In latest feature branch, we currently run shell commands using 3 different approaches:
Standard GitHub run: step
internal/run action
internal/run-script action
The internal/run-script action allows for post-job cleanup, for example for fcli session logouts, so we'll want to keep this.
The internal/run action was initially meant to properly handle multi-argument environment variables like EXTRA_*_OPTS, also in an attempt to avoid command injection (i.e., having something like && bad-command in such an environment variable). However, not sure whether command injection is possible if such commands are executed through regular run: steps, and there seem to be some issues with proper quote handling in this action-based approach.
Ideally, if possible, we should get rid of the internal/run action, or if this functionality is needed for any reason, see whether we can combine both internal/run and internal/run-script actions in a single action (potentially with different inputs to select between running plain commands or a script).
Potentially, for consistency, some or all of the existing shell commands could be moved to a shell script which is then run using either regular run: step or the internal/run-script action.
Enhancement Request
In latest feature branch, we currently run shell commands using 3 different approaches:
run:stepinternal/runactioninternal/run-scriptactionThe
internal/run-scriptaction allows for post-job cleanup, for example for fcli session logouts, so we'll want to keep this.The
internal/runaction was initially meant to properly handle multi-argument environment variables likeEXTRA_*_OPTS, also in an attempt to avoid command injection (i.e., having something like&& bad-commandin such an environment variable). However, not sure whether command injection is possible if such commands are executed through regularrun:steps, and there seem to be some issues with proper quote handling in this action-based approach.Ideally, if possible, we should get rid of the
internal/runaction, or if this functionality is needed for any reason, see whether we can combine bothinternal/runandinternal/run-scriptactions in a single action (potentially with different inputs to select between running plain commands or a script).Potentially, for consistency, some or all of the existing shell commands could be moved to a shell script which is then run using either regular
run:step or theinternal/run-scriptaction.