feat: add strict input validation and robust plugin registration - #189

Walkthrough

The PR introduces stricter input validation for features (default/full), replaces GitHub Actions error signaling with exception throwing, refactors shell command execution with a new execOrThrow helper, simplifies conditional branching through map lookups, and improves workspace and cache directory handling.

Changes

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

• execOrThrow helper: Verify implementation handles edge cases (e.g., signal termination, command not found) consistently across both plugin files
• Cache source computation: Review the binary search and fallback logic in checkOrInstallTool for robustness when no plugins are found
• Workspace directory fallback: Confirm the fallback to current working directory doesn't introduce unintended side effects in CI environments
• getTargets validation: Ensure the guard clause properly covers all error scenarios

Possibly related PRs

• feat: Update setup Nu for future versions of Nu #157: Modifies plugin registration logic in src/plugins.ts including Nu executable path determination and plugin selection/execution patterns.

Poem

🐰 Shell commands now throw with grace,
Input validation finds its place,
Helpers consolidate the way,
Errors caught without delay,
Caching strategies at play!

Pre-merge checks and finishing touches

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Code Analysis

• Input Validation: Added proper validation for features input with explicit type casting and error handling
• Error Handling: Improved error propagation by replacing core.setFailed() with throw new Error() for better stack traces
• Workspace Safety: Added fallback directory handling for local development scenarios
• Command Execution: Centralized shell command execution with proper error handling in execOrThrow helper
• Code Refactoring: Simplified conditional logic in getTargets() function with early returns and unified platform mapping
• Caching Logic: Enhanced caching strategy with fallback to extract directory when no binaries found

Security Review

• Command Injection Risk: ❗ Direct shell command execution with user inputs (enablePlugins, version) in lines like nu ${script} "'${enablePlugins}'" ${version} could be vulnerable to command injection if inputs are not properly sanitized
• Path Traversal: ⚠️ Using process.env.GITHUB_WORKSPACE without validation could allow directory traversal attacks in certain contexts
• Error Information Leakage: Error messages expose internal paths and command details that could aid attackers

Optimization Suggestions

• Input Sanitization: Implement input validation and sanitization for shell command parameters using libraries like shell-escape
• Error Handling: Create custom error types with sanitized messages for production environments
• Caching Strategy: Consider implementing cache validation to prevent stale cache usage
• Type Safety: Add runtime type validation for environment variables and inputs beyond TypeScript compilation

Overall Quality: 3

Note: While the code improvements show good architectural patterns and error handling, security concerns around command injection and path handling prevent a higher rating. The refactoring demonstrates solid TypeScript practices but requires additional security hardening.