From 3ff5d41ca504004d2d55c3a050f3851d2ba7cbd5 Mon Sep 17 00:00:00 2001
From: Leynos <leynos@troubledskies.net>
Date: Mon, 23 Jun 2025 23:17:07 +0100
Subject: [PATCH 1/2] fix upload codescene env

---
 .github/actions/upload-codescene-coverage/CHANGELOG.md | 4 ++++
 .github/actions/upload-codescene-coverage/README.md    | 5 ++---
 .github/actions/upload-codescene-coverage/action.yml   | 9 +++++----
 3 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/.github/actions/upload-codescene-coverage/CHANGELOG.md b/.github/actions/upload-codescene-coverage/CHANGELOG.md
index 607e6cbc..f9a3d815 100644
--- a/.github/actions/upload-codescene-coverage/CHANGELOG.md
+++ b/.github/actions/upload-codescene-coverage/CHANGELOG.md
@@ -40,3 +40,7 @@
 - Ensure `CS_ACCESS_TOKEN` and `CODESCENE_CLI_SHA256` environment variables are
   derived from the corresponding inputs. This prevents action load failures
   caused by unsupported `secrets` or `vars` expressions.
+
+## v1.5.2
+- Remove unsupported `env` block from the `runs` section.
+- Export `CS_ACCESS_TOKEN` and `CODESCENE_CLI_SHA256` via a setup step.
diff --git a/.github/actions/upload-codescene-coverage/README.md b/.github/actions/upload-codescene-coverage/README.md
index 9ef846a9..8aa7067b 100644
--- a/.github/actions/upload-codescene-coverage/README.md
+++ b/.github/actions/upload-codescene-coverage/README.md
@@ -18,9 +18,8 @@ installer script. If the optional `installer-checksum` input is set,
 the installer is validated before execution. Any other value for
 `format` results in an error.
 
-The provided `access-token` and `installer-checksum` inputs become the
-`CS_ACCESS_TOKEN` and `CODESCENE_CLI_SHA256` environment variables
-available to steps within the action.
+The action exports the `access-token` and `installer-checksum` inputs as
+`CS_ACCESS_TOKEN` and `CODESCENE_CLI_SHA256` for use by later steps.
 
 ## Environment variables
 
diff --git a/.github/actions/upload-codescene-coverage/action.yml b/.github/actions/upload-codescene-coverage/action.yml
index b0541ab0..0a2ff573 100644
--- a/.github/actions/upload-codescene-coverage/action.yml
+++ b/.github/actions/upload-codescene-coverage/action.yml
@@ -18,11 +18,12 @@ inputs:
     required: false
 runs:
   using: composite
-  # derive environment from inputs; actions cannot access `secrets` or `vars`
-  env:
-    CS_ACCESS_TOKEN: ${{ inputs.access-token }}
-    CODESCENE_CLI_SHA256: ${{ inputs.installer-checksum }}
   steps:
+    - name: Export env for later steps
+      run: |
+        echo "CS_ACCESS_TOKEN=${{ inputs.access-token }}" >> "$GITHUB_ENV"
+        echo "CODESCENE_CLI_SHA256=${{ inputs.installer-checksum }}" >> "$GITHUB_ENV"
+      shell: bash
     - name: Validate inputs
       run: |
         case "${{ inputs.format }}" in

From 3d1bf28a018779d1a66c2bef52dcb81302cb7fb0 Mon Sep 17 00:00:00 2001
From: Leynos <leynos@troubledskies.net>
Date: Tue, 24 Jun 2025 00:34:09 +0100
Subject: [PATCH 2/2] Use `printf` instead of `echo`

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
---
 .github/actions/upload-codescene-coverage/action.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/actions/upload-codescene-coverage/action.yml b/.github/actions/upload-codescene-coverage/action.yml
index 0a2ff573..43427756 100644
--- a/.github/actions/upload-codescene-coverage/action.yml
+++ b/.github/actions/upload-codescene-coverage/action.yml
@@ -21,8 +21,8 @@ runs:
   steps:
     - name: Export env for later steps
       run: |
-        echo "CS_ACCESS_TOKEN=${{ inputs.access-token }}" >> "$GITHUB_ENV"
-        echo "CODESCENE_CLI_SHA256=${{ inputs.installer-checksum }}" >> "$GITHUB_ENV"
+        printf 'CS_ACCESS_TOKEN=%s\n' "${{ inputs.access-token }}" >>"${GITHUB_ENV}"
+        printf 'CODESCENE_CLI_SHA256=%s\n' "${{ inputs.installer-checksum }}" >>"${GITHUB_ENV}"
       shell: bash
     - name: Validate inputs
       run: |