run script copies back only runner file commands

.github/dependabot.yml

@@ -1,28 +0,0 @@
-version: 2
-
-updates:
-  # Group updates into a single PR per workspace package
-  - package-ecosystem: npm
-    directory: "/packages/docker"
-    schedule:
-      interval: weekly
-    groups:
-      all-dependencies:
-        patterns:
-          - "*"
-  - package-ecosystem: npm
-    directory: "/packages/hooklib"
-    schedule:
-      interval: weekly
-    groups:
-      all-dependencies:
-        patterns:
-          - "*"
-  - package-ecosystem: npm
-    directory: "/packages/k8s"
-    schedule:
-      interval: weekly
-    groups:
-      all-dependencies:
-        patterns:
-          - "*"

package-lock.json

@@ -3165,9 +3165,9 @@
       "license": "MIT"
     },
     "node_modules/js-yaml": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",
-      "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==",
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz",
+      "integrity": "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==",
       "license": "MIT",
       "dependencies": {
         "argparse": "^2.0.1"

packages/docker/package-lock.json

@@ -4656,9 +4656,9 @@
       }
     },
     "node_modules/glob": {
-      "version": "10.5.0",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-10.5.0.tgz",
-      "integrity": "sha512-DfXN8DfhJ7NH3Oe7cFmu3NCu1wKbkReJ8TorzSAFbSKrlNaQSKfIzqYqVY8zlbs2NLBbWpRiU52GX2PbaBVNkg==",
+      "version": "10.4.5",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-10.4.5.tgz",
+      "integrity": "sha512-7Bv8RF0k6xjo7d4A/PxYLbUCfb6c+Vpd2/mB2yRDlew7Jb5hEXiCD9ibfO7wpk8i4sevK6DFny9h7EYbM3/sHg==",
       "dev": true,
       "license": "ISC",
       "dependencies": {

packages/hooklib/package-lock.json

@@ -2803,9 +2803,9 @@
       "license": "ISC"
     },
     "node_modules/js-yaml": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.1.tgz",
-      "integrity": "sha512-qQKT4zQxXl8lLwBtHMWwaTcGfFOZviOJet3Oy/xmGk2gZH677CJM9EvtfdSkgWcATZhj/55JZ0rmy3myCT5lsA==",
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz",
+      "integrity": "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {

packages/k8s/package-lock.json

@@ -4071,9 +4071,9 @@
       }
     },
     "node_modules/glob": {
-      "version": "10.5.0",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-10.5.0.tgz",
-      "integrity": "sha512-DfXN8DfhJ7NH3Oe7cFmu3NCu1wKbkReJ8TorzSAFbSKrlNaQSKfIzqYqVY8zlbs2NLBbWpRiU52GX2PbaBVNkg==",
+      "version": "10.4.5",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-10.4.5.tgz",
+      "integrity": "sha512-7Bv8RF0k6xjo7d4A/PxYLbUCfb6c+Vpd2/mB2yRDlew7Jb5hEXiCD9ibfO7wpk8i4sevK6DFny9h7EYbM3/sHg==",
       "dev": true,
       "license": "ISC",
       "dependencies": {

packages/k8s/src/hooks/run-script-step.ts

@@ -23,52 +23,25 @@ export async function runScriptStep(
   )
 
   const workdir = dirname(process.env.RUNNER_WORKSPACE as string)
-  const runnerTemp = `${workdir}/_temp`
   const containerTemp = '/__w/_temp'
-  const containerTempSrc = '/__w/_temp_pre'
-  // Ensure base and staging dirs exist before copying
-  await execPodStep(
-    [
-      'sh',
-      '-c',
-      'mkdir -p /__w && mkdir -p /__w/_temp && mkdir -p /__w/_temp_pre'
-    ],
-    state.jobPod,
-    JOB_CONTAINER_NAME
-  )
-  await execCpToPod(state.jobPod, runnerTemp, containerTempSrc)
+  const runnerTemp = `${workdir}/_temp`
+  await execCpToPod(state.jobPod, runnerTemp, containerTemp)
 
   // Copy GitHub directories from temp to /github
-  // Merge strategy:
-  // - Overwrite files in _runner_file_commands
-  // - Append files not already present elsewhere
-  const mergeCommands = [
-    'set -e',
-    'mkdir -p /__w/_temp /__w/_temp_pre',
-    'SRC=/__w/_temp_pre',
-    'DST=/__w/_temp',
-    // Overwrite _runner_file_commands
-    'cp -a "$SRC/_runner_file_commands/." "$DST/_runner_file_commands"',
-    `find "$SRC" -type f ! -path "*/_runner_file_commands/*" -exec sh -c '
-    rel="\${1#$2/}"
-    target="$3/$rel"
-    mkdir -p "$(dirname "$target")"
-    cp -a "$1" "$target"
-  ' _ {} "$SRC" "$DST" \\;`,
-    // Remove _temp_pre after merging
-    'rm -rf /__w/_temp_pre'
+  const setupCommands = [
+    'mkdir -p /github',
+    'cp -r /__w/_temp/_github_home /github/home',
+    'cp -r /__w/_temp/_github_workflow /github/workflow'
   ]
 
   try {
     await execPodStep(
-      ['sh', '-c', mergeCommands.join(' && ')],
+      ['sh', '-c', shlex.quote(setupCommands.join(' && '))],
       state.jobPod,
       JOB_CONTAINER_NAME
     )
   } catch (err) {
-    core.debug(`Failed to merge temp directories: ${JSON.stringify(err)}`)
-    const message = (err as any)?.response?.body?.message || err
-    throw new Error(`failed to merge temp dirs: ${message}`)
+    core.debug(`Failed to copy GitHub directories: ${JSON.stringify(err)}`)
   }
 
   // Execute the entrypoint script
@@ -99,7 +72,7 @@ export async function runScriptStep(
     await execCpFromPod(
       state.jobPod,
       `${containerTemp}/_runner_file_commands`,
-      `${workdir}/_temp`
+      `${runnerTemp}`
     )
   } catch (error) {
     core.warning('Failed to copy _temp from pod')

packages/k8s/src/k8s/index.ts

@@ -831,7 +831,7 @@ export async function isPodContainerAlpine(
       [
         'sh',
         '-c',
-        `[ $(cat /etc/*release* | grep -i -e "^ID=*alpine*" -c) != 0 ] || exit 1`
+        `'[ $(cat /etc/*release* | grep -i -e "^ID=*alpine*" -c) != 0 ] || exit 1'`
       ],
       podName,
       containerName

packages/k8s/src/k8s/utils.ts

@@ -288,11 +288,6 @@ function mergeLists<T>(base?: T[], from?: T[]): T[] {
 }
 
 export function fixArgs(args: string[]): string[] {
-  // Preserve shell command strings passed via `sh -c` without re-tokenizing.
-  // Retokenizing would split the script into multiple args, breaking `sh -c`.
-  if (args.length >= 2 && args[0] === 'sh' && args[1] === '-c') {
-    return args
-  }
   return shlex.split(args.join(' '))
 }
 

packages/k8s/tests/prepare-job-test.ts

@@ -45,7 +45,7 @@ describe('Prepare job', () => {
       process.env.GITHUB_WORKSPACE as string,
       'myvolume'
     )
-    fs.mkdirSync(userVolumeMount, { recursive: true })
+    fs.mkdirSync(userVolumeMount)
     fs.writeFileSync(path.join(userVolumeMount, 'file.txt'), 'hello')
     prepareJobData.args.container.userMountVolumes = [
       {
@@ -63,7 +63,11 @@ describe('Prepare job', () => {
     )
 
     await execPodStep(
-      ['sh', '-c', '[ "$(cat /__w/myvolume/file.txt)" = "hello" ] || exit 5'],
+      [
+        'sh',
+        '-c',
+        '\'[ "$(cat /__w/myvolume/file.txt)" = "hello" ] || exit 5\''
+      ],
       content!.state!.jobPod,
       JOB_CONTAINER_NAME
     ).then(output => {