BUILD-10724 fix host paths

[julien-carsique-sonarsource]

The host path cannot be passed as an env, it is modified by the runner hooks.

[hashicorp-vault-sonar-prod]

BUILD-10724

[sonar-review-alpha]

Summary

This PR refactors how host action paths are passed to shell scripts across five GitHub Actions. Instead of using an intermediate environment variable, the scripts now directly reference the input variable using GitHub Actions context. This change affects: config-gradle, config-maven, config-npm, config-pip, and get-build-number actions. The logic remains identical—if host-actions-root is provided, use it; otherwise default to the action's directory.

What reviewers should know

All changes follow the same pattern: removing the env: section that declared HOST_ACTIONS_ROOT and replacing ${HOST_ACTIONS_ROOT} with ${{ inputs.host-actions-root }} in the bash script. The refactoring eliminates an extra layer of variable indirection. Check one file to understand the pattern, then skim the others to confirm they're consistent. The conditional logic (if [[ -z "$host_actions_root" ]]) that determines the fallback behavior is unchanged.

---

• Generate Walkthrough
• Generate Diagram

🗣️ Give feedback

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
5 Accepted issues
0 Dependency risks

Measures
0 Security Hotspots
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Copilot]

Pull request overview

This PR updates several internal composite GitHub Actions to adjust how host-actions-root is read when computing local action paths (used when these actions are invoked from other local actions).

Changes:

• Remove step-level env: HOST_ACTIONS_ROOT: ... wiring.
• Read host-actions-root directly via ${{ inputs.host-actions-root }} inside the bash run: blocks when computing host_actions_root.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
get-build-number/action.yml	Updates local-path resolution to read host-actions-root inline in the bash script.
config-pip/action.yml	Updates local-path resolution to read host-actions-root inline in the bash script.
config-npm/action.yml	Updates local-path resolution to read host-actions-root inline in the bash script.
config-maven/action.yml	Updates local-path resolution to read host-actions-root inline in the bash script.
config-gradle/action.yml	Updates local-path resolution to read host-actions-root inline in the bash script.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[sonar-review-alpha]

Conclusion
This PR inverts a deliberate security fix: the env: → shell-variable indirection pattern that was in place is precisely the mitigation GitHub recommends for script injection. Removing it across all five actions re-opens the vulnerability the original code was written to prevent.

SonarCloud recommendations
Even though the five injection findings are not blocking a named gate condition, I strongly recommend fixing them because they are genuine BLOCKER vulnerabilities:

• config-gradle/action.yml:58
• config-maven/action.yml:59
• config-npm/action.yml:61
• config-pip/action.yml:45
• get-build-number/action.yml:24

${{ inputs.host-actions-root }} is interpolated by the GitHub Actions template engine before the shell is invoked. A caller supplying a value like "; malicious-command #" would execute arbitrary shell code in the runner. The previous env: + ${HOST_ACTIONS_ROOT} pattern is exactly the mitigation GitHub documents for this class of vulnerability — it should be restored, not removed.

🗣️ Give feedback