Skip to content

fix(actions): install CLI via raw URL, not github.action_path #30

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
stephane-segning merged 1 commit into from
Jun 30, 2026
Merged

fix(actions): install CLI via raw URL, not github.action_path #30

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 10 additions & 1 deletion actions/android-build/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,16 @@ runs:
steps:
- id: install
shell: bash
run: bash "${{ github.action_path }}/../../scripts/install-cli.sh"
env:
FT_REF: ${{ github.action_ref }}
Comment on lines +48 to +49

@gemini-code-assist gemini-code-assist Bot Jun 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

When the action is run within the same repository (such as in the repository's own CI/CD workflows or during local testing), github.action_ref is empty. This causes the curl command to attempt to fetch from an invalid URL (with a double slash and no ref), resulting in a 404 error and failing the step. Falling back to github.sha when github.action_ref is empty ensures that the action remains functional and always fetches the correct version of the script corresponding to the commit being tested.

      env:
        FT_REF: ${{ github.action_ref || github.sha }}

run: |
set -euo pipefail
# github.action_path is NOT translated into the container by the GH
# runner under podman → a path-based call ENOENTs. Fetch the installer
# from the pinned ref (container/runtime-agnostic).
curl --fail --silent --show-error --location --retry 3 \
"https://raw.githubusercontent.com/vymalo/flutter-tools/${FT_REF}/scripts/install-cli.sh" \
| bash -s --

- id: build
shell: bash
Expand Down
11 changes: 10 additions & 1 deletion actions/android-setup/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,7 +70,16 @@ runs:
if: ${{ inputs.run-codegen == 'true' }}
id: install
shell: bash
run: bash "${{ github.action_path }}/../../scripts/install-cli.sh"
env:
FT_REF: ${{ github.action_ref }}
Comment on lines +73 to +74

@gemini-code-assist gemini-code-assist Bot Jun 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

When the action is run within the same repository (such as in the repository's own CI/CD workflows or during local testing), github.action_ref is empty. This causes the curl command to attempt to fetch from an invalid URL (with a double slash and no ref), resulting in a 404 error and failing the step. Falling back to github.sha when github.action_ref is empty ensures that the action remains functional and always fetches the correct version of the script corresponding to the commit being tested.

      env:
        FT_REF: ${{ github.action_ref || github.sha }}

run: |
set -euo pipefail
# github.action_path is NOT translated into the container by the GH
# runner under podman → a path-based call ENOENTs. Fetch the installer
# from the pinned ref (container/runtime-agnostic).
curl --fail --silent --show-error --location --retry 3 \
"https://raw.githubusercontent.com/vymalo/flutter-tools/${FT_REF}/scripts/install-cli.sh" \
| bash -s --

- name: Layered codegen
if: ${{ inputs.run-codegen == 'true' }}
Expand Down
11 changes: 10 additions & 1 deletion actions/app-store-submit/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,16 @@ runs:

- id: install
shell: bash
run: bash "${{ github.action_path }}/../../scripts/install-cli.sh"
env:
FT_REF: ${{ github.action_ref }}
Comment on lines +50 to +51

@gemini-code-assist gemini-code-assist Bot Jun 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

When the action is run within the same repository (such as in the repository's own CI/CD workflows or during local testing), github.action_ref is empty. This causes the curl command to attempt to fetch from an invalid URL (with a double slash and no ref), resulting in a 404 error and failing the step. Falling back to github.sha when github.action_ref is empty ensures that the action remains functional and always fetches the correct version of the script corresponding to the commit being tested.

      env:
        FT_REF: ${{ github.action_ref || github.sha }}

run: |
set -euo pipefail
# github.action_path is NOT translated into the container by the GH
# runner under podman → a path-based call ENOENTs. Fetch the installer
# from the pinned ref (container/runtime-agnostic).
curl --fail --silent --show-error --location --retry 3 \
"https://raw.githubusercontent.com/vymalo/flutter-tools/${FT_REF}/scripts/install-cli.sh" \
| bash -s --

- shell: bash
env:
Expand Down
11 changes: 10 additions & 1 deletion actions/artifact-upload/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,7 +90,16 @@ runs:
- id: install
if: ${{ inputs.to-s3 == 'true' }}
shell: bash
run: bash "${{ github.action_path }}/../../scripts/install-cli.sh"
env:
FT_REF: ${{ github.action_ref }}
Comment on lines +93 to +94

@gemini-code-assist gemini-code-assist Bot Jun 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

When the action is run within the same repository (such as in the repository's own CI/CD workflows or during local testing), github.action_ref is empty. This causes the curl command to attempt to fetch from an invalid URL (with a double slash and no ref), resulting in a 404 error and failing the step. Falling back to github.sha when github.action_ref is empty ensures that the action remains functional and always fetches the correct version of the script corresponding to the commit being tested.

      env:
        FT_REF: ${{ github.action_ref || github.sha }}

run: |
set -euo pipefail
# github.action_path is NOT translated into the container by the GH
# runner under podman → a path-based call ENOENTs. Fetch the installer
# from the pinned ref (container/runtime-agnostic).
curl --fail --silent --show-error --location --retry 3 \
"https://raw.githubusercontent.com/vymalo/flutter-tools/${FT_REF}/scripts/install-cli.sh" \
| bash -s --

- id: s3
if: ${{ inputs.to-s3 == 'true' }}
Expand Down
11 changes: 10 additions & 1 deletion actions/codegen/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,7 +71,16 @@ runs:
- name: Install flutter-tools CLI
id: install
shell: bash
run: bash "${{ github.action_path }}/../../scripts/install-cli.sh"
env:
FT_REF: ${{ github.action_ref }}
Comment on lines +74 to +75

@gemini-code-assist gemini-code-assist Bot Jun 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

When the action is run within the same repository (such as in the repository's own CI/CD workflows or during local testing), github.action_ref is empty. This causes the curl command to attempt to fetch from an invalid URL (with a double slash and no ref), resulting in a 404 error and failing the step. Falling back to github.sha when github.action_ref is empty ensures that the action remains functional and always fetches the correct version of the script corresponding to the commit being tested.

      env:
        FT_REF: ${{ github.action_ref || github.sha }}

run: |
set -euo pipefail
# github.action_path is NOT translated into the container by the GH
# runner under podman → a path-based call ENOENTs. Fetch the installer
# from the pinned ref (container/runtime-agnostic).
curl --fail --silent --show-error --location --retry 3 \
"https://raw.githubusercontent.com/vymalo/flutter-tools/${FT_REF}/scripts/install-cli.sh" \

@chatgpt-codex-connector chatgpt-codex-connector Bot Jun 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Keep installer fetch bound to the loaded action

When consumers pin a mutable action ref such as @v0 or a branch, github.action_ref is the symbolic ref, so this curl re-resolves it instead of using the action checkout that is already running. If that ref moves while earlier steps in this composite are still running (for example the Flutter/Java setup above), the action metadata can come from one commit while install-cli.sh/cli-version.txt come from another, which can install an incompatible CLI version or fail on a not-yet-published binary. Fetch using an immutable resolved revision or otherwise keep the installer version bound to the loaded action.

Useful? React with 👍 / 👎.

| bash -s --

- name: Run layered codegen
shell: bash
Expand Down
11 changes: 10 additions & 1 deletion actions/ensure-cli/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,4 +23,13 @@ runs:
steps:
- id: install
shell: bash
run: bash "${{ github.action_path }}/../../scripts/install-cli.sh" "${{ inputs.version }}"
env:
FT_REF: ${{ github.action_ref }}
Comment on lines +26 to +27

@gemini-code-assist gemini-code-assist Bot Jun 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

When the action is run within the same repository (such as in the repository's own CI/CD workflows or during local testing), github.action_ref is empty. This causes the curl command to attempt to fetch from an invalid URL (with a double slash and no ref), resulting in a 404 error and failing the step. Falling back to github.sha when github.action_ref is empty ensures that the action remains functional and always fetches the correct version of the script corresponding to the commit being tested.

      env:
        FT_REF: ${{ github.action_ref || github.sha }}

run: |
set -euo pipefail
# github.action_path is NOT translated into the container by the GH
# runner under podman → a path-based call ENOENTs. Fetch the installer
# from the pinned ref (container/runtime-agnostic).
curl --fail --silent --show-error --location --retry 3 \
"https://raw.githubusercontent.com/vymalo/flutter-tools/${FT_REF}/scripts/install-cli.sh" \

@chatgpt-codex-connector chatgpt-codex-connector Bot Jun 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Use the action repository when fetching the installer

When a workflow consumes this action from a fork or from a ref/SHA that only exists outside vymalo/flutter-tools (for example to test action changes before they are merged upstream), github.action_ref is only the ref name while this URL always fetches from the upstream repository. The previous github.action_path version read install-cli.sh from the actual checked-out action, but this now 404s before the CLI can install; the same hard-coded raw URL pattern is repeated in the other action metadata files. Pass/use github.action_repository for the raw URL instead of hard-coding the owner/repo.

Useful? React with 👍 / 👎.

| bash -s -- "${{ inputs.version }}"
11 changes: 10 additions & 1 deletion actions/ios-build/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,16 @@ runs:
steps:
- id: install
shell: bash
run: bash "${{ github.action_path }}/../../scripts/install-cli.sh"
env:
FT_REF: ${{ github.action_ref }}
Comment on lines +46 to +47

@gemini-code-assist gemini-code-assist Bot Jun 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

When the action is run within the same repository (such as in the repository's own CI/CD workflows or during local testing), github.action_ref is empty. This causes the curl command to attempt to fetch from an invalid URL (with a double slash and no ref), resulting in a 404 error and failing the step. Falling back to github.sha when github.action_ref is empty ensures that the action remains functional and always fetches the correct version of the script corresponding to the commit being tested.

      env:
        FT_REF: ${{ github.action_ref || github.sha }}

run: |
set -euo pipefail
# github.action_path is NOT translated into the container by the GH
# runner under podman → a path-based call ENOENTs. Fetch the installer
# from the pinned ref (container/runtime-agnostic).
curl --fail --silent --show-error --location --retry 3 \
"https://raw.githubusercontent.com/vymalo/flutter-tools/${FT_REF}/scripts/install-cli.sh" \
| bash -s --

- id: build
shell: bash
Expand Down
11 changes: 10 additions & 1 deletion actions/ios-setup/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,16 @@ runs:
if: ${{ inputs.run-codegen == 'true' }}
id: install
shell: bash
run: bash "${{ github.action_path }}/../../scripts/install-cli.sh"
env:
FT_REF: ${{ github.action_ref }}
Comment on lines +56 to +57

@gemini-code-assist gemini-code-assist Bot Jun 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

When the action is run within the same repository (such as in the repository's own CI/CD workflows or during local testing), github.action_ref is empty. This causes the curl command to attempt to fetch from an invalid URL (with a double slash and no ref), resulting in a 404 error and failing the step. Falling back to github.sha when github.action_ref is empty ensures that the action remains functional and always fetches the correct version of the script corresponding to the commit being tested.

      env:
        FT_REF: ${{ github.action_ref || github.sha }}

run: |
set -euo pipefail
# github.action_path is NOT translated into the container by the GH
# runner under podman → a path-based call ENOENTs. Fetch the installer
# from the pinned ref (container/runtime-agnostic).
curl --fail --silent --show-error --location --retry 3 \
"https://raw.githubusercontent.com/vymalo/flutter-tools/${FT_REF}/scripts/install-cli.sh" \
| bash -s --

- name: Layered codegen
if: ${{ inputs.run-codegen == 'true' }}
Expand Down
11 changes: 10 additions & 1 deletion actions/play-submit/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,16 @@ runs:

- id: install
shell: bash
run: bash "${{ github.action_path }}/../../scripts/install-cli.sh"
env:
FT_REF: ${{ github.action_ref }}
Comment on lines +53 to +54

@gemini-code-assist gemini-code-assist Bot Jun 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

When the action is run within the same repository (such as in the repository's own CI/CD workflows or during local testing), github.action_ref is empty. This causes the curl command to attempt to fetch from an invalid URL (with a double slash and no ref), resulting in a 404 error and failing the step. Falling back to github.sha when github.action_ref is empty ensures that the action remains functional and always fetches the correct version of the script corresponding to the commit being tested.

      env:
        FT_REF: ${{ github.action_ref || github.sha }}

run: |
set -euo pipefail
# github.action_path is NOT translated into the container by the GH
# runner under podman → a path-based call ENOENTs. Fetch the installer
# from the pinned ref (container/runtime-agnostic).
curl --fail --silent --show-error --location --retry 3 \
"https://raw.githubusercontent.com/vymalo/flutter-tools/${FT_REF}/scripts/install-cli.sh" \
| bash -s --

- name: Upload to Play
shell: bash
Expand Down
11 changes: 10 additions & 1 deletion actions/release-cut/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,16 @@ runs:
steps:
- id: install
shell: bash
run: bash "${{ github.action_path }}/../../scripts/install-cli.sh"
env:
FT_REF: ${{ github.action_ref }}
Comment on lines +47 to +48

@gemini-code-assist gemini-code-assist Bot Jun 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

When the action is run within the same repository (such as in the repository's own CI/CD workflows or during local testing), github.action_ref is empty. This causes the curl command to attempt to fetch from an invalid URL (with a double slash and no ref), resulting in a 404 error and failing the step. Falling back to github.sha when github.action_ref is empty ensures that the action remains functional and always fetches the correct version of the script corresponding to the commit being tested.

      env:
        FT_REF: ${{ github.action_ref || github.sha }}

run: |
set -euo pipefail
# github.action_path is NOT translated into the container by the GH
# runner under podman → a path-based call ENOENTs. Fetch the installer
# from the pinned ref (container/runtime-agnostic).
curl --fail --silent --show-error --location --retry 3 \
"https://raw.githubusercontent.com/vymalo/flutter-tools/${FT_REF}/scripts/install-cli.sh" \
| bash -s --

- id: compute
shell: bash
Expand Down
11 changes: 10 additions & 1 deletion actions/screenshots/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,16 @@ runs:
steps:
- id: install
shell: bash
run: bash "${{ github.action_path }}/../../scripts/install-cli.sh"
env:
FT_REF: ${{ github.action_ref }}
Comment on lines +63 to +64

@gemini-code-assist gemini-code-assist Bot Jun 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

When the action is run within the same repository (such as in the repository's own CI/CD workflows or during local testing), github.action_ref is empty. This causes the curl command to attempt to fetch from an invalid URL (with a double slash and no ref), resulting in a 404 error and failing the step. Falling back to github.sha when github.action_ref is empty ensures that the action remains functional and always fetches the correct version of the script corresponding to the commit being tested.

      env:
        FT_REF: ${{ github.action_ref || github.sha }}

run: |
set -euo pipefail
# github.action_path is NOT translated into the container by the GH
# runner under podman → a path-based call ENOENTs. Fetch the installer
# from the pinned ref (container/runtime-agnostic).
curl --fail --silent --show-error --location --retry 3 \
"https://raw.githubusercontent.com/vymalo/flutter-tools/${FT_REF}/scripts/install-cli.sh" \
| bash -s --

- id: shots
shell: bash
Expand Down
11 changes: 10 additions & 1 deletion actions/testflight-submit/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,16 @@ runs:

- id: install
shell: bash
run: bash "${{ github.action_path }}/../../scripts/install-cli.sh"
env:
FT_REF: ${{ github.action_ref }}
Comment on lines +37 to +38

@gemini-code-assist gemini-code-assist Bot Jun 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

When the action is run within the same repository (such as in the repository's own CI/CD workflows or during local testing), github.action_ref is empty. This causes the curl command to attempt to fetch from an invalid URL (with a double slash and no ref), resulting in a 404 error and failing the step. Falling back to github.sha when github.action_ref is empty ensures that the action remains functional and always fetches the correct version of the script corresponding to the commit being tested.

      env:
        FT_REF: ${{ github.action_ref || github.sha }}

run: |
set -euo pipefail
# github.action_path is NOT translated into the container by the GH
# runner under podman → a path-based call ENOENTs. Fetch the installer
# from the pinned ref (container/runtime-agnostic).
curl --fail --silent --show-error --location --retry 3 \
"https://raw.githubusercontent.com/vymalo/flutter-tools/${FT_REF}/scripts/install-cli.sh" \
| bash -s --

- shell: bash
env:
Expand Down
11 changes: 10 additions & 1 deletion actions/version-stamp/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,16 @@ runs:
# step so its $GITHUB_OUTPUT path is readable by the stamp step below.
- id: install
shell: bash
run: bash "${{ github.action_path }}/../../scripts/install-cli.sh"
env:
FT_REF: ${{ github.action_ref }}
Comment on lines +43 to +44

@gemini-code-assist gemini-code-assist Bot Jun 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

When the action is run within the same repository (such as in the repository's own CI/CD workflows or during local testing), github.action_ref is empty. This causes the curl command to attempt to fetch from an invalid URL (with a double slash and no ref), resulting in a 404 error and failing the step. Falling back to github.sha when github.action_ref is empty ensures that the action remains functional and always fetches the correct version of the script corresponding to the commit being tested.

      env:
        FT_REF: ${{ github.action_ref || github.sha }}

run: |
set -euo pipefail
# github.action_path is NOT translated into the container by the GH
# runner under podman → a path-based call ENOENTs. Fetch the installer
# from the pinned ref (container/runtime-agnostic).
curl --fail --silent --show-error --location --retry 3 \
"https://raw.githubusercontent.com/vymalo/flutter-tools/${FT_REF}/scripts/install-cli.sh" \
| bash -s --
- id: stamp
shell: bash
env:
Expand Down
22 changes: 19 additions & 3 deletions scripts/install-cli.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,12 +16,28 @@ set -euo pipefail

REPO="vymalo/flutter-tools"

script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
repo_root="$(cd "$script_dir/.." && pwd)"
# When piped from stdin (curl | bash) there is no on-disk checkout, so BASH_SOURCE
# is unreliable — fall back to "." and guard every repo-relative read below.
script_dir="$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" 2>/dev/null && pwd || echo .)"

@gemini-code-assist gemini-code-assist Bot Jun 30, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

When install-cli.sh is piped from stdin, BASH_SOURCE is empty, so the script falls back to $0. If $0 starts with a hyphen (for example, in a login shell like -bash), dirname will treat it as an option and fail with an invalid option error. Using -- before the argument prevents dirname from interpreting it as an option.

Suggested change
script_dir="$(cd "$(dirname "${BASH_SOURCE[0]:-$0}")" 2>/dev/null && pwd || echo .)"
script_dir="$(cd "$(dirname -- "${BASH_SOURCE[0]:-$0}")" 2>/dev/null && pwd || echo .)"

repo_root="$(cd "$script_dir/.." 2>/dev/null && pwd || echo .)"

# Last-resort version when neither an arg, CLI_VERSION, an on-disk cli-version.txt,
# nor FT_REF is available. Keep in sync with cli-version.txt.
DEFAULT_CLI_VERSION="0.1.0"

# Version precedence: explicit arg / CLI_VERSION → on-disk cli-version.txt (normal
# checkout) → cli-version.txt fetched from the action ref (curl-pipe; FT_REF set by
# the calling action = github.action_ref) → baked default.
version="${1:-${CLI_VERSION:-}}"
if [ -z "$version" ]; then
version="$(tr -d ' \t\n\r' < "$repo_root/cli-version.txt")"
if [ -f "$repo_root/cli-version.txt" ]; then
version="$(tr -d ' \t\n\r' < "$repo_root/cli-version.txt")"
elif [ -n "${FT_REF:-}" ]; then
version="$(curl --fail --silent --show-error --location --retry 3 \
"https://raw.githubusercontent.com/${REPO}/${FT_REF}/cli-version.txt" | tr -d ' \t\n\r')"
else
version="$DEFAULT_CLI_VERSION"
fi
fi
# Tolerate a leading `cli-v` / `v` so `v0.1.0` or `cli-v0.1.0` also resolve.
version="${version#cli-v}"
Expand Down