[bbossola]

Fixes #21.

Problem

entrypoint.sh joined the security and stability programs unconditionally and then trimmed a trailing comma only, so a leading comma survived whenever autofix_stability was set without autofix_security. The client expands that empty element into a real first program with permissive defaults — all reach, overrides enabled — so the action silently ran an update-all pass nobody asked for, and opened PRs against dependencies the user had not selected.

Change

Collect the requested programs into an array and join once. This is correct for all four input combinations and removes the length helper (no other caller) along with the index arithmetic.

autofix_programs=()
if [[ -n "${INPUT_AUTOFIX_SECURITY:-}" ]]; then
    autofix_programs+=("${INPUT_AUTOFIX_SECURITY}+vulns+no-overrides")
fi

if [[ -n "${INPUT_AUTOFIX_STABILITY:-}" ]]; then
    autofix_programs+=("${INPUT_AUTOFIX_STABILITY}+dated+no-overrides")
fi

autofix_final_program=$(IFS=,; echo "${autofix_programs[*]:-}")

${autofix_programs[*]:-} is guarded deliberately: entrypoint.sh does not set -u today, but bash 4.3 and earlier treat an empty array expansion as unset, and the guard costs nothing if set -u is added later.

Verification

The assembly block was extracted verbatim, before and after, and driven through all four input combinations rather than reasoned about. Before:

sec=safe          sta=safe     -> --autofix:safe+vulns+no-overrides,safe+dated+no-overrides
sec=conservative  sta=<unset>  -> --autofix:conservative+vulns+no-overrides
sec=<unset>       sta=safe     -> --autofix:,safe+dated+no-overrides          <-- bug
sec=<unset>       sta=<unset>  -> --autofix

After:

sec=safe          sta=safe     -> --autofix:safe+vulns+no-overrides,safe+dated+no-overrides
sec=conservative  sta=<unset>  -> --autofix:conservative+vulns+no-overrides
sec=<unset>       sta=safe     -> --autofix:safe+dated+no-overrides
sec=<unset>       sta=<unset>  -> --autofix

The three previously-correct rows are byte-identical, so this is not a behaviour change for anyone already setting both inputs. bash -n passes. shellcheck was not available in the environment, so this has not been linted.

Not included

• The client-side guard suggested in autofix_stability without autofix_security builds a malformed --autofix string and silently runs an update-all pass #21 (reject an empty element in --autofix: rather than expanding it to defaults). Different repository, and worth doing independently — this PR only closes the one caller that produced the malformed string.
• A regression test. There is no test harness in this repository; No automated checks: add shellcheck and unit tests for the argument-assembly logic #23 proposes one, and this bug is the motivating example.