fix: use github.head_ref env var as trusted input

Update slugify-value to 1.3.3
Update shortify-git-revision to 1.5.1

Signed-off-by: Nick Reynolds <nickittynack@users.noreply.github.com>

.github/workflows/v4-tests-and-release.yml

@@ -1,8 +1,8 @@
-name: "[v4] Test and Release"
+name: '[v4] Test and Release'
 on: [push, pull_request]
 jobs:
   check-v3compatibility:
-    name: "Check v3 compatibility"
+    name: 'Check v3 compatibility'
     strategy:
       fail-fast: false
       matrix:
@@ -11,14 +11,16 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v3
-      - name: Load using v3.x
-        uses: rlespinasse/github-slug-action@v3.x
+
       - name: Load using v4.x with prefix
         uses: ./
         with:
           prefix: V4_
           short-length: 8
 
+      - name: Load using v3.x
+        uses: rlespinasse/github-slug-action@v3.x
+
       - name: Validate // Partial variables
         run: |
           [[ "${{ env.GITHUB_REPOSITORY_OWNER_PART }}" == "${{ env.V4_GITHUB_REPOSITORY_OWNER_PART }}" ]]
@@ -82,7 +84,7 @@ jobs:
         shell: bash
 
   check-v3compatibility-without-checkout:
-    name: "Check v3 compatibility (without checkout)"
+    name: 'Check v3 compatibility (without checkout)'
     needs:
       - check-v3compatibility
     strategy:
@@ -96,14 +98,16 @@ jobs:
         with:
           path: this-action
           ref: ${{ github.ref }}
-      - name: Load using v3.x
-        uses: rlespinasse/github-slug-action@v3.x
+
       - name: Load using v4.x with prefix
         uses: ./this-action
         with:
           prefix: V4_
           short-length: 8
 
+      - name: Load using v3.x
+        uses: rlespinasse/github-slug-action@v3.x
+
       - name: Validate // Short SHA variables
         run: |
           [[ "${{ env.GITHUB_SHA_SHORT }}" == "${{ env.V4_GITHUB_SHA_SHORT }}" ]]
@@ -111,7 +115,7 @@ jobs:
         shell: bash
 
   display:
-    name: "Display produced variables"
+    name: 'Display produced variables'
     strategy:
       fail-fast: false
       matrix:
@@ -120,6 +124,7 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@v3
+
       - name: Load using v4.x
         uses: ./
 
@@ -186,7 +191,7 @@ jobs:
         shell: bash
 
   display-without-checkout:
-    name: "Display produced variables (without checkout)"
+    name: 'Display produced variables (without checkout)'
     needs:
       - display
     strategy:
@@ -200,14 +205,16 @@ jobs:
         with:
           path: this-action
           ref: ${{ github.ref }}
-      - name: Load using v3.x
-        uses: rlespinasse/github-slug-action@v3.x
+
       - name: Load using v4.x with prefix
         uses: ./this-action
         with:
           prefix: V4_
           short-length: 8
 
+      - name: Load using v3.x
+        uses: rlespinasse/github-slug-action@v3.x
+
       - name: Short SHA variables
         run: |
           echo "sha              : ${{ env.GITHUB_SHA_SHORT }}"
@@ -229,7 +236,7 @@ jobs:
       - name: Using correct short length
         uses: ./
         with:
-          prefix: "CSL_"
+          prefix: 'CSL_'
           short-length: 4
       - name: Using correct length // Validate that all short variables lengths are equals to short-length
         run: |
@@ -241,8 +248,8 @@ jobs:
         id: using-wrong-short-length
         uses: ./
         with:
-          prefix: "WSL_"
-          short-length: "wrong"
+          prefix: 'WSL_'
+          short-length: 'wrong'
         continue-on-error: true
       - name: Using wrong short length // Validate that the action end with an error
         run: |
@@ -271,7 +278,7 @@ jobs:
       - name: Using correct short length
         uses: ./this-action
         with:
-          prefix: "CSL_"
+          prefix: 'CSL_'
           short-length: 4
       - name: Using correct length // Validate that all short variables lengths are equals to short-length
         run: |
@@ -283,7 +290,7 @@ jobs:
         id: using-empty-short-length
         uses: ./this-action
         with:
-          prefix: "ESL_"
+          prefix: 'ESL_'
         continue-on-error: true
       - name: Using empty short length // Validate that the action don't end with an error
         run: |
@@ -297,8 +304,8 @@ jobs:
         id: using-wrong-short-length
         uses: ./this-action
         with:
-          prefix: "WSL_"
-          short-length: "wrong"
+          prefix: 'WSL_'
+          short-length: 'wrong'
         continue-on-error: true
       - name: Using wrong short length // Validate that the action end with an error
         run: |
@@ -322,7 +329,7 @@ jobs:
       - name: Using correct slug max length
         uses: ./
         with:
-          prefix: "CML_"
+          prefix: 'CML_'
           slug-maxlength: 1
       - name: Using correct max length // Validate that all slug variables lengths are equals or under the slug-maxlength
         run: |
@@ -334,8 +341,8 @@ jobs:
         id: using-wrong-slug-max-length
         uses: ./
         with:
-          prefix: "WML_"
-          slug-maxlength: "wrong"
+          prefix: 'WML_'
+          slug-maxlength: 'wrong'
         continue-on-error: true
       - name: Using wrong slug max length // Validate that the action end with an error
         run: |
@@ -349,8 +356,8 @@ jobs:
         id: using-empty-slug-max-length
         uses: ./
         with:
-          prefix: "EML_"
-          slug-maxlength: ""
+          prefix: 'EML_'
+          slug-maxlength: ''
         continue-on-error: true
       - name: Using empty slug max length // Validate that the action end with an error
         run: |
@@ -364,8 +371,8 @@ jobs:
         id: using-nolimit-slug-max-length
         uses: ./
         with:
-          prefix: "NLML_"
-          slug-maxlength: "nolimit"
+          prefix: 'NLML_'
+          slug-maxlength: 'nolimit'
       - name: Using no limit on slug max length // Validate that the action end with an error
         run: |
           [[ "$(env | grep "NLML_" | grep "_SLUG" | wc -l)" -gt 0 ]]
@@ -387,5 +394,3 @@ jobs:
         uses: actions/checkout@v3
       - name: Release this GitHub Action
         uses: rlespinasse/release-that@v1
-        with:
-          without-prefix: true

README.md

@@ -1,10 +1,6 @@
 # GitHub Slug action
 
-[![Release][release-badge]][releases]
-![Lint][lint-badge]
-[![Licence][license-badge]][license]
-
-This GitHub Action will expose the slug/short values of [some GitHub environment variables][github-env-vars] inside your GitHub workflow.
+This GitHub Action will expose the slug/short values of [some GitHub environment variables][default-environment-variables] inside your GitHub workflow.
 
 ## Table of Contents
 
@@ -22,6 +18,8 @@ This GitHub Action will expose the slug/short values of [some GitHub environment
   - [Troubleshooting](#troubleshooting)
     - [The SHORT variables doesn't have the same lengths as before](#the-short-variables-doesnt-have-the-same-lengths-as-before)
     - [One of the environment variables doesn't work as intended](#one-of-the-environment-variables-doesnt-work-as-intended)
+      - [Known environment variable conflicts](#known-environment-variable-conflicts)
+        - [GITHUB_REF_NAME](#github_ref_name)
     - [An action could not be found at the URI](#an-action-could-not-be-found-at-the-uri)
   - [Thanks for talking about us](#thanks-for-talking-about-us)
 
@@ -31,8 +29,9 @@ This GitHub Action will expose the slug/short values of [some GitHub environment
 
 - put the variable content in lower case
 - replace any character by `-` except `0-9`, `a-z`, `.`, and `_`
-- remove leading and trailing `-` character
+- remove leading `-` characters
 - limit the string size to 63 characters
+- remove trailing `-` characters
 
 <details>
   <summary>Others <b>Slug-ish</b> commands are available</summary>
@@ -47,11 +46,10 @@ This GitHub Action will expose the slug/short values of [some GitHub environment
 - `<VAR>_CS` on others variables to keep the value case-sensitive
   - Like `GITHUB_REF_SLUG_CS`
 
+Additional enhanced environment variables can be compute to help you around GitHub environment variables.
   </p>
 </details>
 
-Additional enhanced environment variables can be compute to help you around GitHub environment variables.
-
 ## Use this action
 
 Add this in your workflow
@@ -61,7 +59,9 @@ Add this in your workflow
   uses: rlespinasse/github-slug-action@v4
 ```
 
-Others configurations
+<details>
+  <summary>Others configurations</summary>
+  <p>
 
 - With a prefix
 
@@ -91,6 +91,8 @@ Others configurations
   ```
 
   **Warning**: If you leave it empty, you need to checkout the source first in order to let git decide the size by itself.
+  </p>
+</details>
 
 Check for more [examples][examples] (OS usage, URL use, ...)
 
@@ -182,34 +184,42 @@ To manage that moving length, you can use `short-length` input
 
 ### One of the environment variables doesn't work as intended
 
-[**Note**][naming-conventions]: GitHub reserves the `GITHUB_` environment variable prefix for internal use by GitHub. Setting an environment variable or secret with the `GITHUB_` prefix will result in an error.
+[**Note**][naming-conventions]: When you set a custom environment variable, you cannot use any of the default environment variable names. For a complete list of these, see [Default environment variables][default-environment-variables]. **If you attempt to override the value of one of these default environment variables, the assignment is ignored.**
 
-Currently, a GitHub workflow setting a `GITHUB_` variable will not cause an error, it will just fail silently.
-And if a custom `GITHUB_` variable is in conflict with an official `GITHUB_` variable, the offical `GITHUB_` variable will override custom one.
+If a variable start to be used as default environment variable, the environment variable may have a different behavior than the expected one.
 
-<details>
-  <summary>Test workflow</summary>
-  <p>
+If this append, the `${{ env.GITHUB_AWESOME_VARIABLE }}` and `$GITHUB_AWESOME_VARIABLE` expression will not works in the same way.
+
+- `${{ env.GITHUB_AWESOME_VARIABLE }}` will serve the behavior of this action,
+- `$GITHUB_AWESOME_VARIABLE` will serve the behavior of GitHub Action.
+
+Otherwise the two expression will serve the behavior of this action.
+This will not occurs if you use the `prefix` input to avoid the issue.
+
+**NOTE:** If detected, the maintainers of this action will choose the best course of action depending of the impact.
+
+#### Known environment variable conflicts
+
+##### GITHUB_REF_NAME
+
+The behavior is the same as the GitHub one except on `pull_request*` workflows ([Ready the full story][issue-104]).
+
+- `${{ env.GITHUB_REF_NAME }}` will serve the behavior of this action,
+- `$GITHUB_REF_NAME` will serve the behavior of GitHub Action.
+
+On `pull_request*` workflows, the content will be `<PR-number>/merge` instead of the branch name.
+
+A possible workaround is to use `prefix` input
 
 ```yaml
-name: Test
-on: push
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-      - run: echo ${GITHUB_REF}
-      # print "refs/heads/v4.x"
-      - run: echo "GITHUB_REF=one_value" >> "$GITHUB_ENV"
-      - run: echo ${GITHUB_REF}
-      # print "refs/heads/v4.x"
-      - run: echo "GITHUB_REF_SLUG=another_value" >> "$GITHUB_ENV"
-      - run: echo ${GITHUB_REF_SLUG}
-      # print "another_value"
+- name: Inject slug/short variables
+  uses: rlespinasse/github-slug-action@v4
+  with:
+    prefix: CI_
 ```
 
-  </p>
-</details>
+Then `${{ env.CI_GITHUB_REF_NAME }}`, and `$CI_GITHUB_REF_NAME` will serve the behavior of this action.
+And `$GITHUB_REF_NAME` will serve the behavior of GitHub Action.
 
 ### An action could not be found at the URI
 
@@ -230,29 +240,28 @@ Please, use the current major tag `v4` or a version tag (see [releases pages][re
 ## Thanks for talking about us
 
 - [Mettre en place une CI/CD Angular avec GitHub Actions & Netlify][article-1] (in french :fr:)
-- [Github Actions : enfin des pipelines accessibles aux développeurs][talk-1] (in french :fr:)
 - [Action spotlight by Michael Heap][article-2]
+- [Serverless Deploy Previews on GitHub Actions][article-3]
+- [Let's Build a Continuous Delivery and Branching Process with Github Actions, Vercel and Heroku][article-4]
+- [Github Actions : enfin des pipelines accessibles aux développeurs][talk-1] (in french :fr:)
 - The next one is you. _Don't hesitate to add youself to this list._
 
-[release-badge]: https://img.shields.io/github/workflow/status/rlespinasse/github-slug-action/Release?label=Build&logo=github&style=flat-square
-[lint-badge]: https://img.shields.io/github/workflow/status/rlespinasse/github-slug-action/Lint?label=Lint&logo=github&style=flat-square
-[license-badge]: https://img.shields.io/github/license/rlespinasse/github-slug-action?style=flat-square
-
-[actions]: https://github.com/rlespinasse/github-slug-action/actions
-[license]: https://github.com/rlespinasse/github-slug-action/blob/v4.x/LICENSE
 [examples]: https://github.com/rlespinasse/github-slug-action/tree/v4.x/examples
 [custom-variable]: https://github.com/rlespinasse/github-slug-action/issues/new?assignees=&labels=enhancement&template=feature_request.md&title=
 [releases]: https://github.com/rlespinasse/github-slug-action/releases
 [issue-15]: https://github.com/rlespinasse/github-slug-action/issues/15
+[issue-104]: https://github.com/rlespinasse/github-slug-action/issues/104
 
-[git-revpars]: https://git-scm.com/docs/git-rev-parse#Documentation/git-rev-parse.txt---shortlength
+[git-revparse]: https://git-scm.com/docs/git-rev-parse#Documentation/git-rev-parse.txt---shortlength
 [git-core-abbrev]: https://git-scm.com/docs/git-config#Documentation/git-config.txt-coreabbrev
 
-[github-env-vars]: https://docs.github.com/en/free-pro-team@latest/actions/reference/environment-variables#default-environment-variables
-[dependabot]: https://docs.github.com/en/free-pro-team@latest/github/administering-a-repository/keeping-your-actions-up-to-date-with-github-dependabot
+[default-environment-variables]: https://docs.github.com/en/actions/learn-github-actions/environment-variables#default-environment-variables
+[dependabot]: https://docs.github.com/en/code-security/dependabot/working-with-dependabot/keeping-your-actions-up-to-date-with-dependabot
 [webhooks-and-events]: https://docs.github.com/en/developers/webhooks-and-events/webhook-events-and-payloads
 [naming-conventions]: https://docs.github.com/en/actions/reference/environment-variables#naming-conventions-for-environment-variables
 
 [article-1]: https://esensconsulting.medium.com/mettre-en-place-une-ci-cd-angular-avec-github-actions-netlify-ca0b59b99ed8
 [article-2]: https://michaelheap.com/github-slug-action/
-[talk-1]: https://www.youtube.com/watch?v=RHnTJBwcE98
+[article-3]: https://barstool.engineering/serverless-deploy-previews-on-github-actions/
+[article-4]: https://javascript.plainenglish.io/lets-build-a-continuous-delivery-and-branching-process-c27dae09f0b6
+[talk-1]: https://www.youtube.com/watch?v=F5mBDmOQcvE

action.yml

@@ -26,73 +26,87 @@ runs:
         INPUT_SLUG_MAXLENGTH: ${{ inputs.slug-maxlength }}
         INPUT_SHORT_LENGTH: ${{ inputs.short-length }}
 
-    - uses: rlespinasse/slugify-value@v1.2.3
+    # From Environment Variables
+    - uses: rlespinasse/slugify-value@v1.4.0
       with:
         key: GITHUB_REPOSITORY
         value: ${{ github.repository }}
         prefix: ${{ inputs.prefix }}
         slug-maxlength: ${{ inputs.slug-maxlength }}
-    - uses: rlespinasse/slugify-value@v1.2.3
+    - uses: rlespinasse/slugify-value@v1.4.0
       with:
         key: GITHUB_REF
         prefix: ${{ inputs.prefix }}
         slug-maxlength: ${{ inputs.slug-maxlength }}
-    - uses: rlespinasse/slugify-value@v1.2.3
+    - uses: rlespinasse/slugify-value@v1.4.0
       with:
         key: GITHUB_HEAD_REF
         prefix: ${{ inputs.prefix }}
         slug-maxlength: ${{ inputs.slug-maxlength }}
-    - uses: rlespinasse/slugify-value@v1.2.3
+    - uses: rlespinasse/slugify-value@v1.4.0
       with:
         key: GITHUB_BASE_REF
         prefix: ${{ inputs.prefix }}
         slug-maxlength: ${{ inputs.slug-maxlength }}
 
-    # Specific values
-    - uses: rlespinasse/slugify-value@v1.2.3
+    # From Specific values
+    - uses: rlespinasse/slugify-value@v1.4.0
       with:
         key: GITHUB_EVENT_REF
         value: ${{ github.event.ref }}
         prefix: ${{ inputs.prefix }}
         slug-maxlength: ${{ inputs.slug-maxlength }}
-
-    # Calculated values
-    - id: get-github-ref-name
-      run: echo "::set-output name=github-ref-name::$(echo "${{ github.head_ref || github.ref }}" | cut -d/ -f3)"
-      shell: bash
-    - uses: rlespinasse/slugify-value@v1.2.3
+    - uses: rlespinasse/slugify-value@v1.4.0
       with:
         key: GITHUB_REF_NAME
-        value: ${{ steps.get-github-ref-name.outputs.github-ref-name }}
+        # Related to https://github.com/rlespinasse/github-slug-action/issues/104
+        value: ${{ env.GITHUB_HEAD_REF_RAW || env.GITHUB_REF_NAME_RAW }}
         prefix: ${{ inputs.prefix }}
         slug-maxlength: ${{ inputs.slug-maxlength }}
+      env:
+        GITHUB_HEAD_REF_RAW: ${{ github.head_ref }}
+        GITHUB_REF_NAME_RAW: ${{ github.ref_name }}
+
+    # From Calculated values
     - id: get-github-repository-owner-part
-      run: echo "::set-output name=github-repository-owner-part::$(echo $GITHUB_REPOSITORY | cut -d/ -f1)"
+      run: |
+        ownerpart=$(echo $GITHUB_REPOSITORY | cut -d/ -f1)
+        if [ -f "$GITHUB_OUTPUT" ]; then
+          echo "github-repository-owner-part=${ownerpart}" >> "$GITHUB_OUTPUT"
+        else
+          echo "::set-output name=github-repository-owner-part::${ownerpart}"
+        fi
       shell: bash
-    - uses: rlespinasse/slugify-value@v1.2.3
+    - uses: rlespinasse/slugify-value@v1.4.0
       with:
         key: GITHUB_REPOSITORY_OWNER_PART
         value: ${{ steps.get-github-repository-owner-part.outputs.github-repository-owner-part }}
         prefix: ${{ inputs.prefix }}
         slug-maxlength: ${{ inputs.slug-maxlength }}
     - id: get-github-repository-name-part
-      run: echo "::set-output name=github-repository-name-part::$(echo $GITHUB_REPOSITORY | cut -d/ -f2)"
+      run: |
+        namepart=$(echo $GITHUB_REPOSITORY | cut -d/ -f2)
+        if [ -f "$GITHUB_OUTPUT" ]; then
+          echo "github-repository-name-part=${namepart}" >> "$GITHUB_OUTPUT"
+        else
+          echo "::set-output name=github-repository-name-part::${namepart}"
+        fi
       shell: bash
-    - uses: rlespinasse/slugify-value@v1.2.3
+    - uses: rlespinasse/slugify-value@v1.4.0
       with:
         key: GITHUB_REPOSITORY_NAME_PART
         value: ${{ steps.get-github-repository-name-part.outputs.github-repository-name-part }}
         prefix: ${{ inputs.prefix }}
         slug-maxlength: ${{ inputs.slug-maxlength }}
 
-    # Short
-    - uses: rlespinasse/shortify-git-revision@v1.4.0
+    # From sha
+    - uses: rlespinasse/shortify-git-revision@v1.6.0
       with:
         name: GITHUB_SHA
         short-on-error: true
         length: ${{ steps.prefligth.outputs.PREFLIGHT_SHORT_LENGTH }}
         prefix: ${{ inputs.prefix }}
-    - uses: rlespinasse/shortify-git-revision@v1.4.0
+    - uses: rlespinasse/shortify-git-revision@v1.6.0
       with:
         name: GITHUB_EVENT_PULL_REQUEST_HEAD_SHA
         revision: ${{ github.event.pull_request.head.sha }}

preflight.sh

@@ -31,4 +31,8 @@ else
   fi
 fi
 echo "::debug ::Set PREFLIGHT_SHORT_LENGTH=$PREFLIGHT_SHORT_LENGTH"
-echo "::set-output name=PREFLIGHT_SHORT_LENGTH::$PREFLIGHT_SHORT_LENGTH"
+if [ -f "$GITHUB_OUTPUT" ]; then
+  echo "PREFLIGHT_SHORT_LENGTH=${PREFLIGHT_SHORT_LENGTH}" >> "$GITHUB_OUTPUT"
+else
+  echo "::set-output name=PREFLIGHT_SHORT_LENGTH::${PREFLIGHT_SHORT_LENGTH}"
+fi