Skip to content

fix: Escape environment names in URL paths across 5 files #4536

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gmlewis merged 2 commits into from
Sep 11, 2026
Merged

fix: Escape environment names in URL paths across 5 files #4536

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
dd84d54
fix: escape environment names in URL paths across 5 files
prasanna8585 Sep 10, 2026
b28e04f
docs: note that environment names are URL path escaped
prasanna8585 Sep 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 17 additions & 6 deletions github/actions_secrets.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@ import (
"context"
"encoding/json"
"fmt"
"net/url"
"strconv"
)

Expand Down Expand Up @@ -84,12 +85,14 @@ func (s *ActionsService) GetOrgPublicKey(ctx context.Context, org string) (*Publ

// GetEnvPublicKey gets a public key that should be used for secret encryption.
//
// Note: the environment name is URL path escaped for you. See: https://pkg.go.dev/net/url#PathEscape .
//
// GitHub API docs: https://docs.github.com/rest/actions/secrets?apiVersion=2022-11-28#get-an-environment-public-key
//
//meta:operation GET /repos/{owner}/{repo}/environments/{environment_name}/secrets/public-key
func (s *ActionsService) GetEnvPublicKey(ctx context.Context, owner, repo, env string) (*PublicKey, *Response, error) {
url := fmt.Sprintf("repos/%v/%v/environments/%v/secrets/public-key", owner, repo, env)
return s.getPublicKey(ctx, url)
u := fmt.Sprintf("repos/%v/%v/environments/%v/secrets/public-key", owner, repo, url.PathEscape(env))
return s.getPublicKey(ctx, u)
}

// Secret represents a repository action secret.
Expand Down Expand Up @@ -190,11 +193,13 @@ func (s *ActionsService) ListOrgSecrets(ctx context.Context, org string, opts *L

// ListEnvSecrets lists all secrets available in an environment.
//
// Note: the environment name is URL path escaped for you. See: https://pkg.go.dev/net/url#PathEscape .
//
// GitHub API docs: https://docs.github.com/rest/actions/secrets?apiVersion=2022-11-28#list-environment-secrets
//
//meta:operation GET /repos/{owner}/{repo}/environments/{environment_name}/secrets
func (s *ActionsService) ListEnvSecrets(ctx context.Context, owner, repo, env string, opts *ListOptions) (*Secrets, *Response, error) {
u := fmt.Sprintf("repos/%v/%v/environments/%v/secrets", owner, repo, env)
u := fmt.Sprintf("repos/%v/%v/environments/%v/secrets", owner, repo, url.PathEscape(env))
u, err := addOptions(u, opts)
if err != nil {
return nil, nil, err
Expand Down Expand Up @@ -260,11 +265,13 @@ func (s *ActionsService) GetOrgSecret(ctx context.Context, org, name string) (*S

// GetEnvSecret gets a single environment secret without revealing its encrypted value.
//
// Note: the environment name is URL path escaped for you. See: https://pkg.go.dev/net/url#PathEscape .
//
// GitHub API docs: https://docs.github.com/rest/actions/secrets?apiVersion=2022-11-28#get-an-environment-secret
//
//meta:operation GET /repos/{owner}/{repo}/environments/{environment_name}/secrets/{secret_name}
func (s *ActionsService) GetEnvSecret(ctx context.Context, owner, repo, env, secretName string) (*Secret, *Response, error) {
u := fmt.Sprintf("repos/%v/%v/environments/%v/secrets/%v", owner, repo, env, secretName)
u := fmt.Sprintf("repos/%v/%v/environments/%v/secrets/%v", owner, repo, url.PathEscape(env), secretName)

req, err := s.client.NewRequest(ctx, "GET", u, nil)
if err != nil {
Expand Down Expand Up @@ -354,11 +361,13 @@ func (s *ActionsService) CreateOrUpdateOrgSecret(ctx context.Context, org, name

// CreateOrUpdateEnvSecret creates or updates a single environment secret with an encrypted value.
//
// Note: the environment name is URL path escaped for you. See: https://pkg.go.dev/net/url#PathEscape .
//
// GitHub API docs: https://docs.github.com/rest/actions/secrets?apiVersion=2022-11-28#create-or-update-an-environment-secret
//
//meta:operation PUT /repos/{owner}/{repo}/environments/{environment_name}/secrets/{secret_name}
func (s *ActionsService) CreateOrUpdateEnvSecret(ctx context.Context, owner, repo, env, name string, body SecretRequest) (*Response, error) {
u := fmt.Sprintf("repos/%v/%v/environments/%v/secrets/%v", owner, repo, env, name)
u := fmt.Sprintf("repos/%v/%v/environments/%v/secrets/%v", owner, repo, url.PathEscape(env), name)

req, err := s.client.NewRequest(ctx, "PUT", u, body)
if err != nil {
Expand Down Expand Up @@ -402,11 +411,13 @@ func (s *ActionsService) DeleteOrgSecret(ctx context.Context, org, name string)

// DeleteEnvSecret deletes a secret in an environment using the secret name.
//
// Note: the environment name is URL path escaped for you. See: https://pkg.go.dev/net/url#PathEscape .
//
// GitHub API docs: https://docs.github.com/rest/actions/secrets?apiVersion=2022-11-28#delete-an-environment-secret
//
//meta:operation DELETE /repos/{owner}/{repo}/environments/{environment_name}/secrets/{secret_name}
func (s *ActionsService) DeleteEnvSecret(ctx context.Context, owner, repo, env, secretName string) (*Response, error) {
u := fmt.Sprintf("repos/%v/%v/environments/%v/secrets/%v", owner, repo, env, secretName)
u := fmt.Sprintf("repos/%v/%v/environments/%v/secrets/%v", owner, repo, url.PathEscape(env), secretName)

req, err := s.client.NewRequest(ctx, "DELETE", u, nil)
if err != nil {
Expand Down
33 changes: 33 additions & 0 deletions github/actions_secrets_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -781,6 +781,39 @@ func TestActionsService_ListEnvSecrets(t *testing.T) {
})
}

func TestActionsService_ListEnvSecrets_EscapeEnv(t *testing.T) {
t.Parallel()
for _, tt := range []struct {
env string
escapedEnv string
}{
{env: "staging", escapedEnv: "staging"},
{env: "team/staging", escapedEnv: "team%2Fstaging"},
} {
t.Run(tt.env, func(t *testing.T) {
t.Parallel()
client, mux, _ := setup(t)

mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
testMethod(t, r, "GET")
if got, want := r.URL.EscapedPath(), "/repos/o/repo/environments/"+tt.escapedEnv+"/secrets"; got != want {
t.Errorf("Request path = %q, want %q", got, want)
}
if got, want := r.URL.Path, "/repos/o/repo/environments/"+tt.env+"/secrets"; got != want {
t.Errorf("Decoded request path = %q, want %q", got, want)
}
fmt.Fprint(w, `{"total_count":0,"secrets":[]}`)
})

ctx := t.Context()
_, _, err := client.Actions.ListEnvSecrets(ctx, "o", "repo", tt.env, nil)
if err != nil {
t.Fatalf("Actions.ListEnvSecrets returned error: %v", err)
}
})
}
}

func TestActionsService_GetEnvSecret(t *testing.T) {
t.Parallel()
client, mux, _ := setup(t)
Expand Down
21 changes: 16 additions & 5 deletions github/actions_variables.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@ import (
"context"
"errors"
"fmt"
"net/url"
)

// ActionsCreateOrgVariableRequest represents a request to create an
Expand Down Expand Up @@ -141,11 +142,13 @@ func (s *ActionsService) ListOrgVariables(ctx context.Context, org string, opts

// ListEnvVariables lists all variables available in an environment.
//
// Note: the environment name is URL path escaped for you. See: https://pkg.go.dev/net/url#PathEscape .
//
// GitHub API docs: https://docs.github.com/rest/actions/variables?apiVersion=2022-11-28#list-environment-variables
//
//meta:operation GET /repos/{owner}/{repo}/environments/{environment_name}/variables
func (s *ActionsService) ListEnvVariables(ctx context.Context, owner, repo, env string, opts *ListOptions) (*ActionsVariables, *Response, error) {
u := fmt.Sprintf("repos/%v/%v/environments/%v/variables", owner, repo, env)
u := fmt.Sprintf("repos/%v/%v/environments/%v/variables", owner, repo, url.PathEscape(env))
u, err := addOptions(u, opts)
if err != nil {
return nil, nil, err
Expand Down Expand Up @@ -211,11 +214,13 @@ func (s *ActionsService) GetOrgVariable(ctx context.Context, org, name string) (

// GetEnvVariable gets a single environment variable.
//
// Note: the environment name is URL path escaped for you. See: https://pkg.go.dev/net/url#PathEscape .
//
// GitHub API docs: https://docs.github.com/rest/actions/variables?apiVersion=2022-11-28#get-an-environment-variable
//
//meta:operation GET /repos/{owner}/{repo}/environments/{environment_name}/variables/{name}
func (s *ActionsService) GetEnvVariable(ctx context.Context, owner, repo, env, variableName string) (*ActionsVariable, *Response, error) {
u := fmt.Sprintf("repos/%v/%v/environments/%v/variables/%v", owner, repo, env, variableName)
u := fmt.Sprintf("repos/%v/%v/environments/%v/variables/%v", owner, repo, url.PathEscape(env), variableName)

req, err := s.client.NewRequest(ctx, "GET", u, nil)
if err != nil {
Expand Down Expand Up @@ -265,11 +270,13 @@ func (s *ActionsService) CreateOrgVariable(ctx context.Context, org string, body

// CreateEnvVariable creates an environment variable.
//
// Note: the environment name is URL path escaped for you. See: https://pkg.go.dev/net/url#PathEscape .
//
// GitHub API docs: https://docs.github.com/rest/actions/variables?apiVersion=2022-11-28#create-an-environment-variable
//
//meta:operation POST /repos/{owner}/{repo}/environments/{environment_name}/variables
func (s *ActionsService) CreateEnvVariable(ctx context.Context, owner, repo, env string, body ActionsCreateVariableRequest) (*Response, error) {
u := fmt.Sprintf("repos/%v/%v/environments/%v/variables", owner, repo, env)
u := fmt.Sprintf("repos/%v/%v/environments/%v/variables", owner, repo, url.PathEscape(env))

req, err := s.client.NewRequest(ctx, "POST", u, body)
if err != nil {
Expand Down Expand Up @@ -312,11 +319,13 @@ func (s *ActionsService) UpdateOrgVariable(ctx context.Context, org, name string

// UpdateEnvVariable updates an environment variable.
//
// Note: the environment name is URL path escaped for you. See: https://pkg.go.dev/net/url#PathEscape .
//
// GitHub API docs: https://docs.github.com/rest/actions/variables?apiVersion=2022-11-28#update-an-environment-variable
//
//meta:operation PATCH /repos/{owner}/{repo}/environments/{environment_name}/variables/{name}
func (s *ActionsService) UpdateEnvVariable(ctx context.Context, owner, repo, env, name string, body ActionsUpdateVariableRequest) (*Response, error) {
u := fmt.Sprintf("repos/%v/%v/environments/%v/variables/%v", owner, repo, env, name)
u := fmt.Sprintf("repos/%v/%v/environments/%v/variables/%v", owner, repo, url.PathEscape(env), name)

req, err := s.client.NewRequest(ctx, "PATCH", u, body)
if err != nil {
Expand Down Expand Up @@ -360,11 +369,13 @@ func (s *ActionsService) DeleteOrgVariable(ctx context.Context, org, name string

// DeleteEnvVariable deletes a variable in an environment.
//
// Note: the environment name is URL path escaped for you. See: https://pkg.go.dev/net/url#PathEscape .
//
// GitHub API docs: https://docs.github.com/rest/actions/variables?apiVersion=2022-11-28#delete-an-environment-variable
//
//meta:operation DELETE /repos/{owner}/{repo}/environments/{environment_name}/variables/{name}
func (s *ActionsService) DeleteEnvVariable(ctx context.Context, owner, repo, env, variableName string) (*Response, error) {
u := fmt.Sprintf("repos/%v/%v/environments/%v/variables/%v", owner, repo, env, variableName)
u := fmt.Sprintf("repos/%v/%v/environments/%v/variables/%v", owner, repo, url.PathEscape(env), variableName)

req, err := s.client.NewRequest(ctx, "DELETE", u, nil)
if err != nil {
Expand Down
33 changes: 33 additions & 0 deletions github/actions_variables_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -598,6 +598,39 @@ func TestActionsService_ListEnvVariables(t *testing.T) {
})
}

func TestActionsService_ListEnvVariables_EscapeEnv(t *testing.T) {
t.Parallel()
for _, tt := range []struct {
env string
escapedEnv string
}{
{env: "staging", escapedEnv: "staging"},
{env: "team/staging", escapedEnv: "team%2Fstaging"},
} {
t.Run(tt.env, func(t *testing.T) {
t.Parallel()
client, mux, _ := setup(t)

mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
testMethod(t, r, "GET")
if got, want := r.URL.EscapedPath(), "/repos/o/repo/environments/"+tt.escapedEnv+"/variables"; got != want {
t.Errorf("Request path = %q, want %q", got, want)
}
if got, want := r.URL.Path, "/repos/o/repo/environments/"+tt.env+"/variables"; got != want {
t.Errorf("Decoded request path = %q, want %q", got, want)
}
fmt.Fprint(w, `{"total_count":0,"variables":[]}`)
})

ctx := t.Context()
_, _, err := client.Actions.ListEnvVariables(ctx, "o", "repo", tt.env, nil)
if err != nil {
t.Fatalf("Actions.ListEnvVariables returned error: %v", err)
}
})
}
}

func TestActionsService_GetEnvVariable(t *testing.T) {
t.Parallel()
client, mux, _ := setup(t)
Expand Down
21 changes: 16 additions & 5 deletions github/repos_deployment_branch_policies.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@ package github
import (
"context"
"fmt"
"net/url"
)

// DeploymentBranchPolicy represents a single deployment branch policy for an environment.
Expand Down Expand Up @@ -37,11 +38,13 @@ type UpdateDeploymentBranchPolicyRequest struct {

// ListDeploymentBranchPolicies lists the deployment branch policies for an environment.
//
// Note: the environment name is URL path escaped for you. See: https://pkg.go.dev/net/url#PathEscape .
//
// GitHub API docs: https://docs.github.com/rest/deployments/branch-policies?apiVersion=2022-11-28#list-deployment-branch-policies
//
//meta:operation GET /repos/{owner}/{repo}/environments/{environment_name}/deployment-branch-policies
func (s *RepositoriesService) ListDeploymentBranchPolicies(ctx context.Context, owner, repo, environment string, opts *ListOptions) (*DeploymentBranchPolicyResponse, *Response, error) {
u := fmt.Sprintf("repos/%v/%v/environments/%v/deployment-branch-policies", owner, repo, environment)
u := fmt.Sprintf("repos/%v/%v/environments/%v/deployment-branch-policies", owner, repo, url.PathEscape(environment))
u, err := addOptions(u, opts)
if err != nil {
return nil, nil, err
Expand All @@ -63,11 +66,13 @@ func (s *RepositoriesService) ListDeploymentBranchPolicies(ctx context.Context,

// GetDeploymentBranchPolicy gets a deployment branch policy for an environment.
//
// Note: the environment name is URL path escaped for you. See: https://pkg.go.dev/net/url#PathEscape .
//
// GitHub API docs: https://docs.github.com/rest/deployments/branch-policies?apiVersion=2022-11-28#get-a-deployment-branch-policy
//
//meta:operation GET /repos/{owner}/{repo}/environments/{environment_name}/deployment-branch-policies/{branch_policy_id}
func (s *RepositoriesService) GetDeploymentBranchPolicy(ctx context.Context, owner, repo, environment string, branchPolicyID int64) (*DeploymentBranchPolicy, *Response, error) {
u := fmt.Sprintf("repos/%v/%v/environments/%v/deployment-branch-policies/%v", owner, repo, environment, branchPolicyID)
u := fmt.Sprintf("repos/%v/%v/environments/%v/deployment-branch-policies/%v", owner, repo, url.PathEscape(environment), branchPolicyID)

req, err := s.client.NewRequest(ctx, "GET", u, nil)
if err != nil {
Expand All @@ -85,11 +90,13 @@ func (s *RepositoriesService) GetDeploymentBranchPolicy(ctx context.Context, own

// CreateDeploymentBranchPolicy creates a deployment branch policy for an environment.
//
// Note: the environment name is URL path escaped for you. See: https://pkg.go.dev/net/url#PathEscape .
//
// GitHub API docs: https://docs.github.com/rest/deployments/branch-policies?apiVersion=2022-11-28#create-a-deployment-branch-policy
//
//meta:operation POST /repos/{owner}/{repo}/environments/{environment_name}/deployment-branch-policies
func (s *RepositoriesService) CreateDeploymentBranchPolicy(ctx context.Context, owner, repo, environment string, body CreateDeploymentBranchPolicyRequest) (*DeploymentBranchPolicy, *Response, error) {
u := fmt.Sprintf("repos/%v/%v/environments/%v/deployment-branch-policies", owner, repo, environment)
u := fmt.Sprintf("repos/%v/%v/environments/%v/deployment-branch-policies", owner, repo, url.PathEscape(environment))

req, err := s.client.NewRequest(ctx, "POST", u, body)
if err != nil {
Expand All @@ -107,11 +114,13 @@ func (s *RepositoriesService) CreateDeploymentBranchPolicy(ctx context.Context,

// UpdateDeploymentBranchPolicy updates a deployment branch policy for an environment.
//
// Note: the environment name is URL path escaped for you. See: https://pkg.go.dev/net/url#PathEscape .
//
// GitHub API docs: https://docs.github.com/rest/deployments/branch-policies?apiVersion=2022-11-28#update-a-deployment-branch-policy
//
//meta:operation PUT /repos/{owner}/{repo}/environments/{environment_name}/deployment-branch-policies/{branch_policy_id}
func (s *RepositoriesService) UpdateDeploymentBranchPolicy(ctx context.Context, owner, repo, environment string, branchPolicyID int64, body UpdateDeploymentBranchPolicyRequest) (*DeploymentBranchPolicy, *Response, error) {
u := fmt.Sprintf("repos/%v/%v/environments/%v/deployment-branch-policies/%v", owner, repo, environment, branchPolicyID)
u := fmt.Sprintf("repos/%v/%v/environments/%v/deployment-branch-policies/%v", owner, repo, url.PathEscape(environment), branchPolicyID)

req, err := s.client.NewRequest(ctx, "PUT", u, body)
if err != nil {
Expand All @@ -129,11 +138,13 @@ func (s *RepositoriesService) UpdateDeploymentBranchPolicy(ctx context.Context,

// DeleteDeploymentBranchPolicy deletes a deployment branch policy for an environment.
//
// Note: the environment name is URL path escaped for you. See: https://pkg.go.dev/net/url#PathEscape .
//
// GitHub API docs: https://docs.github.com/rest/deployments/branch-policies?apiVersion=2022-11-28#delete-a-deployment-branch-policy
//
//meta:operation DELETE /repos/{owner}/{repo}/environments/{environment_name}/deployment-branch-policies/{branch_policy_id}
func (s *RepositoriesService) DeleteDeploymentBranchPolicy(ctx context.Context, owner, repo, environment string, branchPolicyID int64) (*Response, error) {
u := fmt.Sprintf("repos/%v/%v/environments/%v/deployment-branch-policies/%v", owner, repo, environment, branchPolicyID)
u := fmt.Sprintf("repos/%v/%v/environments/%v/deployment-branch-policies/%v", owner, repo, url.PathEscape(environment), branchPolicyID)

req, err := s.client.NewRequest(ctx, "DELETE", u, nil)
if err != nil {
Expand Down
33 changes: 33 additions & 0 deletions github/repos_deployment_branch_policies_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,39 @@ func TestRepositoriesService_ListDeploymentBranchPolicies(t *testing.T) {
})
}

func TestRepositoriesService_ListDeploymentBranchPolicies_EscapeEnvironment(t *testing.T) {
t.Parallel()
for _, tt := range []struct {
environment string
escapedEnvironment string
}{
{environment: "staging", escapedEnvironment: "staging"},
{environment: "team/staging", escapedEnvironment: "team%2Fstaging"},
} {
t.Run(tt.environment, func(t *testing.T) {
t.Parallel()
client, mux, _ := setup(t)

mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
testMethod(t, r, "GET")
if got, want := r.URL.EscapedPath(), "/repos/o/repo/environments/"+tt.escapedEnvironment+"/deployment-branch-policies"; got != want {
t.Errorf("Request path = %q, want %q", got, want)
}
if got, want := r.URL.Path, "/repos/o/repo/environments/"+tt.environment+"/deployment-branch-policies"; got != want {
t.Errorf("Decoded request path = %q, want %q", got, want)
}
fmt.Fprint(w, `{"total_count":0,"branch_policies":[]}`)
})

ctx := t.Context()
_, _, err := client.Repositories.ListDeploymentBranchPolicies(ctx, "o", "repo", tt.environment, nil)
if err != nil {
t.Fatalf("Repositories.ListDeploymentBranchPolicies returned error: %v", err)
}
})
}
}

func TestRepositoriesService_GetDeploymentBranchPolicy(t *testing.T) {
t.Parallel()
client, mux, _ := setup(t)
Expand Down
Loading
Loading