This logic is the same as the current one: https://onecompiler.com/nodejs/3xmb4n6tq

The outcome is sadly different

const util = require('util');
const exec = util.promisify(require('child_process').exec);
async function printenv() {
    process.env.TEST_ENV_BANANA = undefined
    process.env.TEST_ENV_APPLE = undefined
    delete process.env.TEST_ENV_APPLE
  try {
      const { stdout, stderr } = await exec('printenv | grep TEST_ENV_');
      console.log('stdout:', stdout);
      console.log('stderr:', stderr);
  } catch (err) {
     console.error(err);
  };
};
printenv();

As you can see in the case of TEST_ENV_BANANA the environment variable is set in the subprocess.
Unlike TEST_ENV_APPLE which was deleted instead of undefined
This causes issue when using EC2 metadata api for getting AWS credentials, as now the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY will both be set to undefined eg they have a value and therefor the AWS cli will try to use them instead of falling back thru the credential chain and use the ec2 metadata api.

So the problem is when

 process.env.AWS_SECRET_ACCESS_KEY = password ||  process.env.AWS_SECRET_ACCESS_KEY

if process.env.AWS_SECRET_ACCESS_KEY and password are both undefined we end up assigning process.env.AWS_SECRET_ACCESS_KEY = undefined which causes this env var to be set for subprocesses.

Here's an updated onecompiler link where you can see that the result will differ
https://onecompiler.com/nodejs/3xmbfxhf6
https://onecompiler.com/nodejs/3xmbg2nzw

Oh ok so this is related to sub steps in the workflow right?

Yes!
If you want to use this action on a self-hosted runner on AWS, the runner can have access to login to AWS ECR without having to set any credentials

      - name: Login to ECR
        uses: docker/login-action@v1
        with:
          registry: <aws-account-number>.dkr.ecr.<region>.amazonaws.com

Eventually the action will run the aws cli to get the login token, line 77 or 81 here. Which would be affected by any process.env changes done in node here since it a child process

We use the docker/login-action for or other workflows so it would be nice to be able to use it on our self-hosted runners as well without having to specify the credentials in those workflows :)

Why node.js propagates env vars as undefined I have no clue 😄

Ok I think instead we could set the env var to the current process in getExecOutput. I will open a PR with this solution and come back to you. I keep yours open in case mine doesn't fit your needs.