Problem when NODE_OPTIONS is in the .env file

[mike-potter]

A recent change to the Github Actions here: https://github.blog/changelog/2023-10-05-github-actions-node_options-is-now-restricted-from-github_env/#:~:text=Due%20to%20security%20restrictions%2C%20users,parameter%20using%20'%24GITHUB_ENV'%20command now restricts setting NODE_OPTIONS using $GITHUB_ENV. So this happens now when using this action-dotenv-to-setenv action if your .env file contains the NODE_OPTIONS variable.

Not sure what a workaround would be, since we need this in .env for our local development. Maybe there needs to be a way to specify a filter so that variable is skipped when exporting it to $GITHUB_ENV?

[c-py]

@mike-potter Thanks for raising this.

Taking a look at the new implementation, it seems like it's possible to set NODE_OPTIONS via script output.
actions/runner#2775 (comment)

Without needing too much rejigging, I can see two options.
What option work better for you?

Option 1:

Skip NODE_OPTIONS in the script and log a warning. Something like:

if [[ $key == "NODE_OPTIONS" ]] then echo "Cannot set NODE_OPTIONS"; continue; fi

Or Option 2:

if [[ $key == "NODE_OPTIONS" ]] then echo "node_options=$val" >> $GITHUB_OUTPUT; continue; fi

Then access the NODE_OPTIONS in the subsequent calls

  - name: Tests
    run: npm run test
    env:
      NODE_OPTIONS: ${{steps.set_env.outputs.node_options}}

Happy to implement either, whatever suits better 👍

[mike-potter]

Hmm, Option 2 is very interesting! I think I like that one since then I don't need to hardcode NODE_OPTIONS in the script later. Nice idea!

[c-py]

@mike-potter I have pushed an update to v5 to skip NODE_OPTIONS and instead output it as a variable under node_options. The README has been updated to reflect this new feature 👍

[mike-potter]

Thanks! I'll give it a try