Description:
Boolean inputs are parsed by comparing their uppercased value with TRUE. Any other non-empty value is silently interpreted as false, so mistakes such as verify-signature: ture disable the requested behavior instead of failing clearly. Replace this behavior with strict parsing that accepts only supported boolean values and reports the input name and invalid value.
Apply the behavior consistently to check-latest, force-download, set-default, verify-signature, overwrite-settings, show-download-progress, and problem-matcher. Add unit tests for valid values, defaults, casing, whitespace, and invalid values.
Task version:
v6
Platform:
Runner type:
Repro steps:
Configure an input with an invalid boolean value, for example:
- uses: actions/setup-java@v6
with:
distribution: temurin
java-version: '21'
verify-signature: ture
Expected behavior:
The action fails before installation with a descriptive validation error identifying verify-signature and its invalid value.
Actual behavior:
The invalid value is silently interpreted as false, and installation continues without signature verification.
Description:
Boolean inputs are parsed by comparing their uppercased value with
TRUE. Any other non-empty value is silently interpreted asfalse, so mistakes such asverify-signature: turedisable the requested behavior instead of failing clearly. Replace this behavior with strict parsing that accepts only supported boolean values and reports the input name and invalid value.Apply the behavior consistently to
check-latest,force-download,set-default,verify-signature,overwrite-settings,show-download-progress, andproblem-matcher. Add unit tests for valid values, defaults, casing, whitespace, and invalid values.Task version:
v6
Platform:
Runner type:
Repro steps:
Configure an input with an invalid boolean value, for example:
Expected behavior:
The action fails before installation with a descriptive validation error identifying
verify-signatureand its invalid value.Actual behavior:
The invalid value is silently interpreted as
false, and installation continues without signature verification.