLM Signed-off-by: Myasnikov Daniil <myasnikovdaniil2001@gmail.com>