fix: composite action input pollution (#2348)

* fix: composite action input pollution

* fix run steps

* fix missing defaults in post after env cleanup

* fix test to make more sense

* Add tests and simplify change

---------

Co-authored-by: mergify[bot] <37929162+mergify[bot]@users.noreply.github.com>

pkg/runner/testdata/uses-composite-check-for-input-collision/action-with-pre-and-post/action.yml

@@ -0,0 +1,16 @@
+name: "Action with pre and post"
+description: "Action with pre and post"
+
+inputs:
+  step:
+    description: "step"
+    required: true
+  cache:
+    required: false
+    default: false
+
+runs:
+  using: "node16"
+  pre: pre.js
+  main: main.js
+  post: post.js

pkg/runner/testdata/uses-composite-check-for-input-collision/action-with-pre-and-post/main.js

@@ -0,0 +1,14 @@
+const { appendFileSync } = require('fs');
+const step = process.env['INPUT_STEP'];
+appendFileSync(process.env['GITHUB_ENV'], `TEST=${step}`, { encoding:'utf-8' })
+
+var cache = process.env['INPUT_CACHE']
+try {
+    var cache = JSON.parse(cache)
+} catch {
+
+}
+if(typeof cache !== 'boolean') {
+    console.log("Input Polluted boolean true/false expected, got " + cache)
+    process.exit(1);
+}

pkg/runner/testdata/uses-composite-check-for-input-collision/action-with-pre-and-post/post.js

@@ -0,0 +1,14 @@
+const { appendFileSync } = require('fs');
+const step = process.env['INPUT_STEP'];
+appendFileSync(process.env['GITHUB_ENV'], `TEST=${step}-post`, { encoding:'utf-8' })
+
+var cache = process.env['INPUT_CACHE']
+try {
+    var cache = JSON.parse(cache)
+} catch {
+
+}
+if(typeof cache !== 'boolean') {
+    console.log("Input Polluted boolean true/false expected, got " + cache)
+    process.exit(1);
+}

pkg/runner/testdata/uses-composite-check-for-input-collision/action-with-pre-and-post/pre.js

@@ -0,0 +1,12 @@
+console.log('pre');
+
+var cache = process.env['INPUT_CACHE']
+try {
+    var cache = JSON.parse(cache)
+} catch {
+
+}
+if(typeof cache !== 'boolean') {
+    console.log("Input Polluted boolean true/false expected, got " + cache)
+    process.exit(1);
+}

pkg/runner/testdata/uses-composite-check-for-input-collision/composite_action/action.yml

@@ -0,0 +1,16 @@
+name: "Test Composite Action"
+description: "Test action uses composite"
+
+inputs:
+  cache:
+    default: none
+
+runs:
+  using: "composite"
+  steps:
+  - uses: ./uses-composite-check-for-input-collision/action-with-pre-and-post
+    with:
+      step: step1
+  - uses: ./uses-composite-check-for-input-collision/action-with-pre-and-post
+    with:
+      step: step2

pkg/runner/testdata/uses-composite-check-for-input-collision/push.yml

@@ -0,0 +1,10 @@
+name: uses-composite-with-pre-and-post-steps
+on: push
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: echo -n "STEP_OUTPUT_TEST=empty" >> $GITHUB_ENV
+      - uses: ./uses-composite-check-for-input-collision/composite_action