Use pinned bun binary for post-steps when allowed_non_write_users is set - #1190
Merged
Claude / Claude Code Review
completed
Apr 7, 2026 in 11m 7s
Code review found 1 potential issue
Found 5 candidates, confirmed 1. See review comments for details.
Details
| Severity | Count |
|---|---|
| 🔴 Important | 0 |
| 🟡 Nit | 1 |
| 🟣 Pre-existing | 0 |
| Severity | File:Line | Issue |
|---|---|---|
| 🟡 Nit | action.yml:226-234 |
Stale pinned bun binary used on self-hosted runners across runs |
Annotations
Check warning on line 234 in action.yml
claude / Claude Code Review
Stale pinned bun binary used on self-hosted runners across runs
On self-hosted runners where `$GITHUB_ACTION_PATH` persists between workflow runs, a `$GITHUB_ACTION_PATH/bin/bun` binary written when `allowed_non_write_users` was set will still pass the `[ -x "$BUN_BIN" ]` check in post-steps during a subsequent run where the input is unset and the pin step is skipped. This is a pre-existing design asymmetry introduced by this PR: the pin step is conditional, but post-step consumption is unconditional — fix by cleaning up the binary in a post-step when `allow
Loading