Repository navigation
feat(action): add composite GitHub Action to install gddy CLI - #301
Merged
Merged
Conversation
Adds action/action.yml wrapping install.sh/install.ps1 so workflows can install gddy via `uses: godaddy/cli/action@action-v1`. Versioned as its own release-please package (action-vX.Y.Z tags, floating action-v1 major tag) so action-only changes never bump or interleave with the CLI's own gddy release train. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
jpage-godaddy
requested review from
axburgess-godaddy,
jpearlman-godaddy,
mguerrero3-godaddy,
qcai-godaddy and
rts1-godaddy
as code owners
September 29, 2026 19:43
Contributor
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
Shell injection risks and action-only release handling can compromise runners and break default CLI installation.
Review effort: Balanced
Findings: 3
Open (6)
What changed in this PR
Adds a composite GitHub Action for installing gddy, with independent release automation and cross-platform tests.
Changes:
- Adds Linux, macOS, and Windows installation action.
- Adds action-specific release versioning and floating major tag.
- Documents and tests latest and pinned installations.
| File | Description |
|---|---|
action/action.yml |
Defines the composite installer action. |
.github/workflows/action-test.yml |
Tests installations across supported runners. |
.github/workflows/release.yml |
Publishes the floating action major tag. |
release-please-config.json |
Configures the action release package. |
.release-please-manifest.json |
Initializes action version tracking. |
README.md |
Documents action usage. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
- Pass the version input through env vars instead of template interpolation in both install steps, closing a command-injection vector via a crafted `version` value. - Never let an action-only release become the repo's "latest" release (it has no binaries attached, and gddy's own install one-liner depends on `releases/latest/download/*`). - Gate the CLI build/attach pipeline on the rust package's own release-please output instead of the cross-package aggregate, so an action-only release can no longer trigger a spurious CLI build. - Enable separate-pull-requests so simultaneous rust/action version bumps never get bundled into one release PR. - Move install.sh/install.ps1 under action/ so the action's own release-please package actually covers the scripts it runs; their release-asset download URLs are unaffected since GitHub Release assets are keyed by filename, not source path. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
install.ps1's normal PATH update writes to the Windows user's registry PATH, which is the right behavior for a real end-user install but an unwanted, persistent side effect on a (especially self-hosted) CI runner. Add -SkipPathUpdate so the action can rely solely on $GITHUB_PATH for job-scoped PATH, same as the Linux/macOS step already does. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Contributor
There was a problem hiding this comment.
Copilot review overview
🟢 Approval recommended
The action, installers, tests, documentation, and independent release workflow are consistently integrated with no unresolved issues found.
Review effort: Balanced
Findings: None
Resolved since last review (1)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
action/action.yml, a composite GitHub Action that wrapsaction/install.sh/action/install.ps1so workflows can installgddyviauses: godaddy/cli/action@action-v1.actionrelease-please package (action-vX.Y.Ztags + a floatingaction-v1major tag), so action-only changes never bump or interleave with the CLI's owngddyrelease train:separate-pull-requests: trueso simultaneous rust/action version bumps never get bundled into one release PR.release_createdoutput (not the cross-package aggregate), so an action-only release can't trigger a spurious CLI build.releases/latest/download/install.shmust keep pointing at a real gddy release).install.sh/install.ps1moved from the repo root intoaction/, so the action's release-please package actually covers the installer scripts it runs. Their public download URLs (releases/.../download/install.sh) are unaffected — GitHub Release assets are keyed by filename, not source path — and the twogh release uploadcall sites (release.yml, rust-port-alpha.yaml) were updated accordingly..github/workflows/action-test.ymlto exercise the action end-to-end (latest + a pinned version) on Ubuntu/macOS/Windows.The action itself passes the
versioninput through environment variables (not template-interpolated into the shell/PowerShell source) to close a command-injection vector, and skipsinstall.ps1's normal persistent user-PATH registry write on Windows (relying on$GITHUB_PATHinstead) so it doesn't leave a stale PATH entry on long-lived runners.Test plan
actionlint-clean.action-test.ymlpasses on this PR (latest + pinnedv0.2.23, all three OSes) — confirms the action installsgddyand adds it toPATH.cicd,drift,CodeQL/Analyze, andConventional commitall pass.separate-pull-requests, installer-scripts-out-of-package-scope, and a Windows PATH-persistence side effect) — all fixed and resolved; final review is a clean approval with zero findings.action/**changes, without touching therust/gddypackage's pending version.🤖 Generated with Claude Code