GITHUB_PATH always takes precedence over GITHUB_ENV

[wchargin]

The docs for environment files say that you can write a key-value
pair to ${GITHUB_ENV} to “[update] an environment variable for any
actions running next in a job”. But this has an undesirable interaction
with the ${GITHUB_PATH} environment file: old GITHUB_PATH entries
are still included even after GITHUB_ENV is used to reset the variable
contents.

For instance, in this example…

    - run: echo '/some/path/dir' >>"${GITHUB_PATH}"
    - run: echo 'PATH=/usr/bin:/bin' >>"${GITHUB_ENV}"
    - run: echo "$PATH"

…we would expect the last step to print /usr/bin:/bin, because that
is the environment variable that has been explicitly set. But instead it
prints /some/path/dir:/usr/bin:/bin, using the path entries that were
prepended before the variable was cleared.

This is problematic because it makes it impossible to reset PATH after
a previous step has echoed to GITHUB_PATH. Specifically, I want to use
the setup-python action to configure a Python toolchain, then create a
virtualenv, and then remove the stock Python toolchain from the path—but
since setup-python uses ${GITHUB_PATH}, there is no way to do this.

(As a user, it’s hard to tell what part of the platform is responsible
for this behavior and whether that code is open source. I’ve filed
against this repository because setup-python uses core.addPath and
thus runs into this issue. If this isn’t the right place, please advise
me where I should file an issue instead. Thanks!)

[Kurt-von-Laven]

Probably way too late to be helpful, but in case it helps anyone else, it’s fine to leave the old entries in the PATH since the more recently added ones for your virtualenv will be searched first. As noted in the official docs, the directory is prepended to the PATH. See ScribeMD/pre-commit-action, for example, which tricks pre-commit into running within the virtualenv even though it tries to install itself globally via pip and run itself without activating the virtualenv. This allows us to lock and cache pre-commit and the transitive closure of its dependencies. Note however that Docker container actions are isolated from modifications to the PATH.