From af8b61a4b37772122e3925395b1084f1fd8d20ec Mon Sep 17 00:00:00 2001 From: Pranav Zinzurde Date: Mon, 29 Jun 2026 02:46:18 +0530 Subject: [PATCH 1/2] ci: expose built percy on PATH in CLI-branch injection npx percy could not resolve the yarn-linked @percy/cli (yarn link symlinks the package but not its bin), so it downloaded the unrelated public percy@5.0.0 and the inject step failed. Add the yarn global bin to PATH and verify with `percy --version`; link is now best-effort so non-JS repos don't abort. Part of PER-9772. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/test.yml | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index f55daa5..c1dd526 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -57,8 +57,15 @@ jobs: yarn yarn build yarn global:link - cd ${{ github.workspace }} - yarn remove @percy/cli && yarn link `echo $PERCY_PACKAGES` - npx percy --version + # Expose the freshly built `percy` on PATH. yarn link symlinks the + # package but not its bin, so `npx percy` would miss it and download + # the unrelated public `percy`. Link is best-effort (non-JS repos have + # no node project to link into); PATH is what makes percy resolvable. + echo "$(yarn global bin)" >> "$GITHUB_PATH" + export PATH="$(yarn global bin):$PATH" + cd ${{ github.workspace }} + yarn remove @percy/cli >/dev/null 2>&1 || true + yarn link `echo $PERCY_PACKAGES` >/dev/null 2>&1 || true + percy --version - run: make coverage From bc40fc68a7e526e0d00a78c094c716635bb1ca71 Mon Sep 17 00:00:00 2001 From: Pranav Zinzurde Date: Mon, 29 Jun 2026 15:11:59 +0530 Subject: [PATCH 2/2] ci: pass CLI branch via env, not inline (fixes semgrep run-shell-injection) git clone interpolated github.event.inputs.branch directly into the shell. Pass it via env ($BRANCH); it is regex-validated upstream. Part of PER-9772. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/test.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index c1dd526..56877a9 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -48,9 +48,11 @@ jobs: restore-keys: v1/${{ runner.os }}/node-${{ matrix.node }}/ - name: Set up @percy/cli from git if: ${{ github.event_name == 'workflow_dispatch' }} + env: + BRANCH: ${{ github.event.inputs.branch }} run: | cd /tmp - git clone --branch ${{ github.event.inputs.branch }} --depth 1 https://github.com/percy/cli + git clone --branch "$BRANCH" --depth 1 https://github.com/percy/cli cd cli PERCY_PACKAGES=`find packages -mindepth 1 -maxdepth 1 -type d | sed -e 's/packages/@percy/g' | tr '\n' ' '` git log -1