fix(runtime-import): handle repo-root-absolute paths with leading / or //#24903
Merged
fix(runtime-import): handle repo-root-absolute paths with leading / or //#24903
/ or //#24903Conversation
Strip the leading "/" from paths like /.agents/skills/my-skill/instructions.md and /.github/agents/planner.md before the existing prefix checks in processRuntimeImport(). This mirrors the compile-time behavior in ResolveIncludePath (remote_fetch.go) introduced in PR #24501. Add regression tests for: - /.agents/... paths resolving to workspace-root .agents folder - /.github/... paths resolving within .github folder - /etc/passwd (unrecognised prefix) safely falling through to .github/workflows/ Closes #24501 Agent-Logs-Url: https://github.com/github/gh-aw/sessions/8a3e3249-84d4-4655-a138-450674869af8 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Agent-Logs-Url: https://github.com/github/gh-aw/sessions/8a3e3249-84d4-4655-a138-450674869af8 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Fix runtime import resolver for repo-root-absolute paths
fix(runtime-import): handle repo-root-absolute paths with leading Apr 6, 2026
/
Replace single-slash strip with regex /^\/+/ so that paths beginning with // (or any number of slashes) are also normalised before the .agents/ / .github/ prefix checks. Add regression tests for //.agents/ and //.github/. Agent-Logs-Url: https://github.com/github/gh-aw/sessions/26793fd8-125c-4d4e-a130-a9381c998dcf Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Contributor
Author
Copilot
AI
changed the title
fix(runtime-import): handle repo-root-absolute paths with leading
fix(runtime-import): handle repo-root-absolute paths with leading Apr 6, 2026
// or //
Contributor
There was a problem hiding this comment.
Pull request overview
Aligns the runtime import resolver’s path handling with the compile-time resolver by correctly supporting repo-root-absolute include paths that begin with one or more / characters (e.g., /.agents/..., //.github/...).
Changes:
- Update
processRuntimeImportto strip leading/characters only when the remaining path starts with.agents/or.github/(including\variants). - Add regression tests for
/.agents/...,//.agents/...,/.github/...,//.github/..., plus a safety-oriented test for/etc/passwd.
Show a summary per file
| File | Description |
|---|---|
| actions/setup/js/runtime_import.cjs | Adds guarded leading-slash stripping to correctly resolve repo-root-absolute .agents/.github paths at runtime. |
| actions/setup/js/runtime_import.test.cjs | Adds regression tests covering leading-slash variants for .agents/.github and a “non-allowed absolute path” case. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 2/2 changed files
- Comments generated: 1
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The runtime import resolver ignored leading slashes on paths like
/.agents/skills/my-skill/instructions.mdor//.github/agents/planner.md, falling through to the default branch and incorrectly resolving to.github/workflows/.agents/…. The compile-time resolver (ResolveIncludePathinremote_fetch.go) already handled this correctly; the runtime JS resolver was never updated to match.Changes
actions/setup/js/runtime_import.cjs— strip all leading/characters (usingreplace(/^\/+/, "")) before prefix checks, but only when the remainder starts with.agents/or.github/(both separators). This handles single (/), double (//), or any number of leading slashes. Paths with unrecognised prefixes are left unchanged and safely fall through to the existing default branch (confined to.github/workflows/).actions/setup/js/runtime_import.test.cjs— add regression tests for/.agents/…,//.agents/…,/.github/…,//.github/…, and a safety test confirming/etc/passwdnever escapes to the system path.