From 74c5e4f8f3328f4624d1ea113df3c51945cc4d02 Mon Sep 17 00:00:00 2001
From: ShaharNaveh <50263213+ShaharNaveh@users.noreply.github.com>
Date: Tue, 24 Mar 2026 13:57:02 +0100
Subject: [PATCH 1/8] Resolve shellcheck warning

---
 .github/workflows/ci.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 7a1e5c941e7..0a2c8ec4faa 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -504,9 +504,9 @@ jobs:
       - name: build rustpython
         run: cargo build --release --target wasm32-wasip1 --features freeze-stdlib,stdlib --verbose
       - name: run snippets
-        run: wasmer run --dir $(pwd) target/wasm32-wasip1/release/rustpython.wasm -- "$(pwd)/extra_tests/snippets/stdlib_random.py"
+        run: wasmer run --dir "$(pwd)" target/wasm32-wasip1/release/rustpython.wasm -- "$(pwd)/extra_tests/snippets/stdlib_random.py"
       - name: run cpython unittest
-        run: wasmer run --dir $(pwd) target/wasm32-wasip1/release/rustpython.wasm -- "$(pwd)/Lib/test/test_int.py"
+        run: wasmer run --dir "$(pwd)" target/wasm32-wasip1/release/rustpython.wasm -- "$(pwd)/Lib/test/test_int.py"
 
   cargo-shear:
     name: cargo shear

From a0abcc189e0114c2e09f8c793c506eca8c74ac37 Mon Sep 17 00:00:00 2001
From: ShaharNaveh <50263213+ShaharNaveh@users.noreply.github.com>
Date: Tue, 24 Mar 2026 14:51:21 +0100
Subject: [PATCH 2/8] Fix more

---
 .github/workflows/ci.yaml | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 0a2c8ec4faa..7b4ccd84e75 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -251,7 +251,7 @@ jobs:
         shell: bash
         run: |
           cores=$(python -c 'print(__import__("os").process_cpu_count())')
-          echo "cores=${cores}" >> $GITHUB_OUTPUT
+          echo "cores=${cores}" >> "$GITHUB_OUTPUT"
 
       - name: Run CPython tests
         run: |
@@ -270,28 +270,30 @@ jobs:
       - name: run cpython tests to check if env polluters have stopped polluting
         shell: bash
         run: |
-          for thing in ${{ join(matrix.env_polluting_tests, ' ') }}; do
+          for thing in "${{ env.TESTS }}"; do
             for i in $(seq 1 10); do
               set +e
-              target/release/rustpython -m test -j 1 --slowest --fail-env-changed --timeout 600 -v ${thing}
+              target/release/rustpython -m test -j 1 --slowest --fail-env-changed --timeout 600 -v "${thing}"
               exit_code=$?
               set -e
-              if [ ${exit_code} -eq 3 ]; then
+              if [ "${exit_code}" -eq 3 ]; then
                 echo "Test ${thing} polluted the environment on attempt ${i}."
                 break
               fi
             done
-            if [ ${exit_code} -ne 3 ]; then
+            if [ "${exit_code}" -ne 3 ]; then
               echo "Test ${thing} is no longer polluting the environment after ${i} attempts!"
               echo "Please remove ${thing} from matrix.env_polluting_tests in '.github/workflows/ci.yaml'."
               echo "Please also remove the skip decorators that include the word 'POLLUTERS' in ${thing}."
-              if [ ${exit_code} -ne 0 ]; then
+              if [ "${exit_code}" -ne 0 ]; then
                 echo "Test ${thing} failed with exit code ${exit_code}."
                 echo "Please investigate which test item in ${thing} is failing and either mark it as an expected failure or a skip."
               fi
               exit 1
             fi
           done
+        env:
+          TESTS: ${{ join(matrix.env_polluting_tests, ' ') }}
         timeout-minutes: 15
 
       - if: runner.os != 'Windows'

From 4814eebc03c12cb7089e318cc84d5c278d66a5a8 Mon Sep 17 00:00:00 2001
From: ShaharNaveh <50263213+ShaharNaveh@users.noreply.github.com>
Date: Tue, 24 Mar 2026 14:53:33 +0100
Subject: [PATCH 3/8] Resolve potential template injection

---
 .github/workflows/ci.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 7b4ccd84e75..e09148261a2 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -270,7 +270,7 @@ jobs:
       - name: run cpython tests to check if env polluters have stopped polluting
         shell: bash
         run: |
-          for thing in "${{ env.TESTS }}"; do
+          for thing in "${TESTS}"; do
             for i in $(seq 1 10); do
               set +e
               target/release/rustpython -m test -j 1 --slowest --fail-env-changed --timeout 600 -v "${thing}"

From 423afb14e7680202b6c06bb764260a435b3caa16 Mon Sep 17 00:00:00 2001
From: ShaharNaveh <50263213+ShaharNaveh@users.noreply.github.com>
Date: Tue, 24 Mar 2026 14:58:36 +0100
Subject: [PATCH 4/8] Fix logic error

---
 .github/workflows/ci.yaml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index e09148261a2..bbcd9de87b5 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -270,7 +270,7 @@ jobs:
       - name: run cpython tests to check if env polluters have stopped polluting
         shell: bash
         run: |
-          for thing in "${TESTS}"; do
+          while IFS= read -r thing; do
             for i in $(seq 1 10); do
               set +e
               target/release/rustpython -m test -j 1 --slowest --fail-env-changed --timeout 600 -v "${thing}"
@@ -291,9 +291,9 @@ jobs:
               fi
               exit 1
             fi
-          done
+          done <<< "$TESTS"
         env:
-          TESTS: ${{ join(matrix.env_polluting_tests, ' ') }}
+          TESTS: ${{ join(matrix.env_polluting_tests, '\n') }}
         timeout-minutes: 15
 
       - if: runner.os != 'Windows'

From 9dc9ebc41de9e887eb350573e719d2a16abdc43d Mon Sep 17 00:00:00 2001
From: ShaharNaveh <50263213+ShaharNaveh@users.noreply.github.com>
Date: Tue, 24 Mar 2026 21:00:24 +0100
Subject: [PATCH 5/8] Fix

---
 .github/workflows/ci.yaml | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index bbcd9de87b5..6fd2d808fef 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -271,6 +271,7 @@ jobs:
         shell: bash
         run: |
           while IFS= read -r thing; do
+          for thing in "${{ matrix.env_polluting_tests[@] }}"; do
             for i in $(seq 1 10); do
               set +e
               target/release/rustpython -m test -j 1 --slowest --fail-env-changed --timeout 600 -v "${thing}"
@@ -291,9 +292,7 @@ jobs:
               fi
               exit 1
             fi
-          done <<< "$TESTS"
-        env:
-          TESTS: ${{ join(matrix.env_polluting_tests, '\n') }}
+          done
         timeout-minutes: 15
 
       - if: runner.os != 'Windows'

From a8bdc238917db8cfbf20a0b51f98022a96b01b9f Mon Sep 17 00:00:00 2001
From: ShaharNaveh <50263213+ShaharNaveh@users.noreply.github.com>
Date: Tue, 24 Mar 2026 21:02:07 +0100
Subject: [PATCH 6/8] Remove old

---
 .github/workflows/ci.yaml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 6fd2d808fef..5ccc478248d 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -270,7 +270,6 @@ jobs:
       - name: run cpython tests to check if env polluters have stopped polluting
         shell: bash
         run: |
-          while IFS= read -r thing; do
           for thing in "${{ matrix.env_polluting_tests[@] }}"; do
             for i in $(seq 1 10); do
               set +e

From e9519983238910d52174d46906d414f5a39ea6f0 Mon Sep 17 00:00:00 2001
From: ShaharNaveh <50263213+ShaharNaveh@users.noreply.github.com>
Date: Tue, 24 Mar 2026 21:04:19 +0100
Subject: [PATCH 7/8] fix

---
 .github/workflows/ci.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 5ccc478248d..1a77109416d 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -270,7 +270,7 @@ jobs:
       - name: run cpython tests to check if env polluters have stopped polluting
         shell: bash
         run: |
-          for thing in "${{ matrix.env_polluting_tests[@] }}"; do
+          for thing in "${{ matrix.env_polluting_tests }}"; do
             for i in $(seq 1 10); do
               set +e
               target/release/rustpython -m test -j 1 --slowest --fail-env-changed --timeout 600 -v "${thing}"

From af1606b088c5e101af429dec256b023f67afb619 Mon Sep 17 00:00:00 2001
From: ShaharNaveh <50263213+ShaharNaveh@users.noreply.github.com>
Date: Tue, 24 Mar 2026 21:11:58 +0100
Subject: [PATCH 8/8] fix

---
 .github/workflows/ci.yaml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 1a77109416d..dccaa59b9d6 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -270,7 +270,9 @@ jobs:
       - name: run cpython tests to check if env polluters have stopped polluting
         shell: bash
         run: |
-          for thing in "${{ matrix.env_polluting_tests }}"; do
+          IFS=' ' read -r -a target_array <<< "$TARGETS"
+
+          for thing in "${target_array[@]}"; do
             for i in $(seq 1 10); do
               set +e
               target/release/rustpython -m test -j 1 --slowest --fail-env-changed --timeout 600 -v "${thing}"
@@ -292,6 +294,8 @@ jobs:
               exit 1
             fi
           done
+        env:
+          TARGETS: ${{ join(matrix.env_polluting_tests, ' ') }}
         timeout-minutes: 15
 
       - if: runner.os != 'Windows'