From 8abf7dfc04d26939557efc5e2226bfb7c4378054 Mon Sep 17 00:00:00 2001
From: Joshua Napoli <jnapoli@cvector.energy>
Date: Wed, 19 Aug 2026 08:27:47 -0400
Subject: [PATCH] [PD1-138] Fix zizmor findings

Clear the zizmor findings in the action, so that the shared GitHub Actions static-analysis workflow can be rolled out to this repository.

The package manager input, the run prefix the detection step selects, and the source directories now reach the shell through the environment instead of being expanded into the script, where a value containing shell syntax would have been executed. The run prefix and the source directory list are still left unquoted, since both are meant to split into separate words, and a comment above the lint steps says so.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 action.yml | 27 +++++++++++++++++++++------
 1 file changed, 21 insertions(+), 6 deletions(-)

diff --git a/action.yml b/action.yml
index 66aaf9d..b73add6 100644
--- a/action.yml
+++ b/action.yml
@@ -48,9 +48,11 @@ runs:
       id: pm
       shell: bash
       working-directory: ${{ inputs.working-directory }}
+      env:
+        PACKAGE_MANAGER: ${{ inputs.package-manager }}
       run: |
-        if [ "${{ inputs.package-manager }}" != "auto" ]; then
-          manager="${{ inputs.package-manager }}"
+        if [ "$PACKAGE_MANAGER" != "auto" ]; then
+          manager="$PACKAGE_MANAGER"
         elif [ -f uv.lock ]; then
           manager="uv"
         elif [ -f poetry.lock ]; then
@@ -125,15 +127,23 @@ runs:
     # PATCH /git/refs returning 422 vs git push returning 403 with the same
     # token). The API path doesn't need git credentials at all.
 
+    # $RUN is the package manager's run prefix ("uv run" or "poetry run") and $SRC_DIRS is a
+    # space-separated list, so both are left unquoted below to split into separate words.
     - name: Run ruff format
       shell: bash
       working-directory: ${{ inputs.working-directory }}
-      run: ${{ steps.pm.outputs.run }} ruff format --exit-non-zero-on-format ${{ inputs.src-dirs }}
+      env:
+        RUN: ${{ steps.pm.outputs.run }}
+        SRC_DIRS: ${{ inputs.src-dirs }}
+      run: $RUN ruff format --exit-non-zero-on-format $SRC_DIRS
 
     - name: Run ruff check
       shell: bash
       working-directory: ${{ inputs.working-directory }}
-      run: ${{ steps.pm.outputs.run }} ruff check --fix --exit-non-zero-on-fix ${{ inputs.src-dirs }}
+      env:
+        RUN: ${{ steps.pm.outputs.run }}
+        SRC_DIRS: ${{ inputs.src-dirs }}
+      run: $RUN ruff check --fix --exit-non-zero-on-fix $SRC_DIRS
 
     - name: Repair
       if: failure() && inputs.repair-token != ''
@@ -262,13 +272,18 @@ runs:
     - name: Run mypy
       shell: bash
       working-directory: ${{ inputs.working-directory }}
-      run: ${{ steps.pm.outputs.run }} mypy ${{ inputs.src-dirs }}
+      env:
+        RUN: ${{ steps.pm.outputs.run }}
+        SRC_DIRS: ${{ inputs.src-dirs }}
+      run: $RUN mypy $SRC_DIRS
 
     - name: Run pytest
       if: inputs.run-pytest == 'true'
       shell: bash
       working-directory: ${{ inputs.working-directory }}
-      run: ${{ steps.pm.outputs.run }} pytest
+      env:
+        RUN: ${{ steps.pm.outputs.run }}
+      run: $RUN pytest
 
 branding:
   icon: check-circle