Revert "fix: prevent code injection and untrusted checkout in CI workflows (#1728)"

.github/actions/publish-library-to-gpr/action.yaml

@@ -120,11 +120,9 @@ runs:
       shell: bash
       working-directory: ${{ steps.resolve_dir.outputs.dir }}
       if: steps.determine_version.outputs.version != steps.determine_version.outputs.package_version
-      env:
-        PKG_VERSION: ${{ steps.determine_version.outputs.version }}
       run: |
-        echo "Updating version to ${PKG_VERSION}"
-        npm version "${PKG_VERSION}" --no-git-tag-version --allow-same-version
+        echo "Updating version to ${{ steps.determine_version.outputs.version }}"
+        npm version ${{ steps.determine_version.outputs.version }} --no-git-tag-version --allow-same-version
 
     - name: Check version exists in GitHub Packages
       continue-on-error: true

.github/actions/sanity-checks/action.yaml

@@ -40,15 +40,14 @@ runs:
         github.event_name == 'pull_request'
       continue-on-error: true
       env:
-        GH_REPOSITORY: ${{ github.repository }}
         PR_BASE_REF: ${{ github.event.pull_request.base.ref }}
-        PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}
         PR_FORK_URL: ${{ github.event.pull_request.head.repo.clone_url }}
+        PR_HEAD_REF: ${{ github.event.pull_request.head.ref }}
       run: |
-        git remote set-url origin "https://github.com/${GH_REPOSITORY}.git"
+        git remote set-url origin https://github.com/${{ github.repository }}.git
         git fetch origin +refs/heads/*:refs/remotes/origin/*
-        git fetch origin "${PR_BASE_REF}:refs/remotes/origin/${PR_BASE_REF}"
-        git fetch origin "${PR_HEAD_REF}:refs/pr/head" || git fetch "${PR_FORK_URL}" "${PR_HEAD_REF}:refs/pr/head"
+        git fetch origin "$PR_BASE_REF:refs/remotes/origin/$PR_BASE_REF"
+        git fetch origin "$PR_HEAD_REF:refs/pr/head" || git fetch "$PR_FORK_URL" "$PR_HEAD_REF:refs/pr/head"
 
     - name: Check PR status vs. target branch
       shell: bash
@@ -57,10 +56,9 @@ runs:
         github.event_name == 'pull_request_target' ||
         github.event_name == 'pull_request'
       continue-on-error: true
-      env:
-        TARGET_SHA: ${{ github.event.pull_request.base.sha }}
-        PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
       run: |
+        TARGET_SHA=${{ github.event.pull_request.base.sha }}
+        PR_HEAD_SHA=${{ github.event.pull_request.head.sha }}
         if ! git merge-base --is-ancestor "$TARGET_SHA" "$PR_HEAD_SHA"; then
           echo "::error title=PR is not up to date::This PR is not up to date with target branch"
           echo "ℹ️  Suggestion: Consider rebasing or merging the latest changes from the target branch"

.github/workflows/integration-mobile-test-diffusion-cpp.yml

@@ -110,32 +110,18 @@ jobs:
         if: matrix.platform == 'Android' && !inputs.package
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # 8.0.1
         with:
-          path: ${{ runner.temp }}/prebuilds-android-staging
+          path: ${{ env.ADDON_WORKDIR }}/prebuilds
           pattern: ${{ env.PREBUILD_ARTIFACT_PREFIX }}android-*
           merge-multiple: true
-
-      - name: Move Android prebuilds from staging
-        if: matrix.platform == 'Android' && !inputs.package
-        run: |
-          mkdir -p ${{ env.ADDON_WORKDIR }}/prebuilds
-          cp -r ${{ runner.temp }}/prebuilds-android-staging/* ${{ env.ADDON_WORKDIR }}/prebuilds/ 2>/dev/null || true
-        shell: bash
         continue-on-error: true
 
       - name: Download iOS prebuilds (from artifacts)
         if: matrix.platform == 'iOS' && !inputs.package
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # 8.0.1
         with:
-          path: ${{ runner.temp }}/prebuilds-ios-staging
+          path: ${{ env.ADDON_WORKDIR }}/prebuilds
           pattern: ${{ env.PREBUILD_ARTIFACT_PREFIX }}ios-*
           merge-multiple: true
-
-      - name: Move iOS prebuilds from staging
-        if: matrix.platform == 'iOS' && !inputs.package
-        run: |
-          mkdir -p ${{ env.ADDON_WORKDIR }}/prebuilds
-          cp -r ${{ runner.temp }}/prebuilds-ios-staging/* ${{ env.ADDON_WORKDIR }}/prebuilds/ 2>/dev/null || true
-        shell: bash
         continue-on-error: true
 
       - name: Download prebuilds from package

.github/workflows/integration-mobile-test-ocr-onnx.yml

@@ -113,32 +113,18 @@ jobs:
         if: matrix.platform == 'Android' && !inputs.package
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # 8.0.1
         with:
-          path: ${{ runner.temp }}/prebuilds-android-staging
+          path: addon/${{ inputs.workdir || env.PKG_DIR }}/prebuilds
           pattern: ${{ env.PREBUILD_ARTIFACT_PREFIX }}android-*
           merge-multiple: true
-
-      - name: Move Android prebuilds from staging
-        if: matrix.platform == 'Android' && !inputs.package
-        run: |
-          mkdir -p addon/${{ inputs.workdir || env.PKG_DIR }}/prebuilds
-          cp -r ${{ runner.temp }}/prebuilds-android-staging/* addon/${{ inputs.workdir || env.PKG_DIR }}/prebuilds/ 2>/dev/null || true
-        shell: bash
         continue-on-error: true
 
       - name: Download iOS prebuilds (from artifacts)
         if: matrix.platform == 'iOS' && !inputs.package
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # 8.0.1
         with:
-          path: ${{ runner.temp }}/prebuilds-ios-staging
+          path: addon/${{ inputs.workdir || env.PKG_DIR }}/prebuilds
           pattern: ${{ env.PREBUILD_ARTIFACT_PREFIX }}ios-*
           merge-multiple: true
-
-      - name: Move iOS prebuilds from staging
-        if: matrix.platform == 'iOS' && !inputs.package
-        run: |
-          mkdir -p addon/${{ inputs.workdir || env.PKG_DIR }}/prebuilds
-          cp -r ${{ runner.temp }}/prebuilds-ios-staging/* addon/${{ inputs.workdir || env.PKG_DIR }}/prebuilds/ 2>/dev/null || true
-        shell: bash
         continue-on-error: true
 
       - name: Download prebuilds from package

.github/workflows/integration-mobile-test-qvac-lib-infer-llamacpp-embed.yml

@@ -123,32 +123,18 @@ jobs:
         if: matrix.platform == 'Android' && !inputs.package
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # 8.0.1
         with:
-          path: ${{ runner.temp }}/prebuilds-android-staging
+          path: ${{ env.ADDON_DIR }}/prebuilds
           pattern: ${{ env.PREBUILD_ARTIFACT_PREFIX }}android-*
           merge-multiple: true
-
-      - name: Move Android prebuilds from staging
-        if: matrix.platform == 'Android' && !inputs.package
-        run: |
-          mkdir -p ${{ env.ADDON_DIR }}/prebuilds
-          cp -r ${{ runner.temp }}/prebuilds-android-staging/* ${{ env.ADDON_DIR }}/prebuilds/ 2>/dev/null || true
-        shell: bash
         continue-on-error: true
 
       - name: Download iOS prebuilds (from artifacts)
         if: matrix.platform == 'iOS' && !inputs.package
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # 8.0.1
         with:
-          path: ${{ runner.temp }}/prebuilds-ios-staging
+          path: ${{ env.ADDON_DIR }}/prebuilds
           pattern: ${{ env.PREBUILD_ARTIFACT_PREFIX }}ios-*
           merge-multiple: true
-
-      - name: Move iOS prebuilds from staging
-        if: matrix.platform == 'iOS' && !inputs.package
-        run: |
-          mkdir -p ${{ env.ADDON_DIR }}/prebuilds
-          cp -r ${{ runner.temp }}/prebuilds-ios-staging/* ${{ env.ADDON_DIR }}/prebuilds/ 2>/dev/null || true
-        shell: bash
         continue-on-error: true
 
       - name: Download prebuilds from package

.github/workflows/integration-mobile-test-qvac-lib-infer-llamacpp-llm.yml

@@ -119,32 +119,18 @@ jobs:
         if: matrix.platform == 'Android' && !inputs.package
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # 8.0.1
         with:
-          path: ${{ runner.temp }}/prebuilds-android-staging
+          path: ${{ env.ADDON_WORKDIR }}/prebuilds
           pattern: ${{ env.PREBUILD_ARTIFACT_PREFIX }}android-*
           merge-multiple: true
-
-      - name: Move Android prebuilds from staging
-        if: matrix.platform == 'Android' && !inputs.package
-        run: |
-          mkdir -p ${{ env.ADDON_WORKDIR }}/prebuilds
-          cp -r ${{ runner.temp }}/prebuilds-android-staging/* ${{ env.ADDON_WORKDIR }}/prebuilds/ 2>/dev/null || true
-        shell: bash
         continue-on-error: true
 
       - name: Download iOS prebuilds (from artifacts)
         if: matrix.platform == 'iOS' && !inputs.package
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # 8.0.1
         with:
-          path: ${{ runner.temp }}/prebuilds-ios-staging
+          path: ${{ env.ADDON_WORKDIR }}/prebuilds
           pattern: ${{ env.PREBUILD_ARTIFACT_PREFIX }}ios-*
           merge-multiple: true
-
-      - name: Move iOS prebuilds from staging
-        if: matrix.platform == 'iOS' && !inputs.package
-        run: |
-          mkdir -p ${{ env.ADDON_WORKDIR }}/prebuilds
-          cp -r ${{ runner.temp }}/prebuilds-ios-staging/* ${{ env.ADDON_WORKDIR }}/prebuilds/ 2>/dev/null || true
-        shell: bash
         continue-on-error: true
 
       - name: Download prebuilds from package

.github/workflows/integration-mobile-test-qvac-lib-infer-nmtcpp.yml

@@ -116,32 +116,18 @@ jobs:
         if: matrix.platform == 'Android' && !inputs.package
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # 8.0.1
         with:
-          path: ${{ runner.temp }}/prebuilds-android-staging
+          path: monorepo/${{ inputs.workdir || env.PKG_DIR }}/prebuilds
           pattern: ${{ env.PREBUILD_ARTIFACT_PREFIX }}android-*
           merge-multiple: true
-
-      - name: Move Android prebuilds from staging
-        if: matrix.platform == 'Android' && !inputs.package
-        run: |
-          mkdir -p monorepo/${{ inputs.workdir || env.PKG_DIR }}/prebuilds
-          cp -r ${{ runner.temp }}/prebuilds-android-staging/* monorepo/${{ inputs.workdir || env.PKG_DIR }}/prebuilds/ 2>/dev/null || true
-        shell: bash
         continue-on-error: true
 
       - name: Download iOS prebuilds (from artifacts)
         if: matrix.platform == 'iOS' && !inputs.package
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # 8.0.1
         with:
-          path: ${{ runner.temp }}/prebuilds-ios-staging
+          path: monorepo/${{ inputs.workdir || env.PKG_DIR }}/prebuilds
           pattern: ${{ env.PREBUILD_ARTIFACT_PREFIX }}ios-*
           merge-multiple: true
-
-      - name: Move iOS prebuilds from staging
-        if: matrix.platform == 'iOS' && !inputs.package
-        run: |
-          mkdir -p monorepo/${{ inputs.workdir || env.PKG_DIR }}/prebuilds
-          cp -r ${{ runner.temp }}/prebuilds-ios-staging/* monorepo/${{ inputs.workdir || env.PKG_DIR }}/prebuilds/ 2>/dev/null || true
-        shell: bash
         continue-on-error: true
 
       - name: Download prebuilds from package

.github/workflows/integration-mobile-test-qvac-lib-infer-onnx-tts.yml

@@ -124,32 +124,18 @@ jobs:
         if: matrix.platform == 'Android' && github.event_name != 'workflow_dispatch'
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # 8.0.1
         with:
-          path: ${{ runner.temp }}/prebuilds-android-staging
+          path: ${{ env.ADDON_DIR }}/prebuilds
           pattern: ${{ env.PREBUILD_ARTIFACT_PREFIX }}android-*
           merge-multiple: true
-
-      - name: Move Android prebuilds from staging
-        if: matrix.platform == 'Android' && !inputs.package
-        run: |
-          mkdir -p ${{ env.ADDON_DIR }}/prebuilds
-          cp -r ${{ runner.temp }}/prebuilds-android-staging/* ${{ env.ADDON_DIR }}/prebuilds/ 2>/dev/null || true
-        shell: bash
         continue-on-error: true
 
       - name: Download iOS prebuilds (from artifacts)
         if: matrix.platform == 'iOS' && github.event_name != 'workflow_dispatch'
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # 8.0.1
         with:
-          path: ${{ runner.temp }}/prebuilds-ios-staging
+          path: ${{ env.ADDON_DIR }}/prebuilds
           pattern: ${{ env.PREBUILD_ARTIFACT_PREFIX }}ios-*
           merge-multiple: true
-
-      - name: Move iOS prebuilds from staging
-        if: matrix.platform == 'iOS' && !inputs.package
-        run: |
-          mkdir -p ${{ env.ADDON_DIR }}/prebuilds
-          cp -r ${{ runner.temp }}/prebuilds-ios-staging/* ${{ env.ADDON_DIR }}/prebuilds/ 2>/dev/null || true
-        shell: bash
         continue-on-error: true
 
       - name: Download prebuilds (from npm - workflow_dispatch)

.github/workflows/integration-mobile-test-qvac-lib-infer-parakeet.yml

@@ -131,33 +131,19 @@ jobs:
         id: artifact_android
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # 8.0.1
         with:
-          path: ${{ runner.temp }}/prebuilds-android-staging
+          path: ${{ env.ADDON_DIR }}/prebuilds
           pattern: ${{ env.PREBUILD_ARTIFACT_PREFIX }}android-*
           merge-multiple: true
-
-      - name: Move Android prebuilds from staging
-        if: matrix.platform == 'Android' && !inputs.package
-        run: |
-          mkdir -p ${{ env.ADDON_DIR }}/prebuilds
-          cp -r ${{ runner.temp }}/prebuilds-android-staging/* ${{ env.ADDON_DIR }}/prebuilds/ 2>/dev/null || true
-        shell: bash
         continue-on-error: true
 
       - name: Download iOS prebuilds (from artifacts)
         if: matrix.platform == 'iOS' && github.event_name != 'workflow_dispatch'
         id: artifact_ios
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # 8.0.1
         with:
-          path: ${{ runner.temp }}/prebuilds-ios-staging
+          path: ${{ env.ADDON_DIR }}/prebuilds
           pattern: ${{ env.PREBUILD_ARTIFACT_PREFIX }}ios-*
           merge-multiple: true
-
-      - name: Move iOS prebuilds from staging
-        if: matrix.platform == 'iOS' && !inputs.package
-        run: |
-          mkdir -p ${{ env.ADDON_DIR }}/prebuilds
-          cp -r ${{ runner.temp }}/prebuilds-ios-staging/* ${{ env.ADDON_DIR }}/prebuilds/ 2>/dev/null || true
-        shell: bash
         continue-on-error: true
 
       - name: Download prebuilds (from npm - workflow_dispatch)

.github/workflows/integration-mobile-test-qvac-lib-infer-whispercpp.yml

@@ -117,32 +117,18 @@ jobs:
         if: matrix.platform == 'Android' && github.event_name != 'workflow_dispatch'
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # 8.0.1
         with:
-          path: ${{ runner.temp }}/prebuilds-android-staging
+          path: addon/${{ inputs.workdir }}/prebuilds
           pattern: ${{ env.PREBUILD_ARTIFACT_PREFIX }}android-*
           merge-multiple: true
-
-      - name: Move Android prebuilds from staging
-        if: matrix.platform == 'Android' && !inputs.package
-        run: |
-          mkdir -p addon/${{ inputs.workdir }}/prebuilds
-          cp -r ${{ runner.temp }}/prebuilds-android-staging/* addon/${{ inputs.workdir }}/prebuilds/ 2>/dev/null || true
-        shell: bash
         continue-on-error: true
 
       - name: Download iOS prebuilds (from artifacts)
         if: matrix.platform == 'iOS' && github.event_name != 'workflow_dispatch'
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # 8.0.1
         with:
-          path: ${{ runner.temp }}/prebuilds-ios-staging
+          path: addon/${{ inputs.workdir }}/prebuilds
           pattern: ${{ env.PREBUILD_ARTIFACT_PREFIX }}ios-*
           merge-multiple: true
-
-      - name: Move iOS prebuilds from staging
-        if: matrix.platform == 'iOS' && !inputs.package
-        run: |
-          mkdir -p addon/${{ inputs.workdir }}/prebuilds
-          cp -r ${{ runner.temp }}/prebuilds-ios-staging/* addon/${{ inputs.workdir }}/prebuilds/ 2>/dev/null || true
-        shell: bash
         continue-on-error: true
 
       - name: Download prebuilds (from npm - workflow_dispatch)

.github/workflows/integration-test-ocr-onnx.yml

@@ -93,17 +93,9 @@ jobs:
         if: ${{ !inputs.prebuild_package }}
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # 8.0.1
         with:
-          path: ${{ runner.temp }}/prebuilds-staging
+          path: ${{ inputs.workdir || env.PKG_DIR }}/prebuilds
           merge-multiple: true
 
-      - name: Move prebuilds from staging to workspace
-        if: ${{ !inputs.prebuild_package }}
-        run: |
-          mkdir -p ${{ inputs.workdir || env.PKG_DIR }}/prebuilds
-          cp -r ${{ runner.temp }}/prebuilds-staging/* ${{ inputs.workdir || env.PKG_DIR }}/prebuilds/ 2>/dev/null || true
-          echo "Prebuilds moved from staging area"
-        shell: bash
-
       - name: Download prebuilds from package
         if: ${{ inputs.prebuild_package }}
         working-directory: ${{ inputs.workdir || env.PKG_DIR }}

.github/workflows/integration-test-qvac-lib-infer-nmtcpp.yml

@@ -88,17 +88,9 @@ jobs:
         if: ${{ !inputs.prebuild_package }}
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # 8.0.1
         with:
-          path: ${{ runner.temp }}/prebuilds-staging
+          path: ${{ inputs.workdir || env.PKG_DIR }}/prebuilds
           merge-multiple: true
 
-      - name: Move prebuilds from staging to workspace
-        if: ${{ !inputs.prebuild_package }}
-        shell: bash
-        run: |
-          mkdir -p ${{ inputs.workdir || env.PKG_DIR }}/prebuilds
-          cp -r ${{ runner.temp }}/prebuilds-staging/* ${{ inputs.workdir || env.PKG_DIR }}/prebuilds/ 2>/dev/null || true
-          echo "Prebuilds moved from staging area"
-
       - name: Download prebuilds from package
         if: ${{ inputs.prebuild_package }}
         working-directory: ${{ inputs.workdir || env.PKG_DIR }}

.github/workflows/integration-test-qvac-lib-infer-onnx-tts.yml

@@ -187,17 +187,9 @@ jobs:
         if: ${{ !inputs.prebuild_package }}
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # 8.0.1
         with:
-          path: ${{ runner.temp }}/prebuilds-staging
+          path: ${{ inputs.workdir }}/prebuilds
           merge-multiple: true
 
-      - name: Move prebuilds from staging to workspace
-        if: ${{ !inputs.prebuild_package }}
-        run: |
-          mkdir -p ${{ inputs.workdir }}/prebuilds
-          cp -r ${{ runner.temp }}/prebuilds-staging/* ${{ inputs.workdir }}/prebuilds/ 2>/dev/null || true
-          echo "Prebuilds moved from staging area"
-        shell: bash
-
       - name: Download prebuilds from package
         if: ${{ inputs.prebuild_package }}
         working-directory: ${{ inputs.workdir }}