Absolute `path` silently bypasses `.gcloudignore` exclusions

[chor4o]

TL;DR

With an absolute path, process_gcloudignore: true silently fails to exclude matching files. An ignored file is still passed to Bucket.upload().

Expected behavior

Files matched by the root .gcloudignore must not be uploaded, whether path is relative or absolute.

Observed behavior

With path: fixture, only public.txt reaches upload. With the absolute path to the same directory, both public.txt and the ignored secret.txt reach upload.

Action YAML

name: Reproduce absolute path ignore issue
on:
  workflow_dispatch:

permissions:
  contents: read
  id-token: write

jobs:
  reproduce:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Create harmless fixtures
        run: |
          mkdir -p fixture
          printf 'public\n' > fixture/public.txt
          printf 'FAKE_SECRET_DO_NOT_UPLOAD\n' > fixture/secret.txt
          printf 'fixture/secret.txt\n' > .gcloudignore

      - uses: google-github-actions/auth@v3
        with:
          workload_identity_provider: ${{ secrets.WIF_PROVIDER }}
          service_account: ${{ secrets.SERVICE_ACCOUNT }}

      - uses: google-github-actions/upload-cloud-storage@v3
        with:
          path: ${{ github.workspace }}/fixture
          destination: your-test-bucket
          parent: false
          process_gcloudignore: true

Log output

No GitHub Actions run was performed. The issue was reproduced locally
with Bucket.upload() mocked; no GCS request was made.

relative: uploaded=[fixture/public.txt], ignoreErrors=0
absolute: uploaded=[fixture/public.txt, fixture/secret.txt], ignoreErrors=2

Tested commit: d1308790579b5dcf26c7354c32ffbd2b9aa89377

Additional information

Root cause: src/main.ts passes path.join(root, files[i]) to ignores.ignores(). With an absolute root, the ignore package throws RangeError. The catch block logs “skipping” but leaves the file in files, so it still reaches Bucket.upload().

Source:

upload-cloud-storage/src/main.ts

Lines 114 to 125 in d130879

	}
	for (let i = 0; i < files.length; i++) {
	const name = path.join(root, files[i]);
	try {
	if (ignores.ignores(name)) {
	core.debug(`Ignoring ${name} because of ignore file`);
	files.splice(i, 1);
	i--;
	}
	} catch (err) {
	const msg = errorMessage(err);

Suggested fix: evaluate each filename relative to the repository root and fail closed if an ignore check errors. Please add regression tests for both relative and absolute path.

Related issues: #248 and #357 discuss path handling, but neither describes this silent upload behavior.

The local test used only a fake secret and a mocked upload. No real bucket or credentials were accessed.

[rootkiller6788]

Confirmed this locally against the tests/main.test.ts harness with Bucket.upload mocked - same result, all six .txt files reach upload when path is absolute.

The reason is that ignore gets an absolute path: files comes out of expandGlob relative to absoluteRoot, so path.join(root, files[i]) is only workspace-relative while root is relative. Once it's absolute, ignores() throws a RangeError and the catch keeps the file.

I'll send a patch that builds the path from absoluteRoot instead, relative to the workspace, and drops files it can't match (the fail-closed bit you mentioned).