Skip to content

[BUG]: Auto-fix for template-injection overcorrects on env.FOO fixes #1052

@woodruffw

Description

@woodruffw

Pre-submission checks

  • I am not filing a feature request. These should be filed via the feature request form instead.
  • I have looked through the open issues for a duplicate report.

zizmor version

1.11.0

Expected behavior

Here's a pretty common pattern we currently flag:

run: echo ${{ env.FOO }}
env:
  FOO: blah blah

This should be auto-fixed as:

run: echo ${FOO}
env:
  FOO: blah blah

Actual behavior

Instead, we overcorrect by replacing the original FOO: value with its ${{ env.FOO }} expansion, which results in an empty expansion (unless the user has FOO set somewhere higher up):

run: echo ${FOO}
env:
  FOO: ${{ env.FOO }}

The trick here is probably to special-case the env. context namespace and not perform an env: block insertion in that case.

Reproduction steps

See above.

Logs

N/A

Additional context

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    autofixAuto-fix functionalitybugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions