[BUG] Fix s5cmd action placing subcommand flags before the subcommand - #84
Merged
Conversation
s5cmd flags like sync --delete are subcommand-scoped, not global, and must come after the subcommand. The flags input places everything before the subcommand, so passing flags: --delete broke with 'flag provided but not defined: -delete'. Add a separate subcommand-flags input placed after the subcommand; flags keeps its documented global-flag behavior. Fixes #83 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Signed-off-by: John McCall <john@overturemaps.org>
There was a problem hiding this comment.
Pull request overview
This pull request fixes the .github/actions/s5cmd composite action’s argument ordering so subcommand-specific flags (e.g. sync --delete) can be placed after the subcommand, preventing production failures where subcommand flags were incorrectly treated as global flags.
Changes:
- Adds a new
subcommand-flagsinput to pass flags after the subcommand and before positional args. - Adds input validation to reject
subcommand-flagswhen using theruncommand. - Updates the ARGS construction to insert
subcommand-flagsbetween the subcommand and source/destination.
Suppressed comments (1)
.github/actions/s5cmd/action.yml:128
- The comment says “quote within flags if needed”, but the current
read -ra ... <<< "$FLAGS"splitting does not honor shell-style quoting. Either update the comment to reflect whitespace-only splitting, or change parsing to a quote-aware approach.
# Build argument array: global flags, then subcommand, then subcommand flags, then positional args
ARGS=()
# Word-split flags safely (simple space split; quote within flags if needed)
if [[ -n "$FLAGS" ]]; then
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Hardcode a targeted fix so existing callers (e.g. stac's publish-catalog.yaml, which pins this action @main and predates subcommand-flags) keep working without a coordinated follow-up PR: if 'flags' contains --delete and the command is sync, move it after the subcommand automatically and emit a warning pointing callers at subcommand-flags. Anything else misplaced in 'flags' still fails as before; extend this case-by-case if more subcommand flags need it. Also documents the whitespace-only splitting behavior of flags and subcommand-flags per PR #84 review feedback. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Signed-off-by: John McCall <john@overturemaps.org>
Eric Godwin (ericgodwin)
approved these changes
Aug 18, 2026
John McCall (lowlydba)
added a commit
to OvertureMaps/stac
that referenced
this pull request
Aug 18, 2026
OvertureMaps/workflows#84 merged (aca281b), so @main already has the sync --delete fix. Drop the temporary e2e pin from earlier in this branch. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Signed-off-by: John McCall <john@overturemaps.org>
John McCall (lowlydba)
added a commit
to OvertureMaps/stac
that referenced
this pull request
Aug 19, 2026
* test: pin s5cmd action to workflows#84 head sha for e2e verification Temporary pin to 1e394d3cfcdc529069e9abe8643c3288ea940a52 (OvertureMaps/workflows#84) to exercise the sync --delete fix via workflow_dispatch before merging the upstream fix. Revert to @main once verified. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Signed-off-by: John McCall <john@overturemaps.org> * fix(publish-catalog): skip session tagging on cloudfront-invalidator assume-role sts:AssumeRole to cloudfront-invalidator failed: stac-publish-oidc-overturemaps isn't authorized for sts:TagSession, which configure-aws-credentials sends by default. Nothing in cloudfront-invalidator's trust or invalidate policy reads session tags (no ABAC conditions), so skip tagging instead of granting the permission. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Signed-off-by: John McCall <john@overturemaps.org> * test: revert s5cmd pin to @main now that workflows#84 is merged OvertureMaps/workflows#84 merged (aca281b), so @main already has the sync --delete fix. Drop the temporary e2e pin from earlier in this branch. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Signed-off-by: John McCall <john@overturemaps.org> --------- Signed-off-by: John McCall <john@overturemaps.org>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
--deleteis async-subcommand flag in s5cmd, not a global one, so it has to come aftersync(s5cmd sync --delete src dst). Theflagsinput on.github/actions/s5cmd/action.ymlis documented as global flags and always gets placed before the subcommand, so OvertureMaps/stac'spublish-catalog.yamlpassingflags: --deletebroke production publishing:Fixes #83.
Adds a
subcommand-flagsinput, placed after the subcommand and beforesource/destination.flagsand its documented global-flag behavior are untouched, so this is backwards compatible. Guardedsubcommand-flagsagainst theruncommand in the validation step, since itsbatch-filelines carry their own per-command flags already.Since OvertureMaps/stac pins this action
@mainand itspublish-catalog.yamlstill passesflags: --delete, that alone would still fail after merging (flagskeeps its documented before-the-subcommand placement). Rather than requiring a coordinated follow-up PR there first, this also hardcodes a targeted auto-correction: ifflagscontains--deleteand the command issync, the action moves it after the subcommand automatically and logs a warning pointing callers atsubcommand-flags. Anything else misplaced inflagsstill fails as before. Extend this case-by-case if more subcommand flags need the same treatment.Verified the
ARGSconstruction locally withbash, both against the newsubcommand-flagsinput and against the existingflags: --deleteshape stac's workflow currently uses; both builds5cmd sync --delete public_releases/ s3://overturemaps-extras-us-west-2/stac/correctly. Not tested against a real S3 bucket.