Release v0.27.0 · mizchi/actrun

Security

Fix expression injection via matrix values in if conditions — matrix values are now quoted as string literals to prevent injection like 'true' || always() from bypassing conditionals
Add path traversal protection for local action references (uses: ./path) — reject paths that escape the workspace via .. segments
Clean up script files after step execution to avoid leaving interpolated secrets on disk

Composite action outputs not propagated — steps.<composite-id>.outputs.* now works correctly for composite actions (#18, reported by @bmthd)
Composite action outcome/conclusion not set — steps.<composite-id>.outcome and steps.<composite-id>.conclusion are now propagated from inner steps
JS SyntaxError on startup — fix ${} in MoonBit-generated JS template literals causing SyntaxError: Missing } in template expression (#17, reported by @bmthd)
Matrix substitution in complex expressions — ${{ matrix.key != 'true' }} no longer replaces the entire expression with empty string; matrix refs within larger expressions are now substituted inline while preserving the ${{ }} wrapper
Job-level if not matrix-substituted — if: ${{ matrix.skip != 'true' }} at the job level now works correctly

13 new matrix strategy test fixtures: three axes, job/step if/env/name, continue-on-error, include extra keys, matrix chain, working-directory, unquoted YAML values
5 composite action test fixtures: single output, multiple outputs, outcome/conclusion, output in if condition, GITHUB_ENV propagation
28 unit tests for substitute_matrix_text edge cases (special characters, complex expressions, injection attempts)
3 executor tests for output/env with special characters and heredoc format

Add performance benchmark (docs/perf.md) covering startup overhead, workspace modes, Node.js CPU, and file I/O across local, nix-packages, and apple-container