Action entrypoints may point above the action directory #26

New Issue

Open

opened 2026-08-04 06:25:51 +00:00 by day01 · 0 comments

day01 commented

2026-08-04 06:25:51 +00:00

Owner

actions/cache/save@v3 and actions/cache/restore@v3 cannot run:

task failed in worker: action entrypoint "../dist/save-only/index.js"
must be a relative path without ..

worker/action_context.rs:10-16 rejects any entrypoint containing a
ParentDir component. That is too strict for how GitHub packages sub-actions:
actions/cache/save lives in a subdirectory of the actions/cache repository
and points at the bundle one level up, inside the same checkout. The reference
never leaves the action's own repository.

The guard should compare the resolved path against the action repository root
rather than reject .. outright — normalise action_path.join(entrypoint) and
require that it stays under the fetched action root. Absolute paths stay
rejected.

Found by the compatibility suite (#13) on its first scheduled run: the cache
job fails on this, not on the cache API it was written to exercise. The test
moves to the top-level actions/cache@v3 meanwhile, so it covers the API; this
issue is what has to be fixed for the sub-actions themselves.

`actions/cache/save@v3` and `actions/cache/restore@v3` cannot run: task failed in worker: action entrypoint "../dist/save-only/index.js" must be a relative path without .. `worker/action_context.rs:10-16` rejects any entrypoint containing a `ParentDir` component. That is too strict for how GitHub packages sub-actions: `actions/cache/save` lives in a subdirectory of the `actions/cache` repository and points at the bundle one level up, inside the same checkout. The reference never leaves the action's own repository. The guard should compare the resolved path against the action repository root rather than reject `..` outright — normalise `action_path.join(entrypoint)` and require that it stays under the fetched action root. Absolute paths stay rejected. Found by the compatibility suite (#13) on its first scheduled run: the `cache` job fails on this, not on the cache API it was written to exercise. The test moves to the top-level `actions/cache@v3` meanwhile, so it covers the API; this issue is what has to be fixed for the sub-actions themselves.