fix(build): make MutateWith deterministic for forwarded inputs

When pipeline A `uses:` B and B `uses:` C, and B forwards a same-named
input down to C (`with: { foo: ${{inputs.foo}} }`), compilePipeline merges
the parent's resolved substitution map into the child's `with`. The merged
map then holds two entries that collide on one key in MutateWith:

  "${{inputs.foo}}" -> "<resolved parent value>"   (inherited from parent)
  "foo"             -> "${{inputs.foo}}"            (child's forwarded input)

The insert loop wrote both to nw["${{inputs.foo}}"] and Go's randomized map
iteration decided the winner. When the self-reference won it resolved to
itself (single pass) and stayed unsubstituted, so the literal `${{` leaked
into Runs and stripComments failed with "invalid parameter name". The same
collision also silently produced the inherited value instead of a
legitimate literal override (`with: { foo: secret }`) ~13% of runs.

Resolve deterministically by precedence: seed the inherited "${{...}}"
entries first, then apply this pipeline's own inputs authoritatively
(iterating input names in sorted order), resolving each value against the
parent scope so a forwarded self-reference becomes the parent's value and a
literal override always wins. This composes to arbitrary `uses:` depth
because each level passes a fully-resolved map to the next.

Tests (all repeated to defeat randomized map order; they fail on the old
code and pass with this change):
- Test_MutateWith_ForwardedSameNamedInput: forwarded self-ref, literal
  override, child-default-wins, no-collision, sibling-ref, multi-key.
- Test_MutateWith_DeepForwarding: 6-level forwarding chain.
- Test_CompilePipelines_NestedForwardedInput: end-to-end compile of a
  3-level nested `uses:`, reproducing the stripComments failure.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Thomas Bechtold <thomas.bechtold@chainguard.dev>

Author: toabctl

pkg/build/pipeline.go

@@ -23,6 +23,7 @@ import (
 	"os/signal"
 	"path"
 	"path/filepath"
+	"sort"
 	"strconv"
 	"strings"
 
@@ -40,15 +41,31 @@ const WorkDir = "/home/build"
 func (sm *SubstitutionMap) MutateWith(with map[string]string) (map[string]string, error) {
 	nw := maps.Clone(sm.Substitutions)
 
+	// Deterministic (Go map order is random) merge of `with`: seed the parent's
+	// inherited "${{...}}" entries, then this pipeline's plain inputs in sorted
+	// order, resolved vs the parent so a forwarded self-ref takes its value.
 	for k, v := range with {
-		// already mutated?
 		if strings.HasPrefix(k, "${{") {
 			nw[k] = v
-		} else {
-			nk := fmt.Sprintf("${{inputs.%s}}", k)
-			nw[nk] = v
 		}
 	}
+	inputKeys := make([]string, 0, len(with))
+	for k := range with {
+		if !strings.HasPrefix(k, "${{") {
+			inputKeys = append(inputKeys, k)
+		}
+	}
+	sort.Strings(inputKeys)
+	for _, k := range inputKeys {
+		v := with[k]
+		nk := fmt.Sprintf("${{inputs.%s}}", k)
+		// Resolve against the parent scope; keep raw if not yet in scope (a
+		// sibling input) — the mutation loop below resolves it.
+		if rv, err := util.MutateStringFromMap(nw, v); err == nil {
+			v = rv
+		}
+		nw[nk] = v
+	}
 
 	// do the actual mutations
 	for k, v := range nw {

pkg/build/pipeline_test.go

@@ -15,6 +15,7 @@
 package build
 
 import (
+	"maps"
 	"os"
 	"path/filepath"
 	"testing"
@@ -107,6 +108,168 @@ func Test_MutateWith(t *testing.T) {
 	}
 }
 
+// Regression: a nested `uses:` that forwards a same-named input (compile.go
+// merges the parent's resolved "${{inputs.X}}" with the child's own "X") must
+// resolve deterministically regardless of Go's random map order.
+func Test_MutateWith_ForwardedSameNamedInput(t *testing.T) {
+	sm := &SubstitutionMap{Substitutions: map[string]string{}}
+
+	for _, tc := range []struct {
+		name  string
+		with  map[string]string
+		wants map[string]string // key -> expected resolved value
+	}{{
+		name: "forwarded self-reference resolves to parent value",
+		with: map[string]string{
+			"${{inputs.admin-password}}": "adminpw",                    // inherited from parent
+			"admin-password":             "${{inputs.admin-password}}", // forwarded down
+		},
+		wants: map[string]string{"${{inputs.admin-password}}": "adminpw"},
+	}, {
+		name: "literal override wins over inherited value",
+		with: map[string]string{
+			"${{inputs.admin-password}}": "adminpw",
+			"admin-password":             "literalsecret",
+		},
+		wants: map[string]string{"${{inputs.admin-password}}": "literalsecret"},
+	}, {
+		name: "child default wins over inherited parent value",
+		with: map[string]string{
+			"${{inputs.tls-cert-dir}}": "/tmp/tls", // parent's value
+			"tls-cert-dir":             "",         // child's default (validateWith filled it)
+		},
+		wants: map[string]string{"${{inputs.tls-cert-dir}}": ""},
+	}, {
+		name:  "plain input with no collision resolves normally",
+		with:  map[string]string{"foo": "bar"},
+		wants: map[string]string{"${{inputs.foo}}": "bar"},
+	}, {
+		name: "sibling reference resolves regardless of order",
+		with: map[string]string{
+			"a": "${{inputs.b}}",
+			"b": "bee",
+		},
+		wants: map[string]string{
+			"${{inputs.a}}": "bee",
+			"${{inputs.b}}": "bee",
+		},
+	}, {
+		name: "multiple forwarded inputs all resolve to parent values",
+		with: map[string]string{
+			"${{inputs.password}}": "pw",
+			"password":             "${{inputs.password}}",
+			"${{inputs.cert-dir}}": "/d",
+			"cert-dir":             "${{inputs.cert-dir}}",
+		},
+		wants: map[string]string{
+			"${{inputs.password}}": "pw",
+			"${{inputs.cert-dir}}": "/d",
+		},
+	}} {
+		t.Run(tc.name, func(t *testing.T) {
+			// Run many times to defeat randomized map iteration order.
+			for i := range 1000 {
+				got, err := sm.MutateWith(tc.with)
+				if err != nil {
+					t.Fatalf("MutateWith: %v", err)
+				}
+				for k, want := range tc.wants {
+					if v := got[k]; v != want {
+						t.Fatalf("iter %d: %s: got %q, want %q", i, k, v, want)
+					}
+				}
+			}
+		})
+	}
+}
+
+// Forwarding the same-named input down many levels must keep resolving to the
+// top value at any depth (each level passes a fully-resolved map to the next).
+func Test_MutateWith_DeepForwarding(t *testing.T) {
+	sm := &SubstitutionMap{Substitutions: map[string]string{}}
+	for i := range 1000 {
+		// Top level: the input takes its real value.
+		m, err := sm.MutateWith(map[string]string{"admin-password": "adminpw"})
+		if err != nil {
+			t.Fatalf("iter %d top: %v", i, err)
+		}
+		// Each deeper level inherits the parent's resolved map and forwards the
+		// same-named input (the self-referential `X: ${{inputs.X}}`).
+		for lvl := 1; lvl <= 5; lvl++ {
+			child := maps.Clone(m)
+			child["admin-password"] = "${{inputs.admin-password}}"
+			m, err = sm.MutateWith(child)
+			if err != nil {
+				t.Fatalf("iter %d level %d: %v", i, lvl, err)
+			}
+		}
+		if v := m["${{inputs.admin-password}}"]; v != "adminpw" {
+			t.Fatalf("iter %d: 6-level forwarded value = %q, want %q", i, v, "adminpw")
+		}
+	}
+}
+
+// Functional: compile a 3-level nested `uses:` (parent->child->grandchild) that
+// forwards a same-named input down to a `runs:` block. Pre-fix this
+// intermittently failed stripComments with "invalid parameter name".
+func Test_CompilePipelines_NestedForwardedInput(t *testing.T) {
+	ctx := slogtest.Context(t)
+	dir := t.TempDir()
+	write := func(name, body string) {
+		t.Helper()
+		require.NoError(t, os.WriteFile(filepath.Join(dir, name), []byte(body), 0o644))
+	}
+	write("parent.yaml", `
+inputs:
+  password:
+    default: defaultpw
+pipeline:
+  - uses: child
+    with:
+      password: ${{inputs.password}}
+`)
+	write("child.yaml", `
+inputs:
+  password:
+    default: childdefault
+pipeline:
+  - uses: grandchild
+    with:
+      password: ${{inputs.password}}
+`)
+	write("grandchild.yaml", `
+inputs:
+  password:
+    default: grandchilddefault
+pipeline:
+  - runs: |
+      echo "pw=${{inputs.password}}"
+`)
+
+	// repeats is an iteration count (NOT nesting depth); the pre-fix bug was
+	// intermittent (random map order), so repeat to fail reliably.
+	const repeats = 200
+	for i := range repeats {
+		cfg := config.Configuration{
+			Package: config.Package{Name: "foo", Version: "1.2.3"},
+			Pipeline: []config.Pipeline{{
+				Uses: "parent",
+				With: map[string]string{"password": "topsecret"},
+			}},
+		}
+		c := &Compiled{PipelineDirs: []string{dir}}
+		sm, err := NewSubstitutionMap(&cfg, "", "", nil)
+		require.NoError(t, err)
+
+		require.NoError(t, c.CompilePipelines(ctx, sm, cfg.Pipeline), "iter %d", i)
+
+		// parent -> child -> grandchild -> runs step
+		runs := cfg.Pipeline[0].Pipeline[0].Pipeline[0].Pipeline[0].Runs
+		require.Contains(t, runs, "pw=topsecret", "iter %d: runs=%q", i, runs)
+		require.NotContains(t, runs, "${{", "iter %d: unresolved template in runs=%q", i, runs)
+	}
+}
+
 func Test_substitutionNeedPackages(t *testing.T) {
 	ctx := slogtest.Context(t)
 	pkg := config.Package{