From 9b3c270db3d9d732ca03d1e3dda9b3b7855c7337 Mon Sep 17 00:00:00 2001
From: Adam Hall <adam.hall@aligent.com.au>
Date: Tue, 12 May 2026 14:39:45 +0930
Subject: [PATCH] HOTFIX: Disable glob expansion so /* does not expand out to
 the linux root directory for invalidations

---
 .github/workflows/pwa-deployment.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/pwa-deployment.yml b/.github/workflows/pwa-deployment.yml
index f26b31e..ded9a72 100644
--- a/.github/workflows/pwa-deployment.yml
+++ b/.github/workflows/pwa-deployment.yml
@@ -467,6 +467,9 @@ jobs:
         run: |
           echo "🔄 Invalidating CloudFront cache..."
 
+          # Disable glob expansion so /* is never expanded to filesystem paths
+          set -f
+
           # Parse invalidation paths
           PATHS=$(echo "${NEEDS_PREPARE_OUTPUTS_INVALIDATION_PATHS}" | jq -r '.[]')
 
@@ -490,6 +493,7 @@ jobs:
             --paths $PATHS \
             --query 'Invalidation.Id' \
             --output text)
+          set +f
 
           echo "✅ CloudFront invalidation created: $INVALIDATION_ID"