From 24d45ff20bb020d94ec2d54d80dc54920f42eff8 Mon Sep 17 00:00:00 2001 From: nbuckwalt Date: Thu, 26 Mar 2026 16:36:19 -0400 Subject: [PATCH] fix: use env var indirection for inputs.include-hidden-files to prevent CMD_EXEC --- action.yml | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/action.yml b/action.yml index 7afb508..e26c36c 100644 --- a/action.yml +++ b/action.yml @@ -36,11 +36,12 @@ runs: -cvf "$RUNNER_TEMP/artifact.tar" \ --exclude=.git \ --exclude=.github \ - ${{ inputs.include-hidden-files != 'true' && '--exclude=.[^/]*' || '' }} \ + $( [ "$INCLUDE_HIDDEN_FILES" != 'true' ] && echo '--exclude=.[^/]*' || echo '' ) \ . echo ::endgroup:: env: INPUT_PATH: ${{ inputs.path }} + INCLUDE_HIDDEN_FILES: ${{ inputs.include-hidden-files }} # Switch to gtar (GNU tar instead of bsdtar which is the default in the MacOS runners so we can use --hard-dereference) - name: Archive artifact @@ -54,11 +55,12 @@ runs: -cvf "$RUNNER_TEMP/artifact.tar" \ --exclude=.git \ --exclude=.github \ - ${{ inputs.include-hidden-files != 'true' && '--exclude=.[^/]*' || '' }} \ + $( [ "$INCLUDE_HIDDEN_FILES" != 'true' ] && echo '--exclude=.[^/]*' || echo '' ) \ . echo ::endgroup:: env: INPUT_PATH: ${{ inputs.path }} + INCLUDE_HIDDEN_FILES: ${{ inputs.include-hidden-files }} # Massage the paths for Windows only - name: Archive artifact @@ -72,12 +74,13 @@ runs: -cvf "$RUNNER_TEMP\artifact.tar" \ --exclude=.git \ --exclude=.github \ - ${{ inputs.include-hidden-files != 'true' && '--exclude=.[^/]*' || '' }} \ + $( [ "$INCLUDE_HIDDEN_FILES" != 'true' ] && echo '--exclude=.[^/]*' || echo '' ) \ --force-local \ "." echo ::endgroup:: env: INPUT_PATH: ${{ inputs.path }} + INCLUDE_HIDDEN_FILES: ${{ inputs.include-hidden-files }} - name: Upload artifact id: upload-artifact