Fix double-substitution bug in runtime import expression replacement

[Copilot]

The iterative split/join loop in processExpressions could incorrectly re-substitute expression syntax found inside an already-evaluated value. For example, an issue title containing the literal text ${{ github.actor }} would have that text replaced with the actor's username — corrupting the output.

Changes

• runtime_import.cjs: Replace the multi-pass split/join loop with a single regex that matches all original expressions simultaneously, so evaluated values are never scanned again:

  const escapeForRegex = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
  const pattern = new RegExp(Array.from(replacements.keys()).map(escapeForRegex).join("|"), "g");
  const result = content.replace(pattern, match => replacements.get(match) ?? match);

• runtime_import.test.cjs: The existing test for this scenario had the correct assertion but was missing the mock-context override to set the issue title to a value containing expression syntax ("Use ${{ github.actor }} here"), so it wasn't actually exercising the bug.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[Copilot]

Pull request overview

This PR fixes a double-substitution bug in the expression replacement logic where literal expression syntax within evaluated values could be incorrectly replaced again. For example, an issue title containing ${{ github.actor }} would have that text replaced with the actual actor username, corrupting the output.

Changes:

• Replaced the iterative split/join replacement loop with a single-pass regex-based replacement to prevent re-scanning of evaluated values
• Added missing test setup to properly exercise the double-substitution scenario

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
actions/setup/js/runtime_import.cjs	Replaced multi-pass split/join loop with single regex pattern matching all expressions simultaneously to prevent double-substitution
actions/setup/js/runtime_import.test.cjs	Added missing mock context setup to set issue title containing expression syntax, enabling the test to actually validate the fix

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.