Fix GitHub Actions code injection and untrusted-checkout warnings

.github/actions/collect-format-results/action.yaml

@@ -19,18 +19,12 @@ runs:
     - name: Aggregate results
       id: collect
       shell: bash
+      env:
+        RESULTS_JSON: ${{ inputs.results-json }}
       run: |
-        echo "results<<EOF" >> $GITHUB_ENV
-        echo '${{ inputs.results-json }}' >> $GITHUB_ENV
-        echo "EOF" >> $GITHUB_ENV
-
-        # In a real script we would parse the JSON, but for a composite action
-        # we can pass pre-formatted data. To keep it simple and robust,
-        # let's assume the caller provides a bash-friendly format or we use python.
-
         python3 -c "
         import json, os
-        data = json.loads(os.environ['results'])
+        data = json.loads(os.environ['RESULTS_JSON'])
         messages = []
         has_failures = False
         for name, res in data.items():

.github/actions/complete-pr-comment/action.yaml

@@ -17,9 +17,11 @@ runs:
     - name: Update PR Comment Reactions
       if: github.event_name == 'issue_comment'
       uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+      env:
+        INPUT_STATUS: ${{ inputs.status }}
       with:
         script: |
-          const status = '${{ inputs.status }}';
+          const status = process.env.INPUT_STATUS;
           const completionReaction = (status === 'success') ? 'rocket' : 'confused';
 
           // 1. Remove "eyes" reaction

.github/actions/post-clang-tidy-results/action.yaml

@@ -25,8 +25,10 @@ runs:
     - name: Check if artifacts exist
       id: check
       shell: bash
+      env:
+        INPUT_BUILD_PATH: ${{ inputs.build-path }}
       run: |
-        if [ -f "${{ inputs.build-path }}/clang-tidy-fixes.yaml" ]; then
+        if [ -f "${INPUT_BUILD_PATH}/clang-tidy-fixes.yaml" ]; then
           echo "has_fixes=true" >> "$GITHUB_OUTPUT"
         else
           echo "has_fixes=false" >> "$GITHUB_OUTPUT"
@@ -43,10 +45,13 @@ runs:
     - name: Post summary comment
       if: steps.check.outputs.has_fixes == 'true' && inputs.post-summary == 'true' && inputs.pr-number != ''
       uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
+      env:
+        INPUT_BUILD_PATH: ${{ inputs.build-path }}
+        INPUT_PR_NUMBER: ${{ inputs.pr-number }}
       with:
         script: |
           const fs = require('fs');
-          const fixesFile = '${{ inputs.build-path }}/clang-tidy-fixes.yaml';
+          const fixesFile = `${process.env.INPUT_BUILD_PATH}/clang-tidy-fixes.yaml`;
 
           let totalIssues = 0;
           const checkCounts = {};
@@ -72,7 +77,7 @@ runs:
             await github.rest.issues.createComment({
               owner: context.repo.owner,
               repo: context.repo.repo,
-              issue_number: ${{ inputs.pr-number }},
+              issue_number: parseInt(process.env.INPUT_PR_NUMBER, 10),
               body: body
             });
           }

.github/actions/prepare-check-outputs/action.yaml

@@ -53,38 +53,48 @@ runs:
     - name: Resolve outputs
       id: resolve
       shell: bash
+      env:
+        INPUT_REF: ${{ inputs.ref }}
+        INPUT_REPO: ${{ inputs.repo }}
+        INPUT_PR_BASE_SHA: ${{ inputs.pr-base-sha }}
+        INPUT_CHECKOUT_PATH: ${{ inputs.checkout-path }}
+        INPUT_BUILD_PATH: ${{ inputs.build-path }}
+        GET_PR_REF: ${{ steps.get_pr.outputs.ref }}
+        GET_PR_REPO: ${{ steps.get_pr.outputs.repo }}
+        GET_PR_BASE_SHA: ${{ steps.get_pr.outputs.base_sha }}
       run: |
-        REF="${{ inputs.ref }}"
-        REPO="${{ inputs.repo }}"
-        BASE_SHA="${{ inputs.pr-base-sha }}"
+        REF="${INPUT_REF}"
+        REPO="${INPUT_REPO}"
+        BASE_SHA="${INPUT_PR_BASE_SHA}"
         PR_NUMBER=""
 
-        if [ "${{ github.event_name }}" == "pull_request" ]; then
-          REF="${REF:-${{ github.sha }}}"
-          BASE_SHA="${BASE_SHA:-${{ github.event.pull_request.base.sha }}}"
-          PR_NUMBER="${{ github.event.pull_request.number }}"
-        elif [ "${{ github.event_name }}" == "issue_comment" ]; then
-          REF="${REF:-${{ steps.get_pr.outputs.ref }}}"
-          REPO="${REPO:-${{ steps.get_pr.outputs.repo }}}"
-          BASE_SHA="${BASE_SHA:-${{ steps.get_pr.outputs.base_sha }}}"
-          PR_NUMBER="${{ github.event.issue.number }}"
-        elif [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
-          REF="${REF:-${{ github.event.inputs.ref || github.ref }}}"
-          BASE_SHA="${BASE_SHA:-${{ github.event.before }}}"
+        if [ "${GITHUB_EVENT_NAME}" == "pull_request" ]; then
+          REF="${REF:-${GITHUB_SHA}}"
+          BASE_SHA="${BASE_SHA:-$(jq -r '.pull_request.base.sha // empty' "${GITHUB_EVENT_PATH}")}"
+          PR_NUMBER="$(jq -r '.pull_request.number // empty' "${GITHUB_EVENT_PATH}")"
+        elif [ "${GITHUB_EVENT_NAME}" == "issue_comment" ]; then
+          REF="${REF:-${GET_PR_REF}}"
+          REPO="${REPO:-${GET_PR_REPO}}"
+          BASE_SHA="${BASE_SHA:-${GET_PR_BASE_SHA}}"
+          PR_NUMBER="$(jq -r '.issue.number // empty' "${GITHUB_EVENT_PATH}")"
+        elif [ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]; then
+          REF="${REF:-$(jq -r '.inputs.ref // empty' "${GITHUB_EVENT_PATH}")}"
+          REF="${REF:-${GITHUB_REF}}"
+          BASE_SHA="${BASE_SHA:-$(jq -r '.before // empty' "${GITHUB_EVENT_PATH}")}"
         else
-          REF="${REF:-${{ github.sha }}}"
-          BASE_SHA="${BASE_SHA:-${{ github.event.before }}}"
+          REF="${REF:-${GITHUB_SHA}}"
+          BASE_SHA="${BASE_SHA:-$(jq -r '.before // empty' "${GITHUB_EVENT_PATH}")}"
         fi
 
-        REPO="${REPO:-${{ github.repository }}}"
+        REPO="${REPO:-${GITHUB_REPOSITORY}}"
         REPO_NAME="${REPO##*/}"
 
-        CHECKOUT_PATH="${{ inputs.checkout-path }}"
+        CHECKOUT_PATH="${INPUT_CHECKOUT_PATH}"
         if [ -z "$CHECKOUT_PATH" ]; then
           CHECKOUT_PATH="${REPO_NAME}-src"
         fi
 
-        BUILD_PATH="${{ inputs.build-path }}"
+        BUILD_PATH="${INPUT_BUILD_PATH}"
         if [ -z "$BUILD_PATH" ]; then
           BUILD_PATH="${REPO_NAME}-build"
         fi

.github/actions/prepare-fix-outputs/action.yaml

@@ -31,32 +31,37 @@ runs:
     - name: Resolve outputs
       id: resolve
       shell: bash
+      env:
+        INPUT_REF: ${{ inputs.ref }}
+        INPUT_REPO: ${{ inputs.repo }}
+        INPUT_CHECKOUT_PATH: ${{ inputs.checkout-path }}
+        GET_PR_REF: ${{ steps.get_pr.outputs.ref }}
+        GET_PR_REPO: ${{ steps.get_pr.outputs.repo }}
       run: |
-        REF="${{ inputs.ref }}"
-        REPO="${{ inputs.repo }}"
+        REF="${INPUT_REF}"
+        REPO="${INPUT_REPO}"
 
         if [ -z "$REF" ]; then
-          if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
-            REF="${{ github.event.inputs.ref || github.ref_name }}"
-          elif [ "${{ github.event_name }}" == "issue_comment" ]; then
-            REF="${{ steps.get_pr.outputs.ref }}"
+          if [ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]; then
+            REF="$(jq -r '.inputs.ref // empty' "${GITHUB_EVENT_PATH}")"
+            REF="${REF:-${GITHUB_REF_NAME}}"
+          elif [ "${GITHUB_EVENT_NAME}" == "issue_comment" ]; then
+            REF="${GET_PR_REF}"
           else
-            REF="${{ github.ref_name }}"
+            REF="${GITHUB_REF_NAME}"
           fi
         fi
 
         if [ -z "$REPO" ]; then
-          if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
-            REPO="${{ github.repository }}"
-          elif [ "${{ github.event_name }}" == "issue_comment" ]; then
-            REPO="${{ steps.get_pr.outputs.repo }}"
+          if [ "${GITHUB_EVENT_NAME}" == "issue_comment" ]; then
+            REPO="${GET_PR_REPO}"
           else
-            REPO="${{ github.repository }}"
+            REPO="${GITHUB_REPOSITORY}"
           fi
         fi
 
         REPO_NAME="${REPO##*/}"
-        CHECKOUT_PATH="${{ inputs.checkout-path }}"
+        CHECKOUT_PATH="${INPUT_CHECKOUT_PATH}"
         if [ -z "$CHECKOUT_PATH" ]; then
           CHECKOUT_PATH="${REPO_NAME}-src"
         fi

.github/actions/run-change-detection/action.yaml

@@ -44,6 +44,7 @@ runs:
         path: ${{ inputs.checkout-path }}
         ref: ${{ inputs.ref }}
         repository: ${{ inputs.repo }}
+        persist-credentials: false
 
     - name: Detect relevant changes
       id: filter
@@ -58,11 +59,15 @@ runs:
 
     - name: Report detection outcome
       shell: bash
+      env:
+        FILTER_MATCHED: ${{ steps.filter.outputs.matched }}
+        FILTER_MATCHED_FILES: ${{ steps.filter.outputs.matched_files }}
+        INPUT_FILE_TYPE: ${{ inputs.file-type }}
       run: |
-        if [ "${{ steps.filter.outputs.matched }}" != "true" ]; then
-          echo "::notice::No relevant changes detected for ${{ inputs.file-type || 'custom globs' }}; job will be skipped."
+        if [ "${FILTER_MATCHED}" != "true" ]; then
+          echo "::notice::No relevant changes detected for ${INPUT_FILE_TYPE:-custom globs}; job will be skipped."
         else
           echo "::group::Relevant files detected"
-          printf '%s\n' "${{ steps.filter.outputs.matched_files }}"
+          printf '%s\n' "${FILTER_MATCHED_FILES}"
           echo "::endgroup::"
         fi

.github/actions/workflow-setup/action.yaml

@@ -85,25 +85,37 @@ runs:
     - name: Standardize outputs
       id: prepare
       shell: bash
+      env:
+        INPUT_MODE: ${{ inputs.mode }}
+        INPUT_BUILD_PATH: ${{ inputs.build-path }}
+        CHECK_IS_ACT: ${{ steps.prepare_check.outputs.is_act }}
+        CHECK_REF: ${{ steps.prepare_check.outputs.ref }}
+        CHECK_REPO: ${{ steps.prepare_check.outputs.repo }}
+        CHECK_BASE_SHA: ${{ steps.prepare_check.outputs.base_sha }}
+        CHECK_PR_NUMBER: ${{ steps.prepare_check.outputs.pr_number }}
+        CHECK_CHECKOUT_PATH: ${{ steps.prepare_check.outputs.checkout_path }}
+        CHECK_BUILD_PATH: ${{ steps.prepare_check.outputs.build_path }}
+        FIX_REF: ${{ steps.prepare_fix.outputs.ref }}
+        FIX_REPO: ${{ steps.prepare_fix.outputs.repo }}
+        FIX_CHECKOUT_PATH: ${{ steps.prepare_fix.outputs.checkout_path }}
       run: |
-        if [ "${{ inputs.mode }}" == "check" ]; then
-          echo "is_act=${{ steps.prepare_check.outputs.is_act }}" >> "$GITHUB_OUTPUT"
-          echo "ref=${{ steps.prepare_check.outputs.ref }}" >> "$GITHUB_OUTPUT"
-          echo "repo=${{ steps.prepare_check.outputs.repo }}" >> "$GITHUB_OUTPUT"
-          echo "base_sha=${{ steps.prepare_check.outputs.base_sha }}" >> "$GITHUB_OUTPUT"
-          echo "pr_number=${{ steps.prepare_check.outputs.pr_number }}" >> "$GITHUB_OUTPUT"
-          echo "checkout_path=${{ steps.prepare_check.outputs.checkout_path }}" >> "$GITHUB_OUTPUT"
-          echo "build_path=${{ steps.prepare_check.outputs.build_path }}" >> "$GITHUB_OUTPUT"
+        if [ "${INPUT_MODE}" == "check" ]; then
+          echo "is_act=${CHECK_IS_ACT}" >> "$GITHUB_OUTPUT"
+          echo "ref=${CHECK_REF}" >> "$GITHUB_OUTPUT"
+          echo "repo=${CHECK_REPO}" >> "$GITHUB_OUTPUT"
+          echo "base_sha=${CHECK_BASE_SHA}" >> "$GITHUB_OUTPUT"
+          echo "pr_number=${CHECK_PR_NUMBER}" >> "$GITHUB_OUTPUT"
+          echo "checkout_path=${CHECK_CHECKOUT_PATH}" >> "$GITHUB_OUTPUT"
+          echo "build_path=${CHECK_BUILD_PATH}" >> "$GITHUB_OUTPUT"
         else
           echo "is_act=false" >> "$GITHUB_OUTPUT"
-          echo "ref=${{ steps.prepare_fix.outputs.ref }}" >> "$GITHUB_OUTPUT"
-          echo "repo=${{ steps.prepare_fix.outputs.repo }}" >> "$GITHUB_OUTPUT"
+          echo "ref=${FIX_REF}" >> "$GITHUB_OUTPUT"
+          echo "repo=${FIX_REPO}" >> "$GITHUB_OUTPUT"
           echo "base_sha=" >> "$GITHUB_OUTPUT"
-          echo "pr_number=${{ github.event.issue.number }}" >> "$GITHUB_OUTPUT"
-          echo "checkout_path=${{ steps.prepare_fix.outputs.checkout_path }}" >> "$GITHUB_OUTPUT"
-          CHECKOUT_PATH="${{ steps.prepare_fix.outputs.checkout_path }}"
-          REPO_NAME="${CHECKOUT_PATH%-src}"
-          BUILD_PATH="${{ inputs.build-path }}"
+          echo "pr_number=$(jq -r '.issue.number // empty' "${GITHUB_EVENT_PATH}")" >> "$GITHUB_OUTPUT"
+          echo "checkout_path=${FIX_CHECKOUT_PATH}" >> "$GITHUB_OUTPUT"
+          REPO_NAME="${FIX_CHECKOUT_PATH%-src}"
+          BUILD_PATH="${INPUT_BUILD_PATH}"
           if [ -z "$BUILD_PATH" ]; then
             BUILD_PATH="${REPO_NAME}-build"
           fi
@@ -127,10 +139,21 @@ runs:
     - name: Set has_changes output
       id: changes
       shell: bash
+      env:
+        IS_ACT: ${{ steps.prepare.outputs.is_act }}
+        INPUT_FILE_TYPE: ${{ inputs.file-type }}
+        INPUT_INCLUDE_GLOBS: ${{ inputs.include-globs }}
+        DETECT_HAS_CHANGES: ${{ steps.detect.outputs.has_changes }}
       run: |
-        if [ "${{ steps.prepare.outputs.is_act }}" = "true" ] && \
-           ([ "${{ inputs.file-type }}" != "" ] || [ "${{ inputs.include-globs }}" != "" ]); then
+        if [ "${IS_ACT}" = "true" ] && \
+           ([ "${INPUT_FILE_TYPE}" != "" ] || [ "${INPUT_INCLUDE_GLOBS}" != "" ]); then
+          echo "has_changes=true" >> "$GITHUB_OUTPUT"
+        elif [ "${INPUT_FILE_TYPE}" = "" ] && [ "${INPUT_INCLUDE_GLOBS}" = "" ]; then
           echo "has_changes=true" >> "$GITHUB_OUTPUT"
         else
-          echo "has_changes=${{ steps.detect.outputs.has_changes }}" >> "$GITHUB_OUTPUT"
+          if [ -z "${DETECT_HAS_CHANGES}" ]; then
+            echo "has_changes=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "has_changes=${DETECT_HAS_CHANGES}" >> "$GITHUB_OUTPUT"
+          fi
         fi

.github/workflows/clang-format-fix.yaml

@@ -30,8 +30,8 @@ run-name: "${{ github.actor }} fixing C++ code format"
       skip-comment:
         description: "Skip posting PR comments"
         required: false
-        type: string
-        default: "false"
+        type: boolean
+        default: false
     outputs:
       changes:
         description: "Whether any fixes were applied"
@@ -114,10 +114,10 @@ jobs:
           token: ${{ secrets.WORKFLOW_PAT }}
           pr-info-ref: ${{ needs.setup.outputs.ref }}
           pr-info-repo: ${{ needs.setup.outputs.repo }}
-          skip-comment: ${{ inputs.skip-comment || 'false' }}
+          skip-comment: ${{ inputs.skip-comment }}
 
       - name: Update PR comment reactions
-        if: always() && github.event_name == 'issue_comment' && inputs.skip-comment != 'true'
+        if: always() && github.event_name == 'issue_comment' && !inputs.skip-comment
         uses: Framework-R-D/phlex/.github/actions/complete-pr-comment@main
         with:
           status: ${{ job.status }}

.github/workflows/clang-tidy-fix.yaml

@@ -41,6 +41,7 @@ jobs:
       repo: ${{ steps.setup.outputs.repo }}
       checkout_path: ${{ steps.setup.outputs.checkout_path }}
       build_path: ${{ steps.setup.outputs.build_path }}
+      pr_number: ${{ steps.setup.outputs.pr_number }}
       tidy_checks:
         ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.tidy-checks ||
         steps.parse_comment.outputs.tidy_checks }}

.github/workflows/cmake-format-fix.yaml

@@ -30,8 +30,8 @@ run-name: "${{ github.actor }} fixing CMake format"
       skip-comment:
         description: "Skip posting PR comments"
         required: false
-        type: string
-        default: "false"
+        type: boolean
+        default: false
     outputs:
       changes:
         description: "Whether any fixes were applied"
@@ -121,10 +121,10 @@ jobs:
           token: ${{ secrets.WORKFLOW_PAT }}
           pr-info-ref: ${{ needs.setup.outputs.ref }}
           pr-info-repo: ${{ needs.setup.outputs.repo }}
-          skip-comment: ${{ inputs.skip-comment || 'false' }}
+          skip-comment: ${{ inputs.skip-comment }}
 
       - name: Update PR comment reactions
-        if: always() && github.event_name == 'issue_comment' && inputs.skip-comment != 'true'
+        if: always() && github.event_name == 'issue_comment' && !inputs.skip-comment
         uses: Framework-R-D/phlex/.github/actions/complete-pr-comment@main
         with:
           status: ${{ job.status }}

.github/workflows/coverage.yaml

@@ -14,6 +14,14 @@ run-name: "${{ github.actor }} running code coverage"
         description: "The branch, ref, or SHA to checkout. Defaults to the repository's default branch."
         required: false
         type: string
+      repo:
+        description: "The repository to checkout. Defaults to the current repository."
+        required: false
+        type: string
+      pr-base-sha:
+        description: "The base SHA for diffing (PR base). Defaults to event-provided value."
+        required: false
+        type: string
       phlex-coverage-compiler:
         description: "Compiler to use for coverage build (gcc or clang)"
         required: false