fix: test.sh's eval invocation dropped all but one coverage flag, and was a real injection risk

[frostebite]

Found via a real CI failure on unity-test-runner's thin-wrapper PR (#310): after fixing the version-pin gap (#96), every single Docker test run still produced no results file at all.

Two bugs, both introduced in #95:

1. COVERAGE_FLAGS was converted to a bash array (to avoid the eval below), but the unity-editor invocation still referenced it as plain $COVERAGE_FLAGS instead of "${COVERAGE_FLAGS[@]}" — unquoted, unsubscripted array expansion in bash only yields element [0]. Every run silently dropped -enableCodeCoverage/-coverageOptions and the coverageResultsPath value, leaving a bare -coverageResultsPath flag that then swallowed the next token (customParameters' first word) as its argument — corrupting the whole Unity command line.
2. The invocation used eval to get CUSTOM_PARAMETERS to word-split into separate argv entries. CUSTOM_PARAMETERS is user-controlled (the action's own customParameters input) — eval would interpret any shell metacharacters in it (;, $(), backticks) as real shell syntax, a real command-injection surface.

Fix

Converted the whole invocation to a plain bash array (runTests, COVERAGE_FLAGS) with proper "${array[@]}" expansion. CUSTOM_PARAMETERS is still deliberately left unquoted for its intended word-splitting into separate args, but with eval gone entirely, that splitting can no longer be abused as shell syntax.

Testing

• bash -n syntax check passes.
• Full bun test ./src: 156 pass, 0 fail (this file isn't bundled into dist/index.js — it's a static asset mounted into the container at runtime, so nothing else needed rebuilding).
• Will re-verify against a real Docker test run once this + a new release land (this exact script is what unity-test-runner's failing CI run was exercising).

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 7c76612c-0a7a-4a8d-8088-0f63cb715b98

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}