internal/ci: reading from unset environment variable in GitHub workflow does not result in an error

[myitcv]

What version of CUE are you using (cue version)?

$ cue version
cue version v0.0.0-20241128110049-c9d519e55269

go version go1.23.2
      -buildmode exe
       -compiler gc
  DefaultGODEBUG asynctimerchan=1,gotypesalias=0,httpservecontentkeepheaders=1,tls3des=1,tlskyber=0,x509keypairleaf=0,x509negativeserial=1
     CGO_ENABLED 1
          GOARCH arm64
            GOOS linux
         GOARM64 v8.0
             vcs git
    vcs.revision c9d519e55269223c51cde19469cb7978f9777282
        vcs.time 2024-11-28T11:00:49Z
    vcs.modified false
cue.lang.version v0.12.0

Does this issue reproduce with the latest release?

Not a CUE issue, but the problem is present in the CI config at c9d519e

What did you do?

In run https://github.com/cue-lang/cue-trybot/actions/runs/12066599935/job/33648939405, a read from $CUE_LOGINS to populate $CUE_CONFIG_DIR/logins.json essentially failed because that environment variable was unset, and we ended up with an empty file.

This happened because the trybot run in question was against https://review.gerrithub.io/c/cue-lang/cue/+/1204109/8, a commit which had a merge base against origin/master of a point before https://review.gerrithub.io/c/cue-lang/cue/+/1204254 landed. CL 1204254 moved us away from CUE_LOGINS with a follow-up of that environment variable being unset in the GitHub secrets environment. Hence the attempt to read from $CUE_LOGINS should have failed, but didn't.

What did you expect to see?

A failure in CI at the point of trying to read from $CUE_LOGINS

What did you see instead?

A subsequent failure which made it hard to diagnose the root cause.

Not sure if there is a way that we can make all script-based steps run with set -u equivalent. See https://docs.github.com/en/actions/writing-workflows/workflow-syntax-for-github-actions#defaultsrunshell for reference.

[mvdan]

set -u is short for set -o nounset, so that's the full name of the option for the sake of searching the internet.

Unfortunately, "github actions nounset" does not seem to yield any useful Google results. I'm also not sure that there is a way to enforce this for our choice of bash as a shell on entire workflows or jobs, short of some relatively hacky templating across all job steps to inject a set -o nounset line before every run script when the shell is bash.

[myitcv]

In a quick hack, I had a go at fixing this for the vscode-cue repo in https://review.gerrithub.io/c/cue-lang/vscode-cue/+/1205357