[only21mil]

Problem

The manual Windows Tests workflow pasted its package and files inputs straight into single-quoted PowerShell source:

$package = '${{ inputs.package }}'
$files = '${{ inputs.files }}'

GitHub substitutes the expression before PowerShell parses the script, so a quote in either value changes the script. A file name with an apostrophe (src/it's.test.ts) fails with a ParserError before any test runs, and a value such as x'; Write-Output INJECTED; ' runs as a command. This is a manual workflow_dispatch workflow, so it is a correctness bug in input handling rather than a public exploit.

Change

• The Test step binds the two inputs as step env values (PACKAGE, FILES) and reads them with $env:, the same pattern mobile-eas-production.yml uses for its dispatch inputs. PowerShell now gets the values as data.
• The empty checks use -not $package / -not $files instead of -eq '', so an empty input that arrives as an unset variable ($null) still counts as empty. $null -eq '' is false in PowerShell.

Branching, the $files.Split(' ') splitting, triggers, permissions, package selection and action refs are unchanged.

Scope and approval

A small, focused fix for an obvious bug under CONTRIBUTING.md § Prior approval: a quote in a workflow input breaks or rewrites the Test step's script. It changes one step in one workflow and no product behavior, so no prior issue or discussion was opened. Our open #28749 pins action refs in this same file on other lines; the two do not overlap.

Verification

• actionlint -ignore 'label "blacksmith-8vcpu-windows-2025" is unknown' .github/workflows/windows-tests.yml with actionlint 1.7.12: exit 0. Base gets the same result; unfiltered actionlint reports only the unknown runner label on both.

• Ran the Test step's run: script from base and from this branch under PowerShell 7.6.9 (macOS arm64), modelling the runner's shell: pwsh: expressions substituted into the script text and env: values, $ErrorActionPreference = 'stop' and the $LASTEXITCODE exit check around it, then pwsh -command ". '<file>'". A native vp stub on PATH printed each argument as [arg].

  Inputs	Base	This branch
  both empty, also with the empty variables unset	vp [run] [--parallel] [--concurrency-limit] [4] [--filter] [!t3] [--filter] [!@t3tools/monorepo] [test]	same
  package=packages/shared, also with empty FILES unset	vp [run] [--filter] [./packages/shared] [test]	same
  package=apps/server, files=src/process/externalLauncher.test.ts src/cli/theme.test.ts	vp [test] [run] [src/process/externalLauncher.test.ts] [src/cli/theme.test.ts] in apps/server	same
  files=src/it's.test.ts	ParserError: Unexpected token 's.test.ts', exit 1	vp [test] [run] [src/it's.test.ts]
  files=x'; Write-Output INJECTED; '	prints INJECTED, then vp [test] [run] [x]	vp [test] [run] [x';] [Write-Output] [INJECTED;] [']
  files=$(Write-Output SUBEXPR) ; & | $env:PATH	passed through literally	same

• vp run check:changed 3fd2b855c5c6b9169cdfe3733b34011c1c5ed4b7: format, typecheck (39 packages) and the 1 selected test file pass.

Not checked:

• No run on a Windows runner. The workflow needs the blacksmith-8vcpu-windows-2025 runner, which a fork cannot use, so Windows-only behavior was not exercised: how the runner passes an empty env value, and Windows native argument passing to vp.
• No UI change; this edits a CI workflow only.

Prior PRs

• ci: add on-demand Windows test workflow #9538 by juliusmarminge added this workflow. No earlier PR changed how it passes its inputs.

Generated with Claude Opus 5.5 and GPT-6.1 Terra and GPT-6.1 Sol in T3 Code Nightly

[macroscopeapp]

Approvability

Verdict: Approved at dc86824

Macroscope's review found this PR approvable — Dispatch inputs now reach PowerShell through environment variables, avoiding direct interpolation while preserving empty-input test selection. The change is confined to the existing manual Windows test workflow and leaves permissions and infrastructure unchanged.

^{You can add or adjust custom eligibility rules. Learn more.}

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: pingdotgg/t3code
• Branch: main
• File: .coderabbit.config.ts
• Commit: 3fd2b85
• Layers: Repository TS config
• Review profile: CHILL
• Plan: Advanced
• Run ID: f854ba7a-a3d2-4009-91e9-ad495dbaed02

Commits

Reviewing files that changed from the base of the PR and between 3fd2b85 and dc86824.

Files selected for processing: 1

• .github/workflows/windows-tests.yml

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 2 remain after this review.

Walkthrough

The Windows test workflow passes package and file inputs through environment variables. It uses PowerShell truthiness checks to choose between running all package tests and running the selected package’s suite.

Changes: Windows test input handling

Layer / File(s)	Summary
Test step input handling .github/workflows/windows-tests.yml	The test step reads PACKAGE and FILES from environment variables. A falsy package runs the all-package test command; a truthy package with falsy files proceeds to the package-suite branch.

Estimated code review effort: 2 (Simple) | ~5 minutes

Change: Bug fix

Possibly related PRs

• pingdotgg/t3code#28753: It classifies the Windows test workflow for package-job selection.

Suggested reviewers: macroscopeapp

Merge Risk: Minimal · up to dc868

No actionable merge-blocking risk remains in this workflow change.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: passing workflow dispatch inputs to PowerShell through environment variables.
Description check		The description includes the required Problem, Change, Scope and approval, and Verification sections. It explains the bug, implementation, approval basis, test results, and untested Windows-runner beh…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description includes the required Problem, Change, Scope and approval, and Verification sections. It explains the bug, implementation, approval basis, test results, and untested Windows-runner behavior.

Finishing Touches

Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts