Release code-scan-action v0.2.0 - #16
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9510ccbddb
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| @@ -46962,6 +48031,7 @@ function createSubprocessEnv() { | |||
| ); | |||
| delete env.NPM_CONFIG_BEFORE; | |||
| delete env.npm_config_before; | |||
| delete env.NODE_OPTIONS; | |||
There was a problem hiding this comment.
On Windows runners, environment-variable names are case-insensitive, but env is a plain JavaScript object preserving the original key casing. If an earlier untrusted step persists a mixed-case name such as Node_Options=--require=... through $GITHUB_ENV, this exact-key deletion misses it, while the child Node processes still interpret it as NODE_OPTIONS; the payload then runs during installation and scanning, including when the OIDC token is available. Remove every key whose lowercase form is node_options, as is already done for npm config keys.
Useful? React with 👍 / 👎.
1 participant
Automated release mirror for
@promptfoo/code-scan-actionv0.2.0.Source: promptfoo/promptfoo@2c45764
Source tag: code-scan-action-0.2.0
This PR is generated from the monorepo release workflow. The mirror repository validation workflow rebuilds from
.release-source.jsonand checks that the generated artifacts match.