GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — Do not use `core.exportVariable` in unit tests (2nd attempt) by mbg · Pull Request #4212 · github/codeql-action

Conversation

@mbg

@mbg mbg commented Oct 7, 2026

Copy link
Copy Markdown
Member

This PR revives #3930 as per the discussion at #4198 (comment). This PR aims to accomplish the same goals as #3930, but is updated based on changes that have happened in the codebase since. The original PR description follows.


Although we already clear environment variables that are set during unit tests, that does not affect the behaviour of core.exportVariable which additionally sets environment variables for subsequent steps in a workflow. If the unit tests are run in CI, then core.exportVariable sets environment variables for subsequent steps in the workflow job which can interfere with them.

This PR improves the situation by introducing a wrapper around core.exportVariable which does not call core.exportVariable when NODE_ENV is test (which is set automatically by ava).


The main change compared to the previous PR is that we now have ReadOnlyEnv and Env and it makes sense to integrate the logic of our exportVariable wrapper with those.

At first glance, a potential concern with using the export method of the Env class is that, if NODE_ENV is test, it only stores the environment variable in the Env instance. Other functions which may depend on the environment variable, but still use process.env to access it, do not see the value. However, all of the unit tests pass, and so we can rule out that this is an issue affecting the tests.

Outside of unit tests, where NODE_ENV is not expected to be set to test, the implementation calls core.exportVariable as well, which does set the environment variable for the process.

Risk assessment

For internal use only. Please select the risk level of this change:

  • Low risk: Changes are fully under feature flags, or have been fully tested and validated in pre-production environments and are highly observable, or are documentation or test only.

Which use cases does this change impact?

Environments:

  • Testing/None - This change does not impact any CodeQL workflows in production.

How did/will you validate this change?

  • Unit tests - I am depending on unit test coverage (i.e. tests in .test.ts files).
  • End-to-end tests - I am depending on PR checks (i.e. tests in pr-checks).

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

  • Rollback - Change can only be disabled by rolling back the release or releasing a new version with a fix.
  • Development/testing only - This change cannot cause any failures in production.

How will you know if something goes wrong after this change is released?

  • Telemetry - I rely on existing telemetry or have made changes to the telemetry.
    • Dashboards - I will watch relevant dashboards for issues after the release. Consider whether this requires this change to be released at a particular time rather than as part of a regular release.
    • Alerts - New or existing monitors will trip if something goes wrong with this change.

Are there any special considerations for merging or releasing this change?

  • No special considerations - This change can be merged at any time.

Merge / deployment checklist

  • Confirm this change is backwards compatible with existing workflows.
  • Consider adding a changelog entry for this change.
  • Confirm the readme and docs have been updated if necessary.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions
mbg added 5 commits October 7, 2026 20:12
@mbg
Move isInTestMode to environment.ts
63c5299
@mbg
Add wrapper around core.exportVariable
1728f0c
@mbg
Add basic eslint enforcement
59ff83e
@mbg
Add NODE_ENV as safe environment variable
75ea4cb
@mbg
Deprecate isInTestMode in favour of a more clearly named method
ebd711f
@github-actions github-actions Bot added the size/M Should be of average difficulty to review label Oct 7, 2026
@mbg mbg mentioned this pull request Oct 7, 2026
Do not use core.exportVariable in unit tests #3930
Closed
@mbg
mbg marked this pull request as ready for review October 8, 2026 09:57
@mbg
mbg requested a review from a team as a code owner October 8, 2026 09:57
Copilot AI balanced review requested due to automatic review settings October 8, 2026 09:57
@mbg mbg mentioned this pull request Oct 8, 2026
Use setup-codeql logic for finding release assets in start-proxy #4198
Merged
Copilot started reviewing on behalf of mbg October 8, 2026 09:57
View session
Copilot AI reviewed Oct 8, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Warning

  • Copilot's review of this pull request may be incomplete because some of the changed files are excluded by your Copilot content exclusion settings. See Excluding content from Copilot for details.

🟡 Changes recommended

NODE_ENV-based detection can suppress cross-step exports in real workflows that set NODE_ENV=test.

1 open finding
  • Medium severity NODE_ENV=test misclassifies workflows and skips GITHUB_ENV exports · New
What changed in this PR

Introduces an environment abstraction that prevents unit tests from exporting variables to subsequent workflow steps.

Changes:

  • Adds Env.export and test-environment detection.
  • Migrates environment exports away from core.exportVariable.
  • Updates tests, linting, and CodeQL query configuration.
File Description
src/​environment.ts Adds environment export and test-mode abstractions.
src/​testing-utils.ts Configures isolated test environments.
src/​actions-util.ts Removes exporting from ActionsEnv.
src/​util.ts Uses the environment export wrapper.
src/​upload-lib.ts Migrates SARIF-related exports.
src/​status-report.ts Migrates status and UUID exports.
src/​setup-codeql.ts Migrates setup-state export.
src/​setup-codeql-action.ts Uses action-state environment exporting.
src/​init.ts Migrates deprecation-warning export.
src/​init-action.ts Uses action-state environment access and exporting.
src/​init-action-post.ts Migrates final-status exports.
src/​debug-artifacts.ts Migrates artifact-scan export.
src/​config-utils.ts Migrates TRAP-cache exports.
src/​codeql.ts Migrates warning-suppression export.
src/​autobuild.ts Migrates autobuild exports.
src/​autobuild-action.ts Uses action-state environment exporting.
src/​api-client.ts Migrates analysis-key export.
src/​analyze-action.ts Uses action-state environment exporting.
src/​overlay/​caching.test.ts Updates the test-mode stub location.
src/​init.test.ts Updates environment export stubs.
queries/​default-setup-environment-variables.ql Allows NODE_ENV access.
eslint.config.mjs Prohibits direct core.exportVariable use.
lib/​entry-points.js Generated bundle update; excluded from review.
Files excluded by content exclusion policy (1)
  • lib/entry-points.js

🧠 Review effort: Balanced


Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions
Comment thread src/environment.ts Resolved

Uh oh!

There was an error while loading. Please reload this page.

henrymercer
henrymercer reviewed Oct 8, 2026
View reviewed changes
Comment thread src/environment.ts Resolved

Uh oh!

There was an error while loading. Please reload this page.

Comment thread eslint.config.mjs Resolved

Uh oh!

There was an error while loading. Please reload this page.

@mbg
Rename exportVariable wrapper to exportEnvVar
d6196d8
@github-actions github-actions Bot added size/L May be hard to review and removed size/M Should be of average difficulty to review labels Oct 8, 2026
@mbg
mbg requested a review from henrymercer October 8, 2026 19:19
@mbg
Add and use __CODEQL_ACTION_TEST_ENV__ in tests
bd97dda
@mbg
mbg force-pushed the mbg/tests/fix-export-variable-2 branch from 9326334 to bd97dda Compare October 8, 2026 19:23
henrymercer
henrymercer approved these changes Oct 9, 2026
View reviewed changes
Comment thread src/environment.ts
Comment on lines +223 to +227
/**
* Used by Node and related tools to indicate what kind of environment we are running in.
*/
NODE_ENV = "NODE_ENV",
}

@henrymercer henrymercer Oct 9, 2026

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this can now be cleaned up

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions
Comment thread src/environment.ts
Comment on lines +323 to +326
* Gets a value indicative of whether we are in a testing environment
* by testing whether the value of the `NODE_ENV` variable is "test".
* This is expected to be the case if e.g. `ava` is running the tests
* or if this instance was constructed by `getTestEnv`.

@henrymercer henrymercer Oct 9, 2026

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Update this JSDoc

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

@mbg mbg Oct 9, 2026

Copy link
Copy Markdown
Member Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was worried I might have missed one

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions
@mbg

mbg commented Oct 9, 2026

Copy link
Copy Markdown
Member Author

@henrymercer I'll merge this as-is for now since it's changing quite a few places and I want to avoid merge conflicts arising if we let too much time pass. I'll address your feedback separately.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

@mbg
mbg added this pull request to the merge queue Oct 9, 2026
Merged via the queue into main with commit 68f5b57 Oct 9, 2026
234 checks passed

Uh oh!

There was an error while loading. Please reload this page.

@mbg
mbg deleted the mbg/tests/fix-export-variable-2 branch October 9, 2026 17:51
This was referenced Oct 14, 2026
Merge main into releases/v4 dsp-testing/mario-campos-post-comment-test#6
Merged
Merge main into releases/v4 #4239
Merged
Merge releases/v4 into releases/v3 #4241
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments
@henrymercer henrymercer henrymercer approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

size/L May be hard to review

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

3 participants

@mbg @henrymercer
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.