From d73c7ff0ff089a094d0cb3ba562d6e4b83787186 Mon Sep 17 00:00:00 2001
From: Simone <simone@emulab.it>
Date: Sun, 17 May 2026 12:13:22 +0200
Subject: [PATCH] fix(ci): write GITHUB_OUTPUT without BOM; harden artifact
 path
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

PowerShell 5.1 `Out-File -Encoding utf8` prepends a UTF-8 BOM. The
act_runner GITHUB_OUTPUT parser then read the key as "artifact-path",
so steps.invoke-ci.outputs.artifact-path resolved empty. Combined with
the trailing backslash, the upload path became "\" -> the F: drive root,
causing upload-artifact to ingest the entire drive (hundreds of GB of
unrelated files).

- Append outputs with UTF8Encoding($false) (no BOM).
- Throw if artifactPath is empty instead of emitting nothing.
- Drop the trailing backslash; use /*.log for the diagnostic glob.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
---
 .gitea/actions/local-ci-build/action.yml | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/.gitea/actions/local-ci-build/action.yml b/.gitea/actions/local-ci-build/action.yml
index ee11c31..d346f0f 100644
--- a/.gitea/actions/local-ci-build/action.yml
+++ b/.gitea/actions/local-ci-build/action.yml
@@ -275,9 +275,17 @@ runs:
         & $venvPython @pyArgs
         if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
 
-        # Emit outputs consumed by subsequent steps
-        "artifact-path=$artifactPath" | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8
-        "artifact-name=$artifactName" | Out-File -FilePath $env:GITHUB_OUTPUT -Append -Encoding utf8
+        # Emit outputs consumed by subsequent steps.
+        # PowerShell 5.1 `Out-File -Encoding utf8` writes a BOM; the act_runner
+        # GITHUB_OUTPUT parser then reads the key as "artifact-path" and
+        # the output resolves empty. An empty artifact-path made the upload
+        # step glob the entire F: drive. Write UTF-8 without BOM.
+        if (-not $artifactPath) { throw "artifactPath is empty; refusing to emit." }
+        $utf8NoBom = New-Object System.Text.UTF8Encoding($false)
+        [System.IO.File]::AppendAllText(
+            $env:GITHUB_OUTPUT, "artifact-path=$artifactPath`n", $utf8NoBom)
+        [System.IO.File]::AppendAllText(
+            $env:GITHUB_OUTPUT, "artifact-name=$artifactName`n", $utf8NoBom)
 
     # ── Upload build artifacts on success ─────────────────────────────────────
     - name: Upload artifacts
@@ -285,7 +293,7 @@ runs:
       uses: actions/upload-artifact@v3
       with:
         name: ${{ steps.invoke-ci.outputs.artifact-name }}
-        path: ${{ steps.invoke-ci.outputs.artifact-path }}\
+        path: ${{ steps.invoke-ci.outputs.artifact-path }}
         retention-days: ${{ inputs.artifact-retention-days }}
         if-no-files-found: error
 
@@ -295,6 +303,6 @@ runs:
       uses: actions/upload-artifact@v3
       with:
         name: build-logs-${{ github.sha }}
-        path: ${{ steps.invoke-ci.outputs.artifact-path }}\*.log
+        path: ${{ steps.invoke-ci.outputs.artifact-path }}/*.log
         retention-days: 3
         if-no-files-found: ignore