Skip to content

Enhance support of cache-dependency-paths outside the current directory - #2

Open
v-priya-kinthali wants to merge 6 commits into
update-e2e-freethreadfrom
sample-361
Open

Enhance support of cache-dependency-paths outside the current directory#2
v-priya-kinthali wants to merge 6 commits into
update-e2e-freethreadfrom
sample-361

Conversation

@v-priya-kinthali

@v-priya-kinthali v-priya-kinthali commented Jul 25, 2025

Copy link
Copy Markdown
Owner

Description:
This PR support cache-dependency-paths that are located outside the current directory, which is needed when building composite Actions.

Related issue:
setup-python#361

Check list:

  • Mark if documentation changes are required.
  • Mark if tests were added or updated to cover the changes.

github-advanced-security[bot]
github-advanced-security AI found potential problems Jul 25, 2025
View reviewed changes
Comment thread dist/setup/index.js
const baseDir = filePath.startsWith('**')
? process.cwd()
: path.dirname(filePath.replace(/\*\*\/?/, ''));
const pattern = path.basename(filePath).replace('*', '.*');

Check failure

Code scanning / CodeQL

Incomplete string escaping or encoding

This replaces only the first occurrence of '*'.

Copilot Autofix

AI about 1 year ago

Copilot could not generate an autofix suggestion

Copilot could not generate an autofix suggestion for this alert. Try pushing a new commit or if the problem persists contact support.

Comment thread src/setup-python.ts
Comment on lines +47 to +53
'^' +
pattern
.replace(/\*\*/g, '.*')
.replace(/\*/g, '[^/]*')
.replace(/(\w+)\*/g, '$1(-[^/]+)?')
.replace(/\.(\w+)$/, '(\\.[^/]+)?') +
'$'

Check failure

Code scanning / CodeQL

Regular expression injection

This regular expression is constructed from a [GitHub Actions user input](1).

Copilot Autofix

AI about 1 year ago

To fix the issue, we need to sanitize the user input before embedding it into the regular expression. The best way to achieve this is by using a library like lodash and its _.escapeRegExp function, which escapes special characters in a string to make it safe for use in a regular expression. This ensures that any user-provided input cannot alter the intended behavior of the regular expression.

The fix involves:

  1. Importing the lodash library.
  2. Using _.escapeRegExp to sanitize the pattern variable before embedding it into the regular expression on line 47.
Suggested changeset 2
src/setup-python.ts

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/src/setup-python.ts b/src/setup-python.ts
--- a/src/setup-python.ts
+++ b/src/setup-python.ts
@@ -1,2 +1,3 @@
 import * as core from '@actions/core';
+import _ from 'lodash';
 import * as finder from './find-python';
@@ -45,5 +46,6 @@
         const entries = fs.readdirSync(dir, {withFileTypes: true});
+        const sanitizedPattern = _.escapeRegExp(pattern);
         const regexPattern = new RegExp(
           '^' +
-            pattern
+            sanitizedPattern
               .replace(/\*\*/g, '.*')
EOF
@@ -1,2 +1,3 @@
import * as core from '@actions/core';
import _ from 'lodash';
import * as finder from './find-python';
@@ -45,5 +46,6 @@
const entries = fs.readdirSync(dir, {withFileTypes: true});
const sanitizedPattern = _.escapeRegExp(pattern);
const regexPattern = new RegExp(
'^' +
pattern
sanitizedPattern
.replace(/\*\*/g, '.*')
package.json
Outside changed files

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/package.json b/package.json
--- a/package.json
+++ b/package.json
@@ -35,3 +35,4 @@
     "@iarna/toml": "^3.0.0",
-    "semver": "^7.6.0"
+    "semver": "^7.6.0",
+    "lodash": "^4.17.21"
   },
EOF
@@ -35,3 +35,4 @@
"@iarna/toml": "^3.0.0",
"semver": "^7.6.0"
"semver": "^7.6.0",
"lodash": "^4.17.21"
},
This fix introduces these dependencies
Package Version Security advisories
lodash (npm) 4.17.21 None
Copilot is powered by AI and may make mistakes. Always verify output.
Comment thread src/setup-python.ts
const baseDir = filePath.startsWith('**')
? process.cwd()
: path.dirname(filePath.replace(/\*\*\/?/, ''));
const pattern = path.basename(filePath).replace('*', '.*');

Check failure

Code scanning / CodeQL

Incomplete string escaping or encoding

This replaces only the first occurrence of '*'.

Copilot Autofix

AI about 1 year ago

To fix the issue, we need to ensure that all occurrences of '*' in the string path.basename(filePath) are replaced. This can be achieved by using a regular expression with the global (g) flag instead of the string-based replace method. The regular expression /\*/g will match all occurrences of '*' in the string.

The fix involves replacing the current replace call with a regular expression-based replacement. This change ensures that the resulting pattern correctly replaces all wildcard characters, aligning with the intended behavior.

Suggested changeset 1
src/setup-python.ts

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/src/setup-python.ts b/src/setup-python.ts
--- a/src/setup-python.ts
+++ b/src/setup-python.ts
@@ -71,3 +71,3 @@
               : path.dirname(filePath.replace(/\*\*\/?/, ''));
-            const pattern = path.basename(filePath).replace('*', '.*');
+            const pattern = path.basename(filePath).replace(/\*/g, '.*');
             resolvedPaths = traverseDir(baseDir, pattern);
EOF
@@ -71,3 +71,3 @@
: path.dirname(filePath.replace(/\*\*\/?/, ''));
const pattern = path.basename(filePath).replace('*', '.*');
const pattern = path.basename(filePath).replace(/\*/g, '.*');
resolvedPaths = traverseDir(baseDir, pattern);
Copilot is powered by AI and may make mistakes. Always verify output.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@v-priya-kinthali @github-advanced-security