From bddcb7bfc8260f6e8b62d79c330efb63d535611f Mon Sep 17 00:00:00 2001
From: Emir Beganovic <beganovic.emir@gmail.com>
Date: Sat, 10 Oct 2026 08:59:41 +0200
Subject: [PATCH] Nightly: do not name the rclone pin RCLONE_VERSION

rclone reads every RCLONE_<FLAG> variable as that flag. The step that
installs it set RCLONE_VERSION=v1.75.2 for the download, so its own
"rclone version" ran as "--version=v1.75.2" and failed:

  Invalid value when setting --version from environment variable
  RCLONE_VERSION="v1.75.2": invalid argument for "--version" flag

Both publish jobs stopped there, before uploading, in every run since the
pin was added. Name the two variables PINNED_RCLONE and
PINNED_RCLONE_SHA256, and have the nightly test refuse any RCLONE_ variable
in a workflow other than the remote's RCLONE_CONFIG_ settings.
---
 .github/workflows/nightly-build.yml | 10 ++++++----
 test/unit/nightly-test.sh           |  6 ++++++
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/nightly-build.yml b/.github/workflows/nightly-build.yml
index f718bec..b057ecd 100644
--- a/.github/workflows/nightly-build.yml
+++ b/.github/workflows/nightly-build.yml
@@ -271,15 +271,17 @@ jobs:
       # it had stored the file, and the publish only passed on rclone's retry.
       # 1.60 sends "x-amz-acl: private" with each upload; current rclone does
       # not send it to Cloudflare.
+      # Not RCLONE_VERSION: rclone reads every RCLONE_<FLAG> variable as that
+      # flag, and "--version=v1.75.2" stops it before it does anything.
       - name: rclone
         env:
-          RCLONE_VERSION: v1.75.2
-          RCLONE_SHA256: efbfe852181f7191eb3c9043ed1ab49c9b2d0ba045c61c926a5da111c939ec5c
+          PINNED_RCLONE: v1.75.2
+          PINNED_RCLONE_SHA256: efbfe852181f7191eb3c9043ed1ab49c9b2d0ba045c61c926a5da111c939ec5c
         run: |
           set -euo pipefail
           [ -n "$RCLONE_CONFIG_R2_ACCESS_KEY_ID" ] || { echo "::error::the nightly environment has no bucket key"; exit 1; }
-          curl -fsSL --retry 3 -o rclone.deb "https://github.com/rclone/rclone/releases/download/$RCLONE_VERSION/rclone-$RCLONE_VERSION-linux-amd64.deb"
-          echo "$RCLONE_SHA256  rclone.deb" | sha256sum -c -
+          curl -fsSL --retry 3 -o rclone.deb "https://github.com/rclone/rclone/releases/download/$PINNED_RCLONE/rclone-$PINNED_RCLONE-linux-amd64.deb"
+          echo "$PINNED_RCLONE_SHA256  rclone.deb" | sha256sum -c -
           sudo dpkg -i rclone.deb >/dev/null
           rclone version | head -1
 
diff --git a/test/unit/nightly-test.sh b/test/unit/nightly-test.sh
index ea4ff23..3ae1efc 100644
--- a/test/unit/nightly-test.sh
+++ b/test/unit/nightly-test.sh
@@ -214,6 +214,12 @@ if PATH="$tmp/rc:$PATH" "$wrapped" copy a b >"$tmp/rc/out" 2>&1; then fail "rclo
 equal "rclone: its exit status is kept" "$(PATH="$tmp/rc:$PATH" "$wrapped" copy a b >/dev/null 2>&1; echo $?)" "3"
 if grep -q '::warning::' "$tmp/rc/out"; then fail "rclone: a failed upload was reported as a retry"; fi
 
+# rclone reads every RCLONE_<FLAG> variable as that flag: RCLONE_VERSION=v1.75.2
+# was "--version=v1.75.2" and stopped the publish before it uploaded anything.
+# Only its remote's settings, RCLONE_CONFIG_*, belong in a workflow's environment.
+flags=$(sed -nE 's/^[[:space:]]+(RCLONE_[A-Z0-9_]+):.*/\1/p' "$ROOT"/.github/workflows/*.yml | grep -v '^RCLONE_CONFIG_' | sort -u | paste -sd' ' || true)
+[[ -z $flags ]] || fail "rclone: a workflow sets $flags, which rclone would read as flags"
+
 # ------------------------------------------------------------ the install test
 # The harness is a script that starts a VM when it is read; take the two
 # functions out of it.