Refactor Github Action per b/485167538

Author: benknutson-google

.github/actions/bash/action.yml

@@ -24,4 +24,6 @@ runs:
 
     - name: Run
       shell: bash
-      run: ${{ inputs.command }}
+      run: ${INPUTS_COMMAND}
+      env:
+        INPUTS_COMMAND: ${{ inputs.command }}

.github/actions/bazel-docker/action.yml

@@ -47,7 +47,7 @@ runs:
 
     - name: Hook up repository Cache
       shell: bash
-      run: echo "BAZEL_FLAGS=$BAZEL_FLAGS --repository_cache='/workspace/${{ env.REPOSITORY_CACHE_PATH }}'" >> $GITHUB_ENV
+      run: echo "BAZEL_FLAGS=$BAZEL_FLAGS --repository_cache='/workspace/${REPOSITORY_CACHE_PATH}'" >> $GITHUB_ENV
 
     - name: Validate inputs
       if: ${{ (inputs.bash && inputs.bazel) || (!inputs.bash && !inputs.bazel) }}

.github/actions/bazel/action.yml

@@ -78,7 +78,7 @@ runs:
 
     - name: Hook up repository Cache
       shell: bash
-      run: echo "BAZEL_FLAGS=$BAZEL_FLAGS --repository_cache=$(pwd)/${{ env.REPOSITORY_CACHE_PATH }}" >> $GITHUB_ENV
+      run: echo "BAZEL_FLAGS=$BAZEL_FLAGS --repository_cache=$(pwd)/${REPOSITORY_CACHE_PATH}" >> $GITHUB_ENV
 
     - name: Validate inputs
       if: ${{ (inputs.bash && inputs.bazel) || (!inputs.bash && !inputs.bazel) }}
@@ -87,23 +87,30 @@ runs:
 
     - name: Pin Bazel version
       shell: bash
-      run: echo "USE_BAZEL_VERSION=${{ inputs.version }}" >> $GITHUB_ENV
+      run: echo "USE_BAZEL_VERSION=${INPUTS_VERSION}" >> $GITHUB_ENV
+      env:
+        INPUTS_VERSION: ${{ inputs.version }}
 
     - name: Output Bazel version
       shell: bash
       run: bazelisk version
 
     - name: Run Bash
       if: ${{ inputs.bash }}
-      run: ${{ inputs.bash }}
+      run: ${INPUTS_BASH}
       shell: bash
+      env:
+        INPUTS_BASH: ${{ inputs.bash }}
 
     - name: Run Bazel
       if: ${{ !inputs.bash }}
       run: >-
-        bazelisk ${{ steps.bazel.outputs.bazel-startup-flags }}
-        ${{ inputs.bazel }} $BAZEL_FLAGS
+        bazelisk ${STEPS_BAZEL_OUTPUTS_BAZEL_STARTUP_FLAGS}
+        ${INPUTS_BAZEL} $BAZEL_FLAGS
       shell: bash
+      env:
+        STEPS_BAZEL_OUTPUTS_BAZEL_STARTUP_FLAGS: ${{ steps.bazel.outputs.bazel-startup-flags }}
+        INPUTS_BAZEL: ${{ inputs.bazel }}
 
     - name: Save Bazel repository cache
       # Only allow repository cache updates during post-submits.

.github/actions/cross-compile-protoc/action.yml

@@ -28,7 +28,9 @@ runs:
 
     - name: Set protoc environment variable
       shell: bash
-      run: echo "PROTOC=protoc-${{ inputs.architecture }}" >> $GITHUB_ENV
+      run: echo "PROTOC=protoc-${INPUTS_ARCHITECTURE}" >> $GITHUB_ENV
+      env:
+        INPUTS_ARCHITECTURE: ${{ inputs.architecture }}
 
     - name: Extract binary
       id: output

.github/actions/docker/action.yml

@@ -40,7 +40,9 @@ runs:
     - name: Generate docker flags
       if: inputs.platform
       shell: bash
-      run: echo "DOCKER_RUN_FLAGS=--platform ${{inputs.platform}}" >> $GITHUB_ENV
+      run: echo "DOCKER_RUN_FLAGS=--platform ${INPUTS_PLATFORM}" >> $GITHUB_ENV
+      env:
+        INPUTS_PLATFORM: ${{inputs.platform}}
 
     - name: Run Docker
       uses: ./.github/actions/internal/docker-run

.github/actions/internal/bazel-setup/action.yml

@@ -51,8 +51,11 @@ runs:
       shell: bash
       run: >-
         echo "BAZEL_FLAGS=$BAZEL_FLAGS
-        --google_credentials=${{ inputs.credentials-file }}
-        --remote_cache=https://storage.googleapis.com/protobuf-bazel-cache/protobuf/gha/${{ inputs.bazel-cache }}" >> $GITHUB_ENV
+        --google_credentials=${INPUTS_CREDENTIALS_FILE}
+        --remote_cache=https://storage.googleapis.com/protobuf-bazel-cache/protobuf/gha/${INPUTS_BAZEL_CACHE}" >> $GITHUB_ENV
+      env:
+        INPUTS_CREDENTIALS_FILE: ${{ inputs.credentials-file }}
+        INPUTS_BAZEL_CACHE: ${{ inputs.bazel-cache }}
 
     - name: Configure Bazel cache writing
       # External runs should never write to our caches.

.github/actions/internal/docker-run/action.yml

@@ -41,22 +41,32 @@ runs:
       shell: bash
       if: ${{ inputs.docker-cache && steps.check-docker-cache.outputs.cache-hit != 'true' }}
       run: >
-        time docker pull -q ${{ inputs.image }} &&
-        mkdir -p ci/docker/$(dirname ${{ inputs.image }}) &&
-        time docker image save ${{ inputs.image }} --output ./ci/docker/${{ inputs.image }}.tar
+        time docker pull -q ${INPUTS_IMAGE} &&
+        mkdir -p ci/docker/$(dirname ${INPUTS_IMAGE}) &&
+        time docker image save ${INPUTS_IMAGE} --output ./ci/docker/${INPUTS_IMAGE}.tar
+      env:
+        INPUTS_IMAGE: ${{ inputs.image }}
 
     - name: Use the cached image on cache hit
       shell: bash
       if: ${{ inputs.docker-cache && steps.check-docker-cache.outputs.cache-hit == 'true' }}
-      run: time docker image load --input ./ci/docker/${{ inputs.image }}.tar
+      run: time docker image load --input ./ci/docker/${INPUTS_IMAGE}.tar
+      env:
+        INPUTS_IMAGE: ${{ inputs.image }}
 
     - name: Pull fresh docker image
       shell: bash
       if: ${{ !inputs.docker-cache }}
-      run: time docker pull -q ${{ inputs.image }}
+      run: time docker pull -q ${INPUTS_IMAGE}
+      env:
+        INPUTS_IMAGE: ${{ inputs.image }}
 
     - name: Run docker
       shell: bash
       run: >
-        time docker run ${{ inputs.run-flags}} -v${{ github.workspace }}:/workspace
-        ${{ inputs.image }} ${{ inputs.command }}
+        time docker run ${INPUTS_RUN_FLAGS} -v${{ github.workspace }}:/workspace
+        ${INPUTS_IMAGE} ${INPUTS_COMMAND}
+      env:
+        INPUTS_RUN_FLAGS: ${{ inputs.run-flags}}
+        INPUTS_IMAGE: ${{ inputs.image }}
+        INPUTS_COMMAND: ${{ inputs.command }}

.github/actions/internal/gcloud-auth/action.yml

@@ -27,7 +27,9 @@ runs:
 
     - name: Store credentials path
       shell: bash
-      run: echo "CREDENTIALS_FILE=${{ steps.auth.outputs.credentials_file_path }}" >> $GITHUB_ENV
+      run: echo "CREDENTIALS_FILE=${STEPS_AUTH_OUTPUTS_CREDENTIALS_FILE_PATH}" >> $GITHUB_ENV
+      env:
+        STEPS_AUTH_OUTPUTS_CREDENTIALS_FILE_PATH: ${{ steps.auth.outputs.credentials_file_path }}
 
     - name: Fix credentials path (Windows)
       if: ${{ runner.os == 'Windows' }}
@@ -39,4 +41,4 @@ runs:
     - name: Output credentials file
       id: output
       shell: bash
-      run: echo "credentials-file=${{ env.CREDENTIALS_FILE }}" >> $GITHUB_OUTPUT
+      run: echo "credentials-file=${CREDENTIALS_FILE}" >> $GITHUB_OUTPUT

.github/actions/internal/repository-cache-restore/action.yml

@@ -24,8 +24,10 @@ runs:
       run: |
         REPOSITORY_CACHE_BASE=repository-cache-${{ github.base_ref || github.ref_name }}-${{ runner.os }}
         echo "REPOSITORY_CACHE_BASE=$REPOSITORY_CACHE_BASE" >> $GITHUB_ENV
-        echo "REPOSITORY_CACHE_NAME=$REPOSITORY_CACHE_BASE-${{ inputs.bazel-cache}}-${{ github.sha }}" >> $GITHUB_ENV
+        echo "REPOSITORY_CACHE_NAME=$REPOSITORY_CACHE_BASE-${INPUTS_BAZEL_CACHE}-${{ github.sha }}" >> $GITHUB_ENV
         echo "REPOSITORY_CACHE_PATH=.repository-cache" >> $GITHUB_ENV
+      env:
+        INPUTS_BAZEL_CACHE: ${{ inputs.bazel-cache}}
 
     - name: Restore Bazel repository cache
       id: restore-cache

.github/workflows/forked_pr_workflow_check.yml

@@ -24,4 +24,6 @@ jobs:
     steps:
       - run: >
           ${{ github.event.pull_request.head.repo.full_name == 'protocolbuffers/protobuf' }} ||
-          (echo "This pull request is from an unsafe fork (${{ github.event.pull_request.head.repo.full_name }}) and isn't allowed to modify workflow files!" && exit 1)
+          (echo "This pull request is from an unsafe fork (${GITHUB_EVENT_PULL_REQUEST_HEAD_REPO_FULL_NAME}) and isn't allowed to modify workflow files!" && exit 1)
+        env:
+          GITHUB_EVENT_PULL_REQUEST_HEAD_REPO_FULL_NAME: ${{ github.event.pull_request.head.repo.full_name }}