steps:
  - id: set_val
    run: |
      echo "value=foo" >> $GITHUB_OUTPUT
  - name: Use value
    env:
      FOO: ${{ steps.set_val.outputs.value }}

name: GitHub Env Test - Negative Cases

# Safe: No dangerous triggers
on:
  push:
    branches: [main]

jobs:
  safe-trigger:
    runs-on: ubuntu-latest
    steps:
      # Even with GITHUB_ENV writes, this is safe because of the trigger
      - name: Safe with push trigger
        run: echo $foo >> $GITHUB_ENV

---
name: Safe Patterns with Dangerous Trigger
on: pull_request_target

jobs:
  safe-static-echo:
    runs-on: ubuntu-latest
    steps:
      # Safe: completely static strings
      - name: Static string literal
        run: echo "FOO=bar" >> $GITHUB_ENV

      - name: Static without quotes
        run: echo completely-static >> $GITHUB_ENV

  no-env-write:
    runs-on: ubuntu-latest
    steps:
      - name: Regular echo
        run: echo "Hello World"

      - name: Write to different file
        run: echo $foo >> $OTHER_FILE

      - name: Comment only
        run: echo $foo >> $OTHER_ENV # not $GITHUB_ENV

  wrong-variables:
    runs-on: ubuntu-latest
    steps:
      - name: Similar but not exact variable name
        run: echo $foo >> $GITHUB

      - name: Another similar name
        run: echo $foo | tee $GITHUB_ENVX

  actions-only:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 18

---
# Composite action: write to GITHUB_PATH with only local bash variables. Even
# though `$HOME` is variable expansion, no attacker-influenced GitHub Actions
# context flows in, so the composite branch must not flag this.
name: Benign composite action
description: Composite action whose write to GITHUB_PATH only uses local bash vars
runs:
  using: composite
  steps:
    - name: Add local bin to PATH
      shell: bash
      run: echo "$HOME/bin" >> $GITHUB_PATH

---
# Composite action: step.env carries an unused untrusted input but the actual
# GITHUB_ENV write only appends a constant. The taint never flows into the
# env-file write, so the composite branch must not flag this.
name: Composite with unused taint
description: Untrusted env entry is unused; the GITHUB_ENV write is constant
inputs:
  message:
    description: Untrusted but unused
    required: true
runs:
  using: composite
  steps:
    - name: Constant write with unused taint
      shell: bash
      env:
        MSG: ${{ inputs.message }}
      run: echo "$HOME/bin" >> $GITHUB_PATH

name: GitHub Env Test - Positive Cases
on:
  pull_request_target:
    types: [opened, synchronize]

jobs:
  bash-redirect-unsafe:
    runs-on: ubuntu-latest
    steps:
      - name: Unsafe echo with variable
        run: echo $foo >> $GITHUB_ENV

      - name: Unsafe echo with multiple variables
        run: echo $foo $bar >> $GITHUB_ENV

      - name: Unsafe echo with command substitution
        run: echo FOO=$(bar) >> $GITHUB_ENV

      - name: Unsafe with braces
        run: echo $foo >> ${GITHUB_ENV}

      - name: Unsafe with quotes
        run: echo $foo >> "$GITHUB_ENV"

  bash-pipeline:
    runs-on: ubuntu-latest
    steps:
      - name: Unsafe tee pattern
        run: something | tee $GITHUB_ENV

      - name: Unsafe tee with quotes
        run: something | tee "$GITHUB_ENV"

  bash-path:
    runs-on: ubuntu-latest
    steps:
      - name: Unsafe GITHUB_PATH write
        run: echo $foo >> $GITHUB_PATH

  powershell-unsafe:
    runs-on: windows-latest
    steps:
      - name: Out-File pattern
        shell: pwsh
        run: |
          echo "CUDA_PATH=$env:CUDA_PATH" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append

      - name: Add-Content pattern
        shell: pwsh
        run: |
          Add-Content -Path $env:GITHUB_ENV -Value "RELEASE_VERSION=$releaseVersion"

      - name: Set-Content pattern
        shell: pwsh
        run: |
          Set-Content -Path $env:GITHUB_ENV -Value "tag=$tag"

      - name: Tee-Object pattern
        shell: pwsh
        run: |
          echo "BRANCH=${{ env.BRANCH_NAME }}" | Tee-Object -Append -FilePath "${env:GITHUB_ENV}"

      - name: PowerShell redirect
        shell: pwsh
        run: |
          echo "UV_CACHE_DIR=$UV_CACHE_DIR" >> $env:GITHUB_ENV

  cmd-unsafe:
    runs-on: windows-latest
    steps:
      - name: CMD redirect pattern
        shell: cmd
        run: echo LIBRARY=%LIBRARY% >> %GITHUB_ENV%

name: Composite action writing to GITHUB_ENV
description: Composite action that writes attacker-influenced content to GITHUB_ENV
inputs:
  message:
    description: Untrusted input
    required: true
runs:
  using: composite
  steps:
    - name: Unsafe redirect
      shell: bash
      env:
        MSG: ${{ inputs.message }}
      run: echo $MSG >> $GITHUB_ENV

name: Composite multi-arg redirect to GITHUB_ENV
description: Composite step writes more than one arg to GITHUB_ENV in a single redirect
inputs:
  message:
    description: Untrusted input
    required: true
runs:
  using: composite
  steps:
    - name: Multi-arg unsafe redirect
      shell: bash
      env:
        MSG: ${{ inputs.message }}
      run: echo "FOO=$MSG" "BAR=baz" >> $GITHUB_ENV