Summary

The env input description states:

Automatically load mise env vars into GITHUB_ENV. Note that PATH modifications are not part of this.

However, the current implementation runs mise env --json and exports every string value using core.exportVariable(), including PATH.

As a result, PATH modifications configured with [env] _.path in mise.toml are persisted to subsequent GitHub Actions steps, contrary to the documented behavior.

Reproduction

Create the following mise.toml:

[env]
_.path = ["{{config_root}}/local-bin"]

Then run this workflow:

steps:
  - uses: actions/checkout@v4

  - name: Create a local executable
    shell: bash
    run: |
      mkdir -p local-bin
      printf '#!/usr/bin/env bash\necho "found through _.path"\n' > local-bin/sample-tool
      chmod +x local-bin/sample-tool

  - name: Set up mise
    uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
    with:
      version: 2026.7.5
      install: false
      cache: false

  - name: Check PATH propagation
    run: sample-tool

The final step succeeds because local-bin has been added to PATH by the action.

Expected behavior

Based on the env input description, PATH modifications such as [env] _.path should not be exported to subsequent steps.

Alternatively, if exporting PATH is now intentional, the input description should be updated and the behavior should be covered by a test.

Additional context

The original environment export implementation in #241 used:

mise env --dotenv

That implementation was consistent with the description excluding PATH modifications.

In #252, the implementation changed to mise env --json to support redacted values and began exporting every returned string:

for (const [key, value] of Object.entries(actualVars)) {
  if (typeof value === 'string') {
    core.exportVariable(key, value)
  }
}

Because mise env --json includes PATH, this appears to have changed the behavior without updating the env input description.

Relevant references:

• env input description:

  mise-action/action.yml

  Lines 94 to 98 in e6a8b39

  	env:
  	description: "Automatically load mise env vars into GITHUB_ENV. Note that PATH modifications are not part of this."
  	required: false
  	default: "true"
  	wings_enabled:

• Current export implementation:

  mise-action/src/index.ts

  Lines 156 to 190 in e6a8b39

  	async function exportMiseEnv(): Promise<void> {
  	core.startGroup('Exporting mise environment variables')
  	const cwd = getCwd()
  	// Check if mise supports --redacted flags based on version input
  	const supportsRedacted = checkMiseSupportsRedacted()
  	if (supportsRedacted) {
  	try {
  	// First, get the redacted values to identify what needs masking
  	const redactedOutput = await exec.getExecOutput(
  	'mise',
  	['env', '--redacted', '--json'],
  	{ silent: true, cwd }
  	)
  	const redactedVars = JSON.parse(redactedOutput.stdout)
  	// Mask sensitive values in GitHub Actions
  	for (const [key, actualValue] of Object.entries(redactedVars)) {
  	core.setSecret(actualValue as string)
  	core.info(`Masked sensitive value for: ${key}`)
  	}
  	// Then get the actual values
  	const actualOutput = await exec.getExecOutput('mise', ['env', '--json'], {
  	cwd
  	})
  	const actualVars = JSON.parse(actualOutput.stdout)
  	// Export all environment variables
  	for (const [key, value] of Object.entries(actualVars)) {
  	if (typeof value === 'string') {
  	core.exportVariable(key, value)
  	}

• Original environment export: feat: export env vars from mise.toml #241
• Change to JSON-based export: fix: redact secret values from env #252