Repository navigation
fix(resolve-latest): silently swallow 404 JSON leakage - #4
Merged
Merged
Conversation
When an action has no published GitHub Releases (common for actions that only ship tags), 'gh api repos/X/releases/latest' returns a 404 and leaks the error-response JSON body to stdout — which then lands in $latest_tag and triggers the 'not strict semver' warning with a raw error object embedded in the message. The tags-API fallback already handles this case correctly; the only visible effect was the confusing warning. Detect the JSON-shaped leakage (contains a brace) and empty the variable before the semver check, falling through silently. The warning still fires for legitimate non-semver release tags like 'latest', 'v1' without patch, or 'release-1' — those are real things worth telling the user about.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When an action has no published GitHub Releases (common for actions that ship only tags),
gh api repos/X/releases/latest --jq .tag_name 2>/dev/nullreturns a 404 and leaks the raw JSON error body to stdout rather than returning empty. That body lands in$latest_tagand triggers the "not strict semver" warning with the error JSON embedded in the message — confusing to read in CI logs, looks like a bug.Example from a beacon run where the action resolves itself:
The tags-API fallback (next block) correctly handles this case; only the warning message was noisy.
Fix: detect the JSON-shaped leakage (brace present in value) and silently empty the variable before the semver check. The warning still fires for legitimate non-semver release tags (
latest,v1,release-1) — those are worth telling the user about.After merge: force-move
v1.0.0andv1to include this fix.