From bc7abaea63d6a4bc0fc0a07aef0baf088c115c69 Mon Sep 17 00:00:00 2001
From: cliffhall <cliff@futurescale.com>
Date: Thu, 27 Aug 2026 02:18:01 -0400
Subject: [PATCH] chore(scripts): accept a dynamic SetEnvironmentVariable
 argument as an override (#2146)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Copilot, ninth review: the .NET arm required a QUOTED second argument, so
`SetEnvironmentVariable("SMOKE_BROWSER", $engine)` — or a ${{ }} expression
there — set the environment with the guard silent. An engine the guard cannot
read is forbidden for the same reason `smoke:web:engine` is, so the arm now
accepts an unquoted value too. Bare values stop at `,` or `)`, so a third
argument ("Process") is not swallowed — pinned by an allowed three-argument
case beside the dynamic one.

Signed-off-by: Cliff Hall <cliff@futurescale.com>
Signed-off-by: cliffhall <cliff@futurescale.com>
---
 scripts/lib/workflow-gate.mjs      |  7 ++++++-
 scripts/lib/workflow-gate.test.mjs | 17 +++++++++++++++++
 2 files changed, 23 insertions(+), 1 deletion(-)

diff --git a/scripts/lib/workflow-gate.mjs b/scripts/lib/workflow-gate.mjs
index 0a17dd78..902c1dd9 100644
--- a/scripts/lib/workflow-gate.mjs
+++ b/scripts/lib/workflow-gate.mjs
@@ -185,9 +185,14 @@ const BROWSER_ASSIGNMENTS = [
     value: 1,
   },
   // .NET, reachable from PowerShell: SetEnvironmentVariable("NAME", "value").
+  // The value arm accepts an UNQUOTED second argument as well — `$engine`, or a
+  // `${{ }}` expression — because that spelling sets the environment just the
+  // same, and an engine the guard cannot read is forbidden for the reason
+  // `smoke:web:engine` is (Copilot). Bare values stop at `,` or `)` so a third
+  // argument (`"Process"`) is not swallowed.
   {
     re: new RegExp(
-      String.raw`SetEnvironmentVariable\s*\(\s*["']${BROWSER_ENV_VAR}["']\s*,\s*["']([^"']*)["']`,
+      String.raw`SetEnvironmentVariable\s*\(\s*["']${BROWSER_ENV_VAR}["']\s*,\s*("[^"]*"|'[^']*'|[^,)]*)`,
       "gi",
     ),
     value: 1,
diff --git a/scripts/lib/workflow-gate.test.mjs b/scripts/lib/workflow-gate.test.mjs
index 4d3263e9..323acca4 100644
--- a/scripts/lib/workflow-gate.test.mjs
+++ b/scripts/lib/workflow-gate.test.mjs
@@ -230,6 +230,23 @@ describe("findWorkflowViolations", () => {
       ),
       rules: [VIOLATION.BROWSER_ENV],
     },
+    {
+      // Copilot, ninth review: an unquoted second argument sets the environment
+      // just the same, and an engine the guard cannot read is forbidden for the
+      // reason `smoke:web:engine` is.
+      name: "flags a SetEnvironmentVariable call with a dynamic value",
+      text: workflow(
+        '      - run: |\n          [Environment]::SetEnvironmentVariable("SMOKE_BROWSER", $engine)\n          npm run smoke',
+      ),
+      rules: [VIOLATION.BROWSER_ENV],
+    },
+    {
+      name: "allows a SetEnvironmentVariable call pinning chromium",
+      text: workflow(
+        '      - run: |\n          [Environment]::SetEnvironmentVariable("SMOKE_BROWSER", "chromium", "Process")\n          npm run smoke',
+      ),
+      rules: [],
+    },
     {
       name: "flags a .NET SetEnvironmentVariable call",
       text: workflow(