feat: Add support for building Amber from source (#69)

* feat: Add support for building Amber from source

* Add a test

* Use GITHUB_TOKEN

* fix: Replace cargo -C flag with cd command for stability

The -C flag in cargo is unstable and requires the nightly toolchain.
Changed to use `cd && cargo build` instead for better compatibility.

This fixes the failing test-repository-ref CI check.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* security: Fix template injection in test workflow

Pass step outputs through environment variables instead of direct
template expansion to prevent potential code injection attacks.

This addresses the zizmor security warning about template-injection.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* security: Fix template injection vulnerabilities in action.yaml

Pass all GitHub Actions template expansions through environment
variables instead of direct shell interpolation to prevent potential
code injection attacks.

Changes:
- Determine source directory: Pass inputs and step outputs via env vars
- Checkout Amber source: Pass repository URL and ref via env vars
- Main step: Pass action path via env var

This addresses zizmor template-injection warnings in the composite action.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* Restore comment

* build

* refactor: Simplify Rust installation error message

Make the error message less prescriptive by removing the specific
rustup command. Now just hints that Rust toolchain setup may be needed.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* docs: Add documentation for building from source

Add comprehensive documentation for the new amber-repository-ref and
amber-repository-url inputs, including:
- Parameter descriptions in the usage section
- Multiple examples showing different use cases
- Note about Rust toolchain requirements

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>

Author: lens0021

.github/workflows/test.yaml

@@ -88,6 +88,25 @@ jobs:
 
       - run: ./amber --version
 
+  test-repository-ref:
+    name: Test amber-repository-ref
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - uses: ./
+        with:
+          amber-repository-ref: 3742194594cfdf18e034658d1f58a93b3143bbd7
+
+      - run: |
+          which amber
+          amber --version | grep -q 3742194
+          echo 'echo("Hello, Amber!")' > test.ab
+          amber build test.ab
+          bash test.sh
+
   test-output:
     name: Test amber-path output
     runs-on: ubuntu-latest
@@ -101,13 +120,15 @@ jobs:
         with:
           amber-version: 0.5.1-alpha
 
-      - run: |
-          echo "Amber path output: ${{ steps.setup.outputs.amber-path }}"
-          if [ -z "${{ steps.setup.outputs.amber-path }}" ]; then
+      - env:
+          AMBER_PATH: ${{ steps.setup.outputs.amber-path }}
+        run: |
+          echo "Amber path output: $AMBER_PATH"
+          if [ -z "$AMBER_PATH" ]; then
             echo "Error: amber-path output is empty"
             exit 1
           fi
-          if [ ! -x "${{ steps.setup.outputs.amber-path }}" ]; then
+          if [ ! -x "$AMBER_PATH" ]; then
             echo "Error: amber-path does not point to an executable file"
             exit 1
           fi

README.md

@@ -27,6 +27,16 @@ See [action.yaml](action.yaml)
     # Default: 0.5.1-alpha
     amber-version: ""
 
+    # Git repository URL to clone Amber from when building from source.
+    # Default: https://github.com/amber-lang/amber.git
+    amber-repository-url: ""
+
+    # Git ref (commit SHA, branch, or tag) to build Amber from source.
+    # If provided, this overrides 'amber-version' and builds from source.
+    # Examples: main, v0.5.0-alpha, 3742194594cfdf18e034658d1f58a93b3143bbd7
+    # Default: "" (uses pre-built binaries)
+    amber-repository-ref: ""
+
     # Whether to cache Amber binaries
     # Default: true
     enable-cache: ""
@@ -94,6 +104,35 @@ jobs:
   run: echo "Amber installed at ${{ steps.setup-amber.outputs.amber-path }}"
 ```
 
+**Building from source:**
+
+```yaml
+- uses: lens0021/setup-amber@v2
+  with:
+    # Build from a specific commit
+    amber-repository-ref: 3742194594cfdf18e034658d1f58a93b3143bbd7
+```
+
+```yaml
+- uses: lens0021/setup-amber@v2
+  with:
+    # Build from a branch
+    amber-repository-ref: main
+```
+
+```yaml
+- uses: lens0021/setup-amber@v2
+  with:
+    # Build from a custom repository fork
+    amber-repository-url: https://github.com/myusername/amber.git
+    amber-repository-ref: my-feature-branch
+```
+
+> [!NOTE]
+> Building from source requires Rust and Cargo to be available in the environment.
+> GitHub Actions runners include these by default, but if you're using a custom
+> runner, you may need to install the Rust toolchain first.
+
 ## License
 
 This project is licensed under the GNU General Public License v3.0 - see the [LICENSE](LICENSE) file for details.

action.yaml

@@ -7,6 +7,16 @@ inputs:
   amber-version:
     description: The version of Amber to install.
     default: 0.5.1-alpha
+  amber-repository-url:
+    description: >-
+      The Git repository URL to clone Amber from when building from source.
+      Defaults to the official Amber repository.
+    default: https://github.com/amber-lang/amber.git
+  amber-repository-ref:
+    description: >-
+      A Git ref (commit SHA, branch name, or tag name) to build Amber from source.
+      If provided, this overrides 'amber-version' and triggers a build from source.
+    default: ""
   enable-cache:
     description: Whether to cache Amber binaries.
     default: true
@@ -42,16 +52,67 @@ runs:
         } >> "$GITHUB_OUTPUT"
     - name: Cache Amber binaries
       uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+      id: amber-cache
       if: inputs.enable-cache
       with:
         path: ${{ steps.cache-path.outputs.amber_cache_path }}/amber
-        key: setup-amber-${{ runner.os }}-${{ runner.arch }}-${{ inputs.amber-version }}
+        key: >-
+          setup-amber-${{ runner.os }}-${{ runner.arch }}-${{ inputs.amber-repository-ref || inputs.amber-version }}
+    - name: Determine source directory
+      if: inputs.amber-repository-ref != '' && steps.amber-cache.outputs.cache-hit != 'true'
+      id: source-dir
+      shell: bash
+      env:
+        ENABLE_CACHE: ${{ inputs.enable-cache }}
+        CACHE_PATH: ${{ steps.cache-path.outputs.amber_cache_path }}
+        RUNNER_TEMP: ${{ runner.temp }}
+      run: |
+        if [ "$ENABLE_CACHE" = "true" ]; then
+          src_dir="$CACHE_PATH/amber-source"
+        else
+          src_dir="$RUNNER_TEMP/amber-source"
+        fi
+        echo "src_dir=$src_dir" >> "$GITHUB_OUTPUT"
+    - name: Checkout Amber source
+      if: inputs.amber-repository-ref != '' && steps.amber-cache.outputs.cache-hit != 'true'
+      shell: bash
+      env:
+        SOURCE_DIR: ${{ steps.source-dir.outputs.src_dir }}
+        REPO_URL: ${{ inputs.amber-repository-url }}
+        REPO_REF: ${{ inputs.amber-repository-ref }}
+      run: |
+        dest_dir="$SOURCE_DIR"
+        echo "::debug::Checking out Amber source to $dest_dir"
+        if [ -d "$dest_dir/.git" ]; then
+          echo "Source already exists in $dest_dir"
+        else
+          mkdir -p "$dest_dir"
+          cd "$dest_dir"
+          git init
+          # Use the token for authentication if it's a GitHub URL
+          url="$REPO_URL"
+          if [[ "$url" == "https://github.com/"* ]]; then
+            url="${url/https:\/\/github.com\//https://x-access-token:$GITHUB_TOKEN@github.com/}"
+          fi
+          git remote add origin "$url"
+          git fetch --depth 1 origin "$REPO_REF"
+          git checkout FETCH_HEAD
+        fi
+    - name: Cache Rust build artifacts
+      uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2.8.2
+      if: inputs.amber-repository-ref != '' && steps.amber-cache.outputs.cache-hit != 'true'
+      with:
+        workspaces: ${{ steps.source-dir.outputs.src_dir }} -> target
     - id: main
       shell: bash
       env:
+        ACTION_PATH: ${{ github.action_path }}
         SETUP_AMBER_CACHE_PATH: ${{ steps.cache-path.outputs.amber_cache_path }}
         SETUP_AMBER_BIN_PATH: ${{ inputs.bin-path }}
         SETUP_AMBER_VERSION: ${{ inputs.amber-version }}
+        SETUP_AMBER_REPOSITORY_URL: ${{ inputs.amber-repository-url }}
+        SETUP_AMBER_REPOSITORY_REF: ${{ inputs.amber-repository-ref }}
+        SETUP_AMBER_SOURCE_DIR: ${{ steps.source-dir.outputs.src_dir }}
       run: |
         # Download Amber binary
-        bash "${{ github.action_path }}/dist/main.sh"
+        bash "$ACTION_PATH/dist/main.sh"