From 345255ca40c670a0d7b72fcfe7c48525def4e30c Mon Sep 17 00:00:00 2001 From: Pranav Zinzurde Date: Mon, 29 Jun 2026 02:46:26 +0530 Subject: [PATCH 1/2] ci: expose built percy on PATH in CLI-branch injection npx percy could not resolve the yarn-linked @percy/cli (yarn link symlinks the package but not its bin), so it downloaded the unrelated public percy@5.0.0 and the inject step failed. Add the yarn global bin to PATH and verify with `percy --version`; link is now best-effort so non-JS repos don't abort. Part of PER-9772. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/test.yml | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index cdc8cf7..2838f7e 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -60,7 +60,14 @@ jobs: yarn yarn build yarn global:link - cd ${{ github.workspace }} - yarn remove @percy/cli && yarn link `echo $PERCY_PACKAGES` - npx percy --version + # Expose the freshly built `percy` on PATH. yarn link symlinks the + # package but not its bin, so `npx percy` would miss it and download + # the unrelated public `percy`. Link is best-effort (non-JS repos have + # no node project to link into); PATH is what makes percy resolvable. + echo "$(yarn global bin)" >> "$GITHUB_PATH" + export PATH="$(yarn global bin):$PATH" + cd ${{ github.workspace }} + yarn remove @percy/cli >/dev/null 2>&1 || true + yarn link `echo $PERCY_PACKAGES` >/dev/null 2>&1 || true + percy --version - run: npx percy exec --testing -- bundle exec rspec From fdd79e20ec42c1cced9706d8b6cfa1fa4acc7e7f Mon Sep 17 00:00:00 2001 From: Pranav Zinzurde Date: Mon, 29 Jun 2026 15:12:04 +0530 Subject: [PATCH 2/2] ci: pass CLI branch via env, not inline (fixes semgrep run-shell-injection) git clone interpolated github.event.inputs.branch directly into the shell. Pass it via env ($BRANCH); it is regex-validated upstream. Part of PER-9772. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/test.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 2838f7e..da5b3fc 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -51,9 +51,11 @@ jobs: - run: yarn - name: Set up @percy/cli from git if: ${{ github.event_name == 'workflow_dispatch' }} + env: + BRANCH: ${{ github.event.inputs.branch }} run: | cd /tmp - git clone --branch ${{ github.event.inputs.branch }} --depth 1 https://github.com/percy/cli + git clone --branch "$BRANCH" --depth 1 https://github.com/percy/cli cd cli PERCY_PACKAGES=`find packages -mindepth 1 -maxdepth 1 -type d | sed -e 's/packages/@percy/g' | tr '\n' ' '` git log -1