@secureci/cli 1.0.0 → 1.1.0

package/dist/parser/pipeline-contract-validator.js

@@ -43,6 +43,7 @@ const repository_1 = require("../utils/repository");
 const action_fetcher_1 = require("../runner/action-fetcher");
 const github_lockfile_1 = require("../github-lockfile");
 const permissions_1 = require("./permissions");
+const expression_1 = require("../runner/expression");
 /** Maximum nesting of composite actions / reusable workflows. */
 const MAX_DEPTH = 10;
 /**
@@ -81,8 +82,17 @@ async function validatePipelineContract(parsed, spec, options = {}) {
     (spec.required ?? []).forEach((entry, idx) => {
         const path = `required[${idx}]`;
         const name = normalizeActionName(entry.uses);
-        const candidates = sequence.filter((u) => u.name === name);
-        if (candidates.length > 0 && candidates.every((c) => c.conditional)) {
+        const found = sequence.filter((u) => u.name === name);
+        const candidates = found.filter((u) => u.runs !== 'never');
+        if (found.length > 0 && candidates.length === 0) {
+            errors.push({
+                path,
+                message: `Required action "${entry.uses}" never runs: its if: conditions (on its step or job) can't be true for this workflow's triggers (${(graph.events ?? []).join(', ')})`,
+                severity: 'error'
+            });
+            return;
+        }
+        if (candidates.length > 0 && candidates.every((c) => c.runs === 'maybe')) {
             errors.push({
                 path,
                 message: `Required action "${entry.uses}" only runs under an if: condition (on its step or job), so it may be skipped`,
@@ -275,6 +285,20 @@ function needsTransitively(nodes, from, to) {
 async function buildGraph(parsed, recurse, offline) {
     const graph = { sequence: [], nodes: new Map(), errors: [] };
     const root = (0, repository_1.repositoryRoot)(parsed.path);
+    // `if:` conditions are decided, where they can be, for each trigger of
+    // the workflow (called workflows run with their caller's event). With
+    // workflow_call, the event is the caller's, so it isn't known.
+    graph.events = triggerEvents(parsed.file.on);
+    const known = graph.events
+        ? graph.events.map((event) => ({ github: { event_name: event } }))
+        : [{}];
+    /** `runs`, narrowed by a job or step's own `if:`. */
+    const within = (runs, condition) => runs.map((outer, i) => {
+        const own = (0, expression_1.staticCondition)(condition, known[i]);
+        if (outer === false || own === false)
+            return false;
+        return outer === true && own === true ? true : undefined;
+    });
     const isLocal = (uses) => uses.startsWith('./') || uses.startsWith('../');
     /**
      * The file behind a composite action / reusable workflow reference, or
@@ -355,31 +379,35 @@ async function buildGraph(parsed, recurse, offline) {
         }
         return true;
     };
-    const addUsage = (node, index, at, uses, conditional) => {
+    const addUsage = (node, index, at, uses, runs) => {
         graph.sequence.push({
             node,
             index,
             path: at,
-            conditional,
+            runs: runs.every((r) => r === false)
+                ? 'never'
+                : runs.every((r) => r === true)
+                    ? 'always'
+                    : 'maybe',
             ...splitActionRef(uses)
         });
     };
     /** Flatten a job's steps (and composite action steps) into `node`. */
-    const addSteps = async (steps, node, at, counter, stack, workflowRoot, conditional) => {
+    const addSteps = async (steps, node, at, counter, stack, workflowRoot, runs) => {
         for (const [i, step] of steps.entries()) {
             const stepPath = `${at}steps[${i}]`;
             if (!step.uses) {
                 counter.next++;
                 continue;
             }
-            const stepConditional = conditional || hasCondition(step.if);
-            addUsage(node, counter.next++, stepPath, step.uses, stepConditional);
+            const stepRuns = within(runs, step.if);
+            addUsage(node, counter.next++, stepPath, step.uses, stepRuns);
             const file = await resolveRef(step.uses, 'action', workflowRoot, stepPath);
             if (!file || !canEnter(file, stack, stepPath))
                 continue;
             const action = parse(file, stepPath);
             if (action?.type === 'action' && action.file.runs.using === 'composite') {
-                await addSteps(action.file.runs.steps ?? [], node, `${stepPath} > ${step.uses} > `, counter, [...stack, file], workflowRoot, stepConditional);
+                await addSteps(action.file.runs.steps ?? [], node, `${stepPath} > ${step.uses} > `, counter, [...stack, file], workflowRoot, stepRuns);
             }
         }
     };
@@ -388,7 +416,7 @@ async function buildGraph(parsed, recurse, offline) {
      * reusable-workflow call itself needs, plus the call). Returns the ids
      * of the added jobs.
      */
-    const addWorkflow = async (workflow, workflowRoot, prefix, labelPrefix, at, after, stack, conditional) => {
+    const addWorkflow = async (workflow, workflowRoot, prefix, labelPrefix, at, after, stack, runs) => {
         const added = [];
         // A job id -> the graph nodes standing for it (a reusable-workflow call
         // stands for the call and all of its called jobs).
@@ -408,17 +436,17 @@ async function buildGraph(parsed, recurse, offline) {
             });
             added.push(node);
             const jobPath = `${at}jobs.${jobId}`;
-            const jobConditional = conditional || hasCondition(job.if);
+            const jobRuns = within(runs, job.if);
             if (job.uses) {
                 // The call itself is a one-step "job" its called jobs run after.
-                addUsage(node, 0, jobPath, job.uses, jobConditional);
+                addUsage(node, 0, jobPath, job.uses, jobRuns);
                 graph.nodes.get(node).length = 1;
                 const ids = [node];
                 const file = await resolveRef(job.uses, 'workflow', workflowRoot, jobPath);
                 if (file && canEnter(file, stack, jobPath)) {
                     const called = parse(file, jobPath);
                     if (called?.type === 'workflow') {
-                        ids.push(...(await addWorkflow(called.file, (0, repository_1.repositoryRoot)(file), `${node}>`, `${labelPrefix}${jobId} > ${job.uses} > `, `${jobPath} > ${job.uses} > `, [...needs, node], [...stack, file], jobConditional)));
+                        ids.push(...(await addWorkflow(called.file, (0, repository_1.repositoryRoot)(file), `${node}>`, `${labelPrefix}${jobId} > ${job.uses} > `, `${jobPath} > ${job.uses} > `, [...needs, node], [...stack, file], jobRuns)));
                     }
                 }
                 alias.set(jobId, ids);
@@ -427,27 +455,30 @@ async function buildGraph(parsed, recurse, offline) {
             }
             alias.set(jobId, [node]);
             const counter = { next: 0 };
-            await addSteps(job.steps ?? [], node, `${jobPath}.`, counter, stack, workflowRoot, jobConditional);
+            await addSteps(job.steps ?? [], node, `${jobPath}.`, counter, stack, workflowRoot, jobRuns);
             graph.nodes.get(node).length = counter.next;
         }
         return added;
     };
-    await addWorkflow(parsed.file, root, '', '', '', [], [path.resolve(parsed.path)], false);
+    await addWorkflow(parsed.file, root, '', '', '', [], [path.resolve(parsed.path)], known.map(() => true));
     return graph;
 }
 /**
- * Whether an `if:` can skip the step/job: anything but a missing value,
- * `true`, `success()` (the default) or `always()`.
+ * The events that trigger a workflow (`on:` as a string, list or map), or
+ * undefined when the event isn't known: none are listed, or the workflow
+ * is reusable (it runs with its caller's event).
  */
-function hasCondition(condition) {
-    if (condition === undefined || condition === null || condition === true) {
-        return false;
-    }
-    const text = String(condition)
-        .trim()
-        .replace(/^\$\{\{([\s\S]*)\}\}$/, '$1')
-        .trim();
-    return !['', 'true', 'success()', 'always()'].includes(text);
+function triggerEvents(on) {
+    const events = typeof on === 'string'
+        ? [on]
+        : Array.isArray(on)
+            ? on.map(String)
+            : on && typeof on === 'object'
+                ? Object.keys(on)
+                : [];
+    return events.length === 0 || events.includes('workflow_call')
+        ? undefined
+        : events;
 }
 function splitActionRef(uses) {
     const atIndex = uses.lastIndexOf('@');

package/dist/runner/action-fetcher.js

@@ -43,6 +43,7 @@ exports.lsRemoteSha = lsRemoteSha;
 exports.parseLsRemoteTags = parseLsRemoteTags;
 exports.lsRemoteTags = lsRemoteTags;
 exports.getText = getText;
+exports.getResponse = getResponse;
 exports.followRedirect = followRedirect;
 exports.fetchAction = fetchAction;
 exports.fetchRepoFile = fetchRepoFile;
@@ -222,6 +223,10 @@ async function lsRemoteTags(url) {
  * with an error carrying `status`.
  */
 function getText(url, headers, timeoutMs) {
+    return getResponse(url, headers, timeoutMs).then((r) => r.body);
+}
+/** getText, with the response headers (e.g. `link` for pagination). */
+function getResponse(url, headers, timeoutMs) {
     return new Promise((resolve, reject) => {
         const client = url.startsWith('http://') ? http : https;
         const request = client.get(url, { headers }, (response) => {
@@ -237,7 +242,7 @@ function getText(url, headers, timeoutMs) {
                 body += chunk;
             });
             response.on('end', () => response.statusCode === 200
-                ? resolve(body)
+                ? resolve({ body, headers: response.headers })
                 : reject(Object.assign(new Error(`HTTP ${response.statusCode}`), {
                     status: response.statusCode
                 })));

package/dist/runner/actions.js

@@ -93,7 +93,7 @@ function warnUnsandboxedActions(steps, ctx, options) {
 async function stepFileSystem(runtime) {
     const container = runtime.container;
     if (!container)
-        return (0, builtin_actions_1.hostFileSystem)(process.cwd());
+        return (0, builtin_actions_1.hostFileSystem)(runtime.workspace);
     if (container.home === undefined) {
         const probe = await container.runtime.exec(container.id, {
             command: 'printf %s "$HOME"'
@@ -102,7 +102,7 @@ async function stepFileSystem(runtime) {
     }
     return (0, builtin_actions_1.containerFileSystem)({
         workspace: container_runtime_1.CONTAINER_WORKDIR,
-        hostWorkspace: process.cwd(),
+        hostWorkspace: runtime.workspace,
         home: container.home,
         copyFrom: (from, to) => container.runtime.copyFrom(container.id, from, to),
         copyTo: (from, to) => container.runtime.copyTo(container.id, from, to),
@@ -259,8 +259,8 @@ function isLocalActionRef(uses) {
  * Resolve a local action (`uses: ./path/to/action`) relative to the
  * workspace, like the runner does, to its action.yml / action.yaml.
  */
-function resolveLocalAction(uses) {
-    const dir = path.resolve(process.cwd(), uses);
+function resolveLocalAction(uses, workspace = process.cwd()) {
+    const dir = path.resolve(workspace, uses);
     for (const name of ['action.yml', 'action.yaml']) {
         const candidate = path.join(dir, name);
         if (fs.existsSync(candidate))
@@ -297,7 +297,7 @@ async function executeAction(step, options, startTime, runtime, ctx) {
                     args: withValues.args ? (0, shell_1.splitArgs)(withValues.args) : []
                 }
             };
-            return await (0, docker_action_1.executeDockerAction)(dockerAction, path.join(process.cwd(), 'action.yml'), step, {}, callerCtx.env, options, runtime, startTime);
+            return await (0, docker_action_1.executeDockerAction)(dockerAction, path.join(runtime.workspace, 'action.yml'), step, {}, callerCtx.env, options, runtime, startTime);
         }
         if (options.localCheckout !== false &&
             (0, checkout_1.isLocalCheckout)(step.uses, step.with, callerCtx)) {
@@ -308,11 +308,11 @@ async function executeAction(step, options, startTime, runtime, ctx) {
             return await runBuiltinAction(builtin, step, callerCtx, options, runtime, startTime);
         }
         const actionPath = isLocalActionRef(step.uses)
-            ? resolveLocalAction(step.uses)
+            ? resolveLocalAction(step.uses, runtime.workspace)
             : await fetchActionOnce(step.uses, options, runtime);
         if (!actionPath) {
             const error = `Could not resolve action "${step.uses}"${isLocalActionRef(step.uses)
-                ? ` (no action.yml or action.yaml in ${path.resolve(process.cwd(), step.uses)})`
+                ? ` (no action.yml or action.yaml in ${path.resolve(runtime.workspace, step.uses)})`
                 : ''}`;
             logger_1.logger.error(error);
             return {

package/dist/runner/checkout.js

@@ -34,10 +34,13 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.copyWorkingCopy = copyWorkingCopy;
+exports.createIsolatedWorkspace = createIsolatedWorkspace;
+exports.removeIsolatedWorkspace = removeIsolatedWorkspace;
 exports.isLocalCheckout = isLocalCheckout;
 exports.localCheckout = localCheckout;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
+const child_process_1 = require("child_process");
 const logger_1 = require("../utils/logger");
 const expression_1 = require("./expression");
 /** Marks a `path:` copy made by localCheckout, so it may be replaced. */
@@ -64,10 +67,34 @@ function copyWorkingCopy(srcDir, dstDir, exclude) {
         fs.cpSync(src, dst, {
             recursive: true,
             verbatimSymlinks: true,
+            // Copy-on-write clones where the file system supports them.
+            mode: fs.constants.COPYFILE_FICLONE,
             filter: (file) => !fs.existsSync(path.join(file, CHECKOUT_MARKER))
         });
     }
 }
+/**
+ * A copy of the working copy (uncommitted changes and .git included) for
+ * one job, in `parentDir`, for --isolate-workspace. Remove it with
+ * removeIsolatedWorkspace.
+ */
+function createIsolatedWorkspace(workingCopy, parentDir) {
+    const dir = fs.mkdtempSync(path.join(parentDir, 'workspace-'));
+    copyWorkingCopy(workingCopy, dir, dir);
+    return dir;
+}
+/**
+ * Remove a job's isolated workspace. Best effort: files a container step
+ * created as another user may not be removable, which is only warned about.
+ */
+function removeIsolatedWorkspace(dir) {
+    try {
+        fs.rmSync(dir, { recursive: true, force: true });
+    }
+    catch (error) {
+        logger_1.logger.warn(`Couldn't remove the job's workspace copy ${dir}: ${error instanceof Error ? error.message : String(error)}`);
+    }
+}
 /**
  * Whether a step is `actions/checkout` of the repository being run (no
  * `repository:` input, or the current one in any case), which is served
@@ -101,6 +128,54 @@ function escapesViaSymlink(workspace, dest) {
     const real = fs.realpathSync(existing);
     return real !== root && !real.startsWith(root + path.sep);
 }
+/** Run git in `cwd` on the host; undefined when it fails. */
+function gitOutput(cwd, args) {
+    try {
+        return (0, child_process_1.execFileSync)('git', args, {
+            cwd,
+            encoding: 'utf8',
+            stdio: ['ignore', 'pipe', 'ignore']
+        }).trim();
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * The commit `ref` names in the local repository (as given, else as a
+ * branch of `origin`), or undefined. A ref that looks like an option is
+ * never passed to git.
+ */
+function resolveLocalRef(workspace, ref) {
+    if (ref.startsWith('-'))
+        return undefined;
+    for (const candidate of [ref, `refs/remotes/origin/${ref}`]) {
+        const sha = gitOutput(workspace, [
+            'rev-parse',
+            '--verify',
+            '--quiet',
+            '--end-of-options',
+            `${candidate}^{commit}`
+        ]);
+        if (sha)
+            return sha;
+    }
+    return undefined;
+}
+/**
+ * Submodules of the working copy that aren't initialized (`git submodule
+ * status` marks them with "-"), by path.
+ */
+function uninitializedSubmodules(workspace) {
+    if (!fs.existsSync(path.join(workspace, '.gitmodules')))
+        return [];
+    const status = gitOutput(workspace, ['submodule', 'status', '--recursive']);
+    return (status ?? '')
+        .split('\n')
+        .filter((line) => line.startsWith('-'))
+        .map((line) => line.slice(1).split(' ')[1])
+        .filter(Boolean);
+}
 function localCheckout(step, ctx, runtime, startTime) {
     const withValues = (0, expression_1.substituteRecord)(step.with, ctx);
     const outputs = {
@@ -111,12 +186,7 @@ function localCheckout(step, ctx, runtime, startTime) {
         logger_1.logger.error(error);
         return { step, success: false, error, duration: Date.now() - startTime };
     };
-    const ref = withValues.ref;
-    if (ref &&
-        ![ctx.github.ref, ctx.github.ref_name, ctx.github.sha].includes(ref)) {
-        logger_1.logger.warn(`actions/checkout: ignoring ref "${ref}"; using the local working copy (pass --no-local-checkout to run the real action)`);
-    }
-    const workspace = process.cwd();
+    const workspace = runtime.workspace;
     const dest = path.resolve(workspace, withValues.path || '.');
     const relative = path.relative(workspace, dest);
     if (relative.startsWith('..') ||
@@ -124,6 +194,28 @@ function localCheckout(step, ctx, runtime, startTime) {
         escapesViaSymlink(workspace, dest)) {
         return fail(`actions/checkout: path "${withValues.path}" is outside the workspace`);
     }
+    // A ref other than the current one: check out that commit, when the local
+    // repository has it, into path: (never over the user's working copy).
+    const ref = withValues.ref;
+    let commit;
+    if (ref &&
+        ![ctx.github.ref, ctx.github.ref_name, ctx.github.sha].includes(ref)) {
+        commit = resolveLocalRef(workspace, ref);
+        if (!commit) {
+            logger_1.logger.warn(`actions/checkout: ref "${ref}" isn't in the local repository; using the local working copy (fetch it, or pass --no-local-checkout to run the real action)`);
+        }
+        else if (relative === '') {
+            logger_1.logger.warn(`actions/checkout: not checking out ref "${ref}" over your working copy; add a path: to check it out there, or pass --no-local-checkout to run the real action`);
+            commit = undefined;
+        }
+    }
+    const submodules = String(withValues.submodules ?? '').toLowerCase();
+    if (submodules === 'true' || submodules === 'recursive') {
+        const missing = uninitializedSubmodules(workspace);
+        if (missing.length > 0) {
+            logger_1.logger.warn(`actions/checkout: submodules aren't initialized in your working copy (${missing.join(', ')}); run \`git submodule update --init --recursive\` first`);
+        }
+    }
     let output = 'Using local working copy';
     if (relative !== '') {
         if (fs.existsSync(dest)) {
@@ -134,9 +226,33 @@ function localCheckout(step, ctx, runtime, startTime) {
                 return fail(`actions/checkout: path "${withValues.path}" already exists in the working copy; remove it or pass --no-local-checkout`);
             }
         }
-        copyWorkingCopy(workspace, dest, dest);
+        if (commit) {
+            // A local clone, sharing the repository's objects: nothing is fetched
+            // and the working copy's .git is only read.
+            const cloned = gitOutput(workspace, [
+                'clone',
+                '--quiet',
+                '--shared',
+                '--no-checkout',
+                '--',
+                workspace,
+                dest
+            ]) !== undefined &&
+                gitOutput(dest, ['checkout', '--quiet', '--detach', commit]) !==
+                    undefined;
+            if (!cloned) {
+                fs.rmSync(dest, { recursive: true, force: true });
+                return fail(`actions/checkout: couldn't check out ref "${ref}" to "${withValues.path}"`);
+            }
+            outputs.ref = String(ref);
+            outputs.commit = commit;
+            output = `Checked out ${ref} (${commit.slice(0, 7)}) to ${relative}`;
+        }
+        else {
+            copyWorkingCopy(workspace, dest, dest);
+            output = `Using local working copy (copied to ${relative})`;
+        }
         fs.writeFileSync(path.join(dest, CHECKOUT_MARKER), '');
-        output = `Using local working copy (copied to ${relative})`;
         const postStep = { name: `Post ${step.name || step.uses}` };
         runtime.postSteps.push({
             step: postStep,

package/dist/runner/container-policy.js

@@ -35,6 +35,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.invalidImageReason = invalidImageReason;
 exports.unsafeServiceOptions = unsafeServiceOptions;
+exports.splitReservedOptions = splitReservedOptions;
 exports.unsafeServiceVolumeReason = unsafeServiceVolumeReason;
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
@@ -125,6 +126,37 @@ function unsafeServiceOptions(args) {
     }
     return found;
 }
+/**
+ * Split `args` into the options to pass on and the `reserved` ones (by
+ * flag name, in order), dropping a reserved option's value too. Values of
+ * other options are kept as they are, so `--health-cmd --entrypoint` stays.
+ */
+function splitReservedOptions(args, reserved) {
+    const kept = [];
+    const dropped = [];
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        let name;
+        let takesNext = false;
+        if (arg.startsWith('--')) {
+            const [flag, value] = arg.split(/=(.*)/s);
+            name = flag;
+            takesNext = value === undefined && VALUE_OPTIONS.has(flag);
+        }
+        else if (arg.startsWith('-') && arg.length > 1) {
+            name = arg.slice(0, 2);
+            takesNext = arg.length === 2 && SHORT_VALUE_OPTIONS.has(name);
+        }
+        const span = takesNext ? args.slice(i, i + 2) : [arg];
+        if (name !== undefined && reserved.has(name))
+            dropped.push(name);
+        else
+            kept.push(...span);
+        if (takesNext)
+            i++;
+    }
+    return { kept, dropped };
+}
 const VOLUME_NAME = /^[A-Za-z0-9][A-Za-z0-9_.-]*$/;
 function realpathOrSelf(p) {
     try {

package/dist/runner/docker-action.js

@@ -131,7 +131,7 @@ async function executeDockerAction(action, actionPath, step, actionInputs, calle
             image,
             args,
             entrypoint: action.runs.entrypoint,
-            workingDir: process.cwd(),
+            workingDir: runtime.workspace,
             readOnlyPaths: (0, job_container_1.protectedWorkspacePaths)(options),
             exchangeDir,
             env: {

package/dist/runner/executor.js

@@ -49,6 +49,7 @@ const job_plan_1 = require("./job-plan");
 const job_runtime_1 = require("./job-runtime");
 const job_container_1 = require("./job-container");
 const steps_1 = require("./steps");
+const checkout_1 = require("./checkout");
 const actions_1 = require("./actions");
 const scheduler_1 = require("./scheduler");
 // Public API, kept here so `executor` stays the entry point.
@@ -161,6 +162,15 @@ async function executeWorkflow(filePath, options = {}, internal = {}) {
                 return { success: false, jobs: [], duration: Date.now() - startTime };
             }
             logger_1.logger.info(`Executing workflow: ${parsed.file.name}`);
+            const concurrencyAt = [
+                ...(parsed.file.concurrency ? ['workflow'] : []),
+                ...Object.entries(parsed.file.jobs)
+                    .filter(([, job]) => job.concurrency)
+                    .map(([id]) => `jobs.${id}`)
+            ];
+            if (concurrencyAt.length > 0) {
+                logger_1.logger.info(`concurrency: isn't applied in a local run (${concurrencyAt.join(', ')}): it doesn't queue behind or cancel other runs, and jobs run as needs: and --parallel allow`);
+            }
             options = {
                 ...options,
                 inputs: {
@@ -291,11 +301,20 @@ async function executeWorkflow(filePath, options = {}, internal = {}) {
                     // its running step killed and its containers removed.
                     const runCombination = async (jobIndex, matrixValues, signal) => {
                         const jobLabel = labelOf(matrixValues);
-                        const runtime = (0, job_runtime_1.createJobRuntime)(github, runDir, {
-                            shell: job.defaults?.run?.shell ?? parsed.file.defaults?.run?.shell,
+                        // With --isolate-workspace, the job (and github.workspace) gets
+                        // its own copy of the working copy.
+                        const workspace = options.isolateWorkspace
+                            ? (0, checkout_1.createIsolatedWorkspace)(process.cwd(), runDir)
+                            : process.cwd();
+                        const comboGithub = options.isolateWorkspace
+                            ? { ...github, workspace }
+                            : github;
+                        const runtime = (0, job_runtime_1.createJobRuntime)(comboGithub, runDir, {
+                            shell: job.defaults?.run?.shell ??
+                                parsed.file.defaults?.run?.shell,
                             workingDirectory: job.defaults?.run?.['working-directory'] ??
                                 parsed.file.defaults?.run?.['working-directory']
-                        });
+                        }, workspace);
                         runtime.signal = signal;
                         // Workflow-level env can't reference `env` itself; job-level
                         // env sees the workflow env plus matrix (matching GitHub's
@@ -303,17 +322,17 @@ async function executeWorkflow(filePath, options = {}, internal = {}) {
                         const workflowEnv = {
                             ...options.env,
                             ...(0, expression_1.substituteRecord)(parsed.file.env, {
-                                ...(0, expression_1.createContext)({ ...options.env }, inputs, options.secrets, github),
+                                ...(0, expression_1.createContext)({ ...options.env }, inputs, options.secrets, comboGithub),
                                 vars
                             })
                         };
                         const jobEnv = (0, expression_1.substituteRecord)(job.env, {
-                            ...(0, expression_1.createContext)(workflowEnv, inputs, options.secrets, github, matrixValues),
+                            ...(0, expression_1.createContext)(workflowEnv, inputs, options.secrets, comboGithub, matrixValues),
                             needs,
                             vars
                         });
                         const jobCtx = {
-                            ...(0, expression_1.createContext)({ ...workflowEnv, ...jobEnv }, inputs, options.secrets, github, matrixValues),
+                            ...(0, expression_1.createContext)({ ...workflowEnv, ...jobEnv }, inputs, options.secrets, comboGithub, matrixValues),
                             needs,
                             vars,
                             job: { status: 'success' },
@@ -526,6 +545,9 @@ async function executeWorkflow(filePath, options = {}, internal = {}) {
                         }
                         finally {
                             await stopping;
+                            if (options.isolateWorkspace) {
+                                (0, checkout_1.removeIsolatedWorkspace)(workspace);
+                            }
                         }
                         const jobSuccess = stepResults.every((s) => s.success || s.step['continue-on-error']);
                         // Job-level continue-on-error (often