Skip to content

Add a first-class duration input#252

Merged
rizaziz merged 3 commits into
mainfrom
add-duration-input
Jul 17, 2026
Merged

Add a first-class duration input#252
rizaziz merged 3 commits into
mainfrom
add-duration-input

Conversation

@rizaziz

@rizaziz rizaziz commented Jul 17, 2026

Copy link
Copy Markdown
Contributor

Closes #250.

Summary

Adds an optional, typed duration input (seconds) that maps to the Mayhem CLI --duration flag, so run length no longer has to be threaded through the free-form args string — where precedence was unclear and a ref (e.g. long-runs) could silently clobber a value passed via args.

Precedence

  1. the duration input wins — it replaces any --duration already present in args;
  2. else honor --duration in args;
  3. else the documented default of 60 seconds.

Details

  • Validates the input is a positive integer ("0", "-5", "20m", "1.5" are rejected with a clear error; empty = unset).
  • Echoes the effective duration to the run log in every branch (e.g. Duration: 1200s (from the 'duration' input).) so overrides are visible — directly addressing the "silently became 4 hours" problem in the issue.
  • dist/ rebuilt reproducibly via make dist-rebuild.
  • README.md and action.yml document the new input.

Also included

Bumps the action runtime from node20 to node24 (action.yml). This is the GitHub Actions runtime and is independent of the node:20 Docker image used to build dist/.

Testing

tsc build, prettier format-check, eslint, ncc package, and jest all pass. The existing test already exercises INPUT_DURATION.

Adds an optional, typed `duration` input (seconds) that maps to the
`--duration` CLI flag, so run length no longer has to be threaded through
the free-form `args` string where precedence is unclear.

Precedence: the `duration` input wins (replacing any `--duration` already
in `args`); else honor `--duration` in `args`; else the documented default
of 60 seconds. The input is validated as a positive integer, and the
effective duration is echoed to the run log so overrides are visible.

Also bumps the action runtime from node20 to node24.

Fixes #250
@github-actions

github-actions Bot commented Jul 17, 2026

Copy link
Copy Markdown

Mayhem Automated Code Testing Report

❗ 1 Defects Found

CWE Severity Defect Description
7.1 Improper Input Validation The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Testing details found at https://app.mayhem.security/forallsecure/mcode-action/mayhemit/41

@d-dot-one d-dot-one left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The code looks good. Since I'm not familiar yet with this repo, the only change I would see is to test for the rejection cases (0, negative, fractional, non-numeric) in duration (the existing test only covers a single value of 10).

Aziz Rizayev added 2 commits July 17, 2026 18:00
A decimal (e.g. `30.5`) or negative (e.g. `-5`) duration passed via
`args: --duration ...` previously slipped through unvalidated, and the CLI
treated the malformed value as an unbounded ("infinite") run. Factor the
positive-integer check into a shared `validateDuration` helper and apply it
to the `--duration` value taken from `args`, not just the typed input. Also
catches a `--duration` flag with no following value.
`validateDuration` now returns the value parsed and re-stringified, so
leading-zero inputs like `000000120` are handed to Mayhem as `120` rather
than the raw string. The typed input is normalized in getConfig and the
`--duration` value from `args` is rewritten in place with the clean value.
@rizaziz
rizaziz merged commit 9e26cdc into main Jul 17, 2026
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add a first-class duration input (instead of only args: --duration)

2 participants