use ms attest

Signed-off-by: Brian DeHamer <[email protected]>
2024-11-19 09:46:33 -08:00
12 changed files with 2022 additions and 2546 deletions
@@ -0,0 +1,4 @@
+lib/
+dist/
+node_modules/
+coverage/
@@ -0,0 +1,83 @@
+env:
+  node: true
+  es6: true
+  jest: true
+
+globals:
+  Atomics: readonly
+  SharedArrayBuffer: readonly
+
+ignorePatterns:
+  - '!.*'
+  - '**/node_modules/.*'
+  - '**/dist/.*'
+  - '**/coverage/.*'
+  - '*.json'
+
+parser: '@typescript-eslint/parser'
+
+parserOptions:
+  ecmaVersion: 2023
+  sourceType: module
+  project:
+    - './.github/linters/tsconfig.json'
+    - './tsconfig.json'
+
+plugins:
+  - jest
+  - '@typescript-eslint'
+
+extends:
+  - eslint:recommended
+  - plugin:@typescript-eslint/eslint-recommended
+  - plugin:@typescript-eslint/recommended
+  - plugin:github/recommended
+  - plugin:jest/recommended
+
+rules:
+  {
+    'camelcase': 'off',
+    'eslint-comments/no-use': 'off',
+    'eslint-comments/no-unused-disable': 'off',
+    'i18n-text/no-en': 'off',
+    'import/no-namespace': 'off',
+    'no-console': 'off',
+    'no-unused-vars': 'off',
+    'prettier/prettier': 'error',
+    'semi': 'off',
+    '@typescript-eslint/array-type': 'error',
+    '@typescript-eslint/await-thenable': 'error',
+    '@typescript-eslint/ban-ts-comment': 'error',
+    '@typescript-eslint/consistent-type-assertions': 'error',
+    '@typescript-eslint/explicit-member-accessibility':
+      ['error', { 'accessibility': 'no-public' }],
+    '@typescript-eslint/explicit-function-return-type':
+      ['error', { 'allowExpressions': true }],
+    '@typescript-eslint/func-call-spacing': ['error', 'never'],
+    '@typescript-eslint/no-array-constructor': 'error',
+    '@typescript-eslint/no-empty-interface': 'error',
+    '@typescript-eslint/no-explicit-any': 'error',
+    '@typescript-eslint/no-extraneous-class': 'error',
+    '@typescript-eslint/no-for-in-array': 'error',
+    '@typescript-eslint/no-inferrable-types': 'error',
+    '@typescript-eslint/no-misused-new': 'error',
+    '@typescript-eslint/no-namespace': 'error',
+    '@typescript-eslint/no-non-null-assertion': 'warn',
+    '@typescript-eslint/no-require-imports': 'error',
+    '@typescript-eslint/no-unnecessary-qualifier': 'error',
+    '@typescript-eslint/no-unnecessary-type-assertion': 'error',
+    '@typescript-eslint/no-unused-vars': 'error',
+    '@typescript-eslint/no-useless-constructor': 'error',
+    '@typescript-eslint/no-var-requires': 'error',
+    '@typescript-eslint/prefer-for-of': 'warn',
+    '@typescript-eslint/prefer-function-type': 'warn',
+    '@typescript-eslint/prefer-includes': 'error',
+    '@typescript-eslint/prefer-string-starts-ends-with': 'error',
+    '@typescript-eslint/promise-function-async': 'error',
+    '@typescript-eslint/require-array-sort-compare': 'error',
+    '@typescript-eslint/restrict-plus-operands': 'error',
+    '@typescript-eslint/semi': ['error', 'never'],
+    '@typescript-eslint/space-before-function-paren': 'off',
+    '@typescript-eslint/type-annotation-spacing': 'error',
+    '@typescript-eslint/unbound-method': 'error'
+  }
@@ -1,92 +0,0 @@
-import eslint from '@eslint/js'
-import importplugin from 'eslint-plugin-import'
-import jestplugin from 'eslint-plugin-jest'
-import tseslint from 'typescript-eslint'
-
-export default tseslint.config(
-  // Ignore non-project files
-  {
-    name: 'ignore',
-    ignores: ['.github', 'dist', 'coverage', '**/*.json', 'jest.setup.js']
-  },
-  // Use recommended rules from ESLint, TypeScript, and other plugins
-  eslint.configs.recommended,
-  tseslint.configs.recommendedTypeChecked,
-  jestplugin.configs['flat/recommended'],
-  importplugin.flatConfigs.recommended,
-  importplugin.flatConfigs.typescript,
-  // Override some rules
-  {
-    name: 'project-settings',
-    languageOptions: {
-      ecmaVersion: 2023,
-      parserOptions: {
-        project: ['./.github/linters/tsconfig.json', './tsconfig.json']
-      }
-    },
-    rules: {
-      // eslint rules
-      eqeqeq: ['error', 'smart'],
-      'func-style': ['error', 'declaration', { allowArrowFunctions: true }],
-      'no-console': 'off',
-      'no-implicit-globals': 'error',
-      'no-inner-declarations': 'error',
-      'no-invalid-this': 'error',
-      'no-return-assign': 'error',
-      'no-sequences': 'error',
-      'no-shadow': 'error',
-      'no-useless-concat': 'error',
-      'object-shorthand': ['error', 'always', { avoidQuotes: true }],
-      'one-var': ['error', 'never'],
-      'prefer-template': 'error',
-
-      // typescript-eslint rules
-      '@typescript-eslint/array-type': 'error',
-      '@typescript-eslint/consistent-type-assertions': 'error',
-      '@typescript-eslint/explicit-function-return-type': [
-        'error',
-        { allowExpressions: true }
-      ],
-      '@typescript-eslint/explicit-member-accessibility': [
-        'error',
-        { accessibility: 'no-public' }
-      ],
-      '@typescript-eslint/no-extraneous-class': 'error',
-      '@typescript-eslint/no-inferrable-types': 'error',
-      '@typescript-eslint/no-non-null-assertion': 'warn',
-      '@typescript-eslint/no-unnecessary-qualifier': 'error',
-      '@typescript-eslint/no-unsafe-assignment': 'off',
-      '@typescript-eslint/no-useless-constructor': 'error',
-      '@typescript-eslint/prefer-for-of': 'warn',
-      '@typescript-eslint/prefer-function-type': 'warn',
-      '@typescript-eslint/prefer-includes': 'error',
-      '@typescript-eslint/prefer-string-starts-ends-with': 'error',
-      '@typescript-eslint/promise-function-async': 'error',
-      '@typescript-eslint/require-array-sort-compare': 'error',
-      '@typescript-eslint/restrict-template-expressions': 'off',
-
-      // eslint-plugin-import rules
-      'import/extensions': 'error',
-      'import/first': 'error',
-      'import/no-absolute-path': 'error',
-      'import/no-commonjs': 'error',
-      'import/no-deprecated': 'warn',
-      'import/no-dynamic-require': 'error',
-      'import/no-extraneous-dependencies': 'error',
-      'import/no-mutable-exports': 'error',
-      'import/no-namespace': 'off',
-      'import/no-unresolved': ['error', { ignore: ['csv-parse/sync'] }],
-      'import/no-anonymous-default-export': [
-        'error',
-        {
-          allowAnonymousClass: false,
-          allowAnonymousFunction: false,
-          allowArray: true,
-          allowArrowFunction: false,
-          allowLiteral: true,
-          allowObject: true
-        }
-      ]
-    }
-  }
-)
@@ -38,7 +38,7 @@ jobs:

      - name: Lint Codebase
        id: super-linter
-        uses: super-linter/super-linter/slim@v7.4.0
+        uses: super-linter/super-linter/slim@v7
        env:
          DEFAULT_BRANCH: main
          FILTER_REGEX_EXCLUDE: dist/**/*
@@ -46,10 +46,6 @@ jobs:
          TYPESCRIPT_DEFAULT_STYLE: prettier
          VALIDATE_ALL_CODEBASE: true
          VALIDATE_JAVASCRIPT_STANDARD: false
-          VALIDATE_TYPESCRIPT_ES: false
          VALIDATE_TYPESCRIPT_STANDARD: false
          VALIDATE_JSCPD: false
          VALIDATE_YAML_PRETTIER: false
-
-      - name: Run eslint
-        run: npm run lint:eslint
@@ -29,7 +29,7 @@ jobs:
          date > artifact

      - name: Attest build provenance
-        uses: actions/attest-build-provenance@v2
+        uses: actions/attest-build-provenance@v1
        env:
          INPUT_PRIVATE-SIGNING: ${{ inputs.sigstore == 'github' && 'true' || 'false' }}
        with:
@@ -48,7 +48,7 @@ jobs:

      - name: Report attestation prober success
        if: ${{ success() }}
-        uses: masci/datadog@6889e9d060f5368eeee51f8a3f06a52f65d04da3 # v1.9.1
+        uses: masci/datadog@a5d283e78e33a688ed08a96ba64440505e645a8c # v1.7.1
        with:
          api-key: "${{ secrets.DATADOG_API_KEY }}"
          service-checks: |
@@ -66,7 +66,7 @@ jobs:

      - name: Report attestation prober failure
        if: ${{ failure() }}
-        uses: masci/datadog@6889e9d060f5368eeee51f8a3f06a52f65d04da3 # v1.9.1
+        uses: masci/datadog@a5d283e78e33a688ed08a96ba64440505e645a8c # v1.7.1
        with:
          api-key: "${{ secrets.DATADOG_API_KEY }}"
          service-checks: |
@@ -25,16 +25,6 @@ CLI][5].
 See [Using artifact attestations to establish provenance for builds][9] for more
 information on artifact attestations.

-<!-- prettier-ignore-start -->
-> [!NOTE]
-> Artifact attestations are available in public repositories for all
-> current GitHub plans. They are not available on legacy plans, such as Bronze,
-> Silver, or Gold. If you are on a GitHub Free, GitHub Pro, or GitHub Team plan,
-> artifact attestations are only available for public repositories. To use
-> artifact attestations in private or internal repositories, you must be on a
-> GitHub Enterprise Cloud plan.
-<!-- prettier-ignore-end -->
-
 ## Usage

 Within the GitHub Actions workflow which builds some artifact you would like to
@@ -55,7 +45,7 @@ attest:
 1. Add the following to your workflow after your artifact has been built:

   ```yaml
-   - uses: actions/attest-build-provenance@v2
+   - uses: actions/attest-build-provenance@v1
     with:
       subject-path: '<PATH TO ARTIFACT>'
   ```
@@ -68,28 +58,23 @@ attest:
 See [action.yml](action.yml)

 ```yaml
- uses: actions/attest-build-provenance@v2
+- uses: actions/attest-build-provenance@v1
  with:
    # Path to the artifact serving as the subject of the attestation. Must
-    # specify exactly one of "subject-path", "subject-digest", or
-    # "subject-checksums". May contain a glob pattern or list of paths
-    # (total subject count cannot exceed 1024).
+    # specify exactly one of "subject-path" or "subject-digest". May contain a
+    # glob pattern or list of paths (total subject count cannot exceed 2500).
    subject-path:

    # SHA256 digest of the subject for the attestation. Must be in the form
    # "sha256:hex_digest" (e.g. "sha256:abc123..."). Must specify exactly one
-    # of "subject-path", "subject-digest", or "subject-checksums".
+    # of "subject-path" or "subject-digest".
    subject-digest:

-    # Subject name as it should appear in the attestation. Required when
-    # identifying the subject with the "subject-digest" input.
+    # Subject name as it should appear in the attestation. Required unless
+    # "subject-path" is specified, in which case it will be inferred from the
+    # path.
    subject-name:

-    # Path to checksums file containing digest and name of subjects for
-    # attestation. Must specify exactly one of "subject-path", "subject-digest",
-    # or "subject-checksums".
-    subject-checksums:
-
    # Whether to push the attestation to the image registry. Requires that the
    # "subject-name" parameter specify the fully-qualified image name and that
    # the "subject-digest" parameter be specified. Defaults to false.
@@ -108,28 +93,26 @@ See [action.yml](action.yml)

 <!-- markdownlint-disable MD013 -->

-| Name              | Description                                                    | Example                                          |
-| ----------------- | -------------------------------------------------------------- | ------------------------------------------------ |
-| `attestation-id`  | GitHub ID for the attestation                                  | `123456`                                         |
-| `attestation-url` | URL for the attestation summary                                | `https://github.com/foo/bar/attestations/123456` |
-| `bundle-path`     | Absolute path to the file containing the generated attestation | `/tmp/attestation.json`                          |
+| Name          | Description                                                    | Example                  |
+| ------------- | -------------------------------------------------------------- | ------------------------ |
+| `bundle-path` | Absolute path to the file containing the generated attestation | `/tmp/attestation.jsonl` |

 <!-- markdownlint-enable MD013 -->

 Attestations are saved in the JSON-serialized [Sigstore bundle][6] format.

-If multiple subjects are being attested at the same time, a single attestation
-will be created with references to each of the supplied subjects.
-
-The absolute path to the generated attestation is appended to the file
-`${RUNNER_TEMP}/created_attestation_paths.txt`. This file will accumulate the
-paths to all attestations created over the course of a single workflow.
+If multiple subjects are being attested at the same time, each attestation will
+be written to the output file on a separate line (using the [JSON Lines][7]
+format).

 ## Attestation Limits

 ### Subject Limits

-No more than 1024 subjects can be attested at the same time.
+No more than 2500 subjects can be attested at the same time. Subjects will be
+processed in batches 50. After the initial group of 50, each subsequent batch
+will incur an exponentially increasing amount of delay (capped at 1 minute of
+delay per batch) to avoid overwhelming the attestation API.

 ## Examples

@@ -147,7 +130,6 @@ on:

 jobs:
  build:
-    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
@@ -159,18 +141,18 @@ jobs:
      - name: Build artifact
        run: make my-app
      - name: Attest
-        uses: actions/attest-build-provenance@v2
+        uses: actions/attest-build-provenance@v1
        with:
          subject-path: '${{ github.workspace }}/my-app'
 ```

 ### Identify Multiple Subjects

-If you are generating multiple artifacts, you can attest all of them at the same
-time by using a wildcard in the `subject-path` input.
+If you are generating multiple artifacts, you can generate a provenance
+attestation for each by using a wildcard in the `subject-path` input.

 ```yaml
- uses: actions/attest-build-provenance@v2
+- uses: actions/attest-build-provenance@v1
  with:
    subject-path: 'dist/**/my-bin-*'
 ```
@@ -182,53 +164,19 @@ Alternatively, you can explicitly list multiple subjects with either a comma or
 newline delimited list:

 ```yaml
- uses: actions/attest-build-provenance@v2
+- uses: actions/attest-build-provenance@v1
  with:
    subject-path: 'dist/foo, dist/bar'
 ```

 ```yaml
- uses: actions/attest-build-provenance@v2
+- uses: actions/attest-build-provenance@v1
  with:
    subject-path: |
      dist/foo
      dist/bar
 ```

-### Identify Subjects with Checksums File
-
-If you are using tools like
-[goreleaser](https://goreleaser.com/customization/checksum/) or
-[jreleaser](https://jreleaser.org/guide/latest/reference/checksum.html) which
-generate a checksums file you can identify the attestation subjects by passing
-the path of the checksums file to the `subject-checksums` input. Each of the
-artifacts identified in the checksums file will be listed as a subject for the
-attestation.
-
-```yaml
- name: Calculate artifact digests
-  run: |
-    shasum -a 256 foo_0.0.1_* > subject.checksums.txt
- uses: actions/attest-build-provenance@v2
-  with:
-    subject-checksums: subject.checksums.txt
-```
-
-<!-- markdownlint-disable MD038 -->
-
-The file referenced by the `subject-checksums` input must conform to the same
-format used by the shasum tools. Each subject should be listed on a separate
-line including the hex-encoded digest (either SHA256 or SHA512), a space, a
-single character flag indicating either binary (`*`) or text (` `) input mode,
-and the filename.
-
-<!-- markdownlint-enable MD038 -->
-
-```text
-b569bf992b287f55d78bf8ee476497e9b7e9d2bf1c338860bfb905016218c740  foo_0.0.1_darwin_amd64
-a54fc515e616cac7fcf11a49d5c5ec9ec315948a5935c1e11dd610b834b14dde  foo_0.0.1_darwin_arm64
-```
-
 ### Container Image

 When working with container images you can invoke the action with the
@@ -282,7 +230,7 @@ jobs:
          push: true
          tags: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
      - name: Attest
-        uses: actions/attest-build-provenance@v2
+        uses: actions/attest-build-provenance@v1
        id: attest
        with:
          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
@@ -290,26 +238,6 @@ jobs:
          push-to-registry: true
 ```

-### Integration with `actions/upload-artifact`
-
-If you'd like to create an attestation for an archive created with the
-[actions/upload-artifact][11] action you can feed the digest of the generated
-artifact directly into the `subject-digest` input of the attestation action.
-
-```yaml
- name: Upload build artifact
-  id: upload
-  uses: actions/upload-artifact@v4
-  with:
-    path: dist/*
-    name: artifact.zip
-
- uses: actions/attest-build-provenance@v2
-  with:
-    subject-name: artifact.zip
-    subject-digest: sha256:${{ steps.upload.outputs.artifact-digest }}
-```
-
 [1]: https://github.com/actions/toolkit/tree/main/packages/attest
 [2]: https://github.com/in-toto/attestation/tree/main/spec/v1
 [3]: https://slsa.dev/spec/v1.0/provenance
@@ -317,8 +245,8 @@ artifact directly into the `subject-digest` input of the attestation action.
 [5]: https://cli.github.com/manual/gh_attestation_verify
 [6]:
  https://github.com/sigstore/protobuf-specs/blob/main/protos/sigstore_bundle.proto
+[7]: https://jsonlines.org/
 [8]: https://github.com/actions/toolkit/tree/main/packages/glob#patterns
 [9]:
  https://docs.github.com/en/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds
 [10]: https://github.com/sigstore/cosign/blob/main/specs/BUNDLE_SPEC.md
-[11]: https://github.com/actions/upload-artifact
@@ -7,7 +7,7 @@ exports[`main when a non-default OIDC issuer is used successfully run main 1`] =
    "externalParameters": {
      "workflow": {
        "path": ".github/workflows/main.yml",
-        "ref": "refs/heads/main",
+        "ref": "main",
        "repository": "https://example-01.ghe.com/owner/repo",
      },
    },
@@ -46,7 +46,7 @@ exports[`main when the default OIDC issuer is used successfully run main 1`] = `
    "externalParameters": {
      "workflow": {
        "path": ".github/workflows/main.yml",
-        "ref": "refs/heads/main",
+        "ref": "main",
        "repository": "https://github.com/owner/repo",
      },
    },
@@ -8,7 +8,7 @@ import * as main from '../src/main'
 const runMock = jest.spyOn(main, 'run').mockImplementation()

 describe('index', () => {
-  it('calls run when imported', () => {
+  it('calls run when imported', async () => {
    // eslint-disable-next-line @typescript-eslint/no-require-imports
    require('../src/index')

@@ -9,26 +9,20 @@ inputs:
  subject-path:
    description: >
      Path to the artifact serving as the subject of the attestation. Must
-      specify exactly one of "subject-path", "subject-digest", or
-      "subject-checksums". May contain a glob pattern or list of paths
-      (total subject count cannot exceed 1024).
+      specify exactly one of "subject-path" or "subject-digest". May contain a
+      glob pattern or list of paths (total subject count cannot exceed 2500).
    required: false
  subject-digest:
    description: >
      Digest of the subject for which provenance will be generated. Must be in
      the form "algorithm:hex_digest" (e.g. "sha256:abc123..."). Must specify
-      exactly one of "subject-path", "subject-digest", or "subject-checksums".
+      exactly one of "subject-path" or "subject-digest".
    required: false
  subject-name:
    description: >
-      Subject name as it should appear in the attestation. Required when
-      identifying the subject with the "subject-digest" input.
-  subject-checksums:
-    description: >
-      Path to checksums file containing digest and name of subjects for
-      attestation. Must specify exactly one of "subject-path", "subject-digest",
-      or "subject-checksums".
-    required: false
+      Subject name as it should appear in the provenance statement. Required
+      unless "subject-path" is specified, in which case it will be inferred from
+      the path.
  push-to-registry:
    description: >
      Whether to push the provenance statement to the image registry. Requires
@@ -50,27 +44,20 @@ inputs:

 outputs:
  bundle-path:
-    description: 'The path to the file containing the attestation bundle.'
+    description: 'The path to the file containing the attestation bundle(s).'
    value: ${{ steps.attest.outputs.bundle-path }}
-  attestation-id:
-    description: 'The ID of the attestation.'
-    value: ${{ steps.attest.outputs.attestation-id }}
-  attestation-url:
-    description: 'The URL for the attestation summary.'
-    value: ${{ steps.attest.outputs.attestation-url }}

 runs:
  using: 'composite'
  steps:
-    - uses: actions/attest-build-provenance/predicate@1176ef556905f349f669722abf30bce1a6e16e01 # [email protected].5
+    - uses: actions/attest-build-provenance/predicate@36fa7d009e22618ca7cd599486979b8150596c74 # [email protected].4
      id: generate-build-provenance-predicate
-    - uses: actions/attest@ce27ba3b4a9a139d9a20a4a07d69fabb52f1e5bc # v2.4.0
+    - uses: actions/attest@main
      id: attest
      with:
        subject-path: ${{ inputs.subject-path }}
        subject-digest: ${{ inputs.subject-digest }}
        subject-name: ${{ inputs.subject-name }}
-        subject-checksums: ${{ inputs.subject-checksums }}
        predicate-type: ${{ steps.generate-build-provenance-predicate.outputs.predicate-type }}
        predicate: ${{ steps.generate-build-provenance-predicate.outputs.predicate }}
        push-to-registry: ${{ inputs.push-to-registry }}
@@ -377,9 +377,11 @@ const buildSLSAProvenancePredicate = (issuer) => __awaiter(void 0, void 0, void
    // Split just the path and ref from the workflow string.
    // owner/repo/.github/workflows/main.yml@main =>
    //   .github/workflows/main.yml, main
-    const [workflowPath] = claims.workflow_ref
+    const [workflowPath, ...workflowRefChunks] = claims.workflow_ref
        .replace(`${claims.repository}/`, '')
        .split('@');
+    // Handle case where tag contains `@` (e.g: when using changesets in a monorepo context),
+    const workflowRef = workflowRefChunks.join('@');
    return {
        type: SLSA_PREDICATE_V1_TYPE,
        params: {
@@ -387,7 +389,7 @@ const buildSLSAProvenancePredicate = (issuer) => __awaiter(void 0, void 0, void
                buildType: GITHUB_BUILD_TYPE,
                externalParameters: {
                    workflow: {
-                        ref: claims.ref,
+                        ref: workflowRef,
                        repository: `${serverURL}/${claims.repository}`,
                        path: workflowPath
                    }
@@ -5744,7 +5746,7 @@ module.exports = __toCommonJS(dist_src_exports);
 var import_universal_user_agent = __nccwpck_require__(33843);

 // pkg/dist-src/version.js
-var VERSION = "9.0.6";
+var VERSION = "9.0.4";

 // pkg/dist-src/defaults.js
 var userAgent = `octokit-endpoint.js/${VERSION} ${(0, import_universal_user_agent.getUserAgent)()}`;
@@ -5849,9 +5851,9 @@ function addQueryParameters(url, parameters) {
 }

 // pkg/dist-src/util/extract-url-variable-names.js
-var urlVariableRegex = /\{[^{}}]+\}/g;
+var urlVariableRegex = /\{[^}]+\}/g;
 function removeNonChars(variableName) {
-  return variableName.replace(/(?:^\W+)|(?:(?<!\W)\W+$)/g, "").split(/,/);
+  return variableName.replace(/^\W+|\W+$/g, "").split(/,/);
 }
 function extractUrlVariableNames(url) {
  const matches = url.match(urlVariableRegex);
@@ -6037,7 +6039,7 @@ function parse(options) {
    }
    if (url.endsWith("/graphql")) {
      if (options.mediaType.previews?.length) {
-        const previewsFromAcceptHeader = headers.accept.match(/(?<![\w-])[\w-]+(?=-preview)/g) || [];
+        const previewsFromAcceptHeader = headers.accept.match(/[\w-]+(?=-preview)/g) || [];
        headers.accept = previewsFromAcceptHeader.concat(options.mediaType.previews).map((preview) => {
          const format = options.mediaType.format ? `.${options.mediaType.format}` : "+json";
          return `application/vnd.github.${preview}-preview${format}`;
@@ -9008,7 +9010,7 @@ var RequestError = class extends Error {
    if (options.request.headers.authorization) {
      requestCopy.headers = Object.assign({}, options.request.headers, {
        authorization: options.request.headers.authorization.replace(
-          /(?<! ) .*$/,
+          / .*$/,
          " [REDACTED]"
        )
      });
@@ -9076,7 +9078,7 @@ var import_endpoint = __nccwpck_require__(54471);
 var import_universal_user_agent = __nccwpck_require__(33843);

 // pkg/dist-src/version.js
-var VERSION = "8.4.1";
+var VERSION = "8.2.0";

 // pkg/dist-src/is-plain-object.js
 function isPlainObject(value) {
@@ -9101,7 +9103,7 @@ function getBufferResponse(response) {

 // pkg/dist-src/fetch-wrapper.js
 function fetchWrapper(requestOptions) {
-  var _a, _b, _c, _d;
+  var _a, _b, _c;
  const log = requestOptions.request && requestOptions.request.log ? requestOptions.request.log : console;
  const parseSuccessResponseBody = ((_a = requestOptions.request) == null ? void 0 : _a.parseSuccessResponseBody) !== false;
  if (isPlainObject(requestOptions.body) || Array.isArray(requestOptions.body)) {
@@ -9122,9 +9124,8 @@ function fetchWrapper(requestOptions) {
  return fetch(requestOptions.url, {
    method: requestOptions.method,
    body: requestOptions.body,
-    redirect: (_c = requestOptions.request) == null ? void 0 : _c.redirect,
    headers: requestOptions.headers,
-    signal: (_d = requestOptions.request) == null ? void 0 : _d.signal,
+    signal: (_c = requestOptions.request) == null ? void 0 : _c.signal,
    // duplex must be set if request.body is ReadableStream or Async Iterables.
    // See https://fetch.spec.whatwg.org/#dom-requestinit-duplex.
    ...requestOptions.body && { duplex: "half" }
@@ -9135,7 +9136,7 @@ function fetchWrapper(requestOptions) {
      headers[keyAndValue[0]] = keyAndValue[1];
    }
    if ("deprecation" in headers) {
-      const matches = headers.link && headers.link.match(/<([^<>]+)>; rel="deprecation"/);
+      const matches = headers.link && headers.link.match(/<([^>]+)>; rel="deprecation"/);
      const deprecationLink = matches && matches.pop();
      log.warn(
        `[@octokit/request] "${requestOptions.method} ${requestOptions.url}" is deprecated. It is scheduled to be removed on ${headers.sunset}${deprecationLink ? `. See ${deprecationLink}` : ""}`
@@ -15000,13 +15001,8 @@ class Agent extends http.Agent {
            .then((socket) => {
            this.decrementSockets(name, fakeSocket);
            if (socket instanceof http.Agent) {
-                try {
-                    // @ts-expect-error `addRequest()` isn't defined in `@types/node`
-                    return socket.addRequest(req, connectOpts);
-                }
-                catch (err) {
-                    return cb(err);
-                }
+                // @ts-expect-error `addRequest()` isn't defined in `@types/node`
+                return socket.addRequest(req, connectOpts);
            }
            this[INTERNAL].currentSocket = socket;
            // @ts-expect-error `createSocket()` isn't defined in `@types/node`
@@ -20961,17 +20957,6 @@ const agent_base_1 = __nccwpck_require__(98894);
 const url_1 = __nccwpck_require__(87016);
 const parse_proxy_response_1 = __nccwpck_require__(37943);
 const debug = (0, debug_1.default)('https-proxy-agent');
-const setServernameFromNonIpHost = (options) => {
-    if (options.servername === undefined &&
-        options.host &&
-        !net.isIP(options.host)) {
-        return {
-            ...options,
-            servername: options.host,
-        };
-    }
-    return options;
-};
 /**
 * The `HttpsProxyAgent` implements an HTTP Agent subclass that connects to
 * the specified "HTTP(s) proxy server" in order to proxy HTTPS requests.
@@ -21019,7 +21004,11 @@ class HttpsProxyAgent extends agent_base_1.Agent {
        let socket;
        if (proxy.protocol === 'https:') {
            debug('Creating `tls.Socket`: %o', this.connectOpts);
-            socket = tls.connect(setServernameFromNonIpHost(this.connectOpts));
+            const servername = this.connectOpts.servername || this.connectOpts.host;
+            socket = tls.connect({
+                ...this.connectOpts,
+                servername,
+            });
        }
        else {
            debug('Creating `net.Socket`: %o', this.connectOpts);
@@ -21055,9 +21044,11 @@ class HttpsProxyAgent extends agent_base_1.Agent {
                // The proxy is connecting to a TLS server, so upgrade
                // this socket connection to a TLS connection.
                debug('Upgrading socket connection to TLS');
+                const servername = opts.servername || opts.host;
                return tls.connect({
-                    ...omit(setServernameFromNonIpHost(opts), 'host', 'path', 'port'),
+                    ...omit(opts, 'host', 'path', 'port'),
                    socket,
+                    servername,
                });
            }
            return socket;
@@ -39056,9 +39047,6 @@ module.exports = safer
 /***/ 89379:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {

-"use strict";
-
-
 const ANY = Symbol('SemVer ANY')
 // hoisted class for cyclic dependency
 class Comparator {
@@ -39207,9 +39195,6 @@ const Range = __nccwpck_require__(96782)
 /***/ 96782:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {

-"use strict";
-
-
 const SPACE_CHARACTERS = /\s+/g

 // hoisted class for cyclic dependency
@@ -39771,9 +39756,6 @@ const testSet = (set, version, options) => {
 /***/ 7163:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {

-"use strict";
-
-
 const debug = __nccwpck_require__(1159)
 const { MAX_LENGTH, MAX_SAFE_INTEGER } = __nccwpck_require__(45101)
 const { safeRe: re, t } = __nccwpck_require__(95471)
@@ -39786,7 +39768,7 @@ class SemVer {

    if (version instanceof SemVer) {
      if (version.loose === !!options.loose &&
-        version.includePrerelease === !!options.includePrerelease) {
+          version.includePrerelease === !!options.includePrerelease) {
        return version
      } else {
        version = version.version
@@ -39952,19 +39934,6 @@ class SemVer {
  // preminor will bump the version up to the next minor release, and immediately
  // down to pre-release. premajor and prepatch work the same way.
  inc (release, identifier, identifierBase) {
-    if (release.startsWith('pre')) {
-      if (!identifier && identifierBase === false) {
-        throw new Error('invalid increment argument: identifier is empty')
-      }
-      // Avoid an invalid semver results
-      if (identifier) {
-        const match = `-${identifier}`.match(this.options.loose ? re[t.PRERELEASELOOSE] : re[t.PRERELEASE])
-        if (!match || match[1] !== identifier) {
-          throw new Error(`invalid identifier: ${identifier}`)
-        }
-      }
-    }
-
    switch (release) {
      case 'premajor':
        this.prerelease.length = 0
@@ -39995,12 +39964,6 @@ class SemVer {
        }
        this.inc('pre', identifier, identifierBase)
        break
-      case 'release':
-        if (this.prerelease.length === 0) {
-          throw new Error(`version ${this.raw} is not a prerelease`)
-        }
-        this.prerelease.length = 0
-        break

      case 'major':
        // If this is a pre-major version, bump up to the same major version.
@@ -40044,6 +40007,10 @@ class SemVer {
      case 'pre': {
        const base = Number(identifierBase) ? 1 : 0

+        if (!identifier && identifierBase === false) {
+          throw new Error('invalid increment argument: identifier is empty')
+        }
+
        if (this.prerelease.length === 0) {
          this.prerelease = [base]
        } else {
@@ -40098,9 +40065,6 @@ module.exports = SemVer
 /***/ 1799:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {

-"use strict";
-
-
 const parse = __nccwpck_require__(16353)
 const clean = (version, options) => {
  const s = parse(version.trim().replace(/^[=v]+/, ''), options)
@@ -40114,9 +40078,6 @@ module.exports = clean
 /***/ 28646:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {

-"use strict";
-
-
 const eq = __nccwpck_require__(55082)
 const neq = __nccwpck_require__(4974)
 const gt = __nccwpck_require__(16599)
@@ -40176,9 +40137,6 @@ module.exports = cmp
 /***/ 35385:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {

-"use strict";
-
-
 const SemVer = __nccwpck_require__(7163)
 const parse = __nccwpck_require__(16353)
 const { safeRe: re, t } = __nccwpck_require__(95471)
@@ -40246,9 +40204,6 @@ module.exports = coerce
 /***/ 37648:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {

-"use strict";
-
-
 const SemVer = __nccwpck_require__(7163)
 const compareBuild = (a, b, loose) => {
  const versionA = new SemVer(a, loose)
@@ -40263,9 +40218,6 @@ module.exports = compareBuild
 /***/ 56874:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {

-"use strict";
-
-
 const compare = __nccwpck_require__(78469)
 const compareLoose = (a, b) => compare(a, b, true)
 module.exports = compareLoose
@@ -40276,9 +40228,6 @@ module.exports = compareLoose
 /***/ 78469:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {

-"use strict";
-
-
 const SemVer = __nccwpck_require__(7163)
 const compare = (a, b, loose) =>
  new SemVer(a, loose).compare(new SemVer(b, loose))
@@ -40291,9 +40240,6 @@ module.exports = compare
 /***/ 70711:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {

-"use strict";
-
-
 const parse = __nccwpck_require__(16353)

 const diff = (version1, version2) => {
@@ -40323,13 +40269,20 @@ const diff = (version1, version2) => {
      return 'major'
    }

-    // If the main part has no difference
-    if (lowVersion.compareMain(highVersion) === 0) {
-      if (lowVersion.minor && !lowVersion.patch) {
-        return 'minor'
-      }
+    // Otherwise it can be determined by checking the high version
+
+    if (highVersion.patch) {
+      // anything higher than a patch bump would result in the wrong version
      return 'patch'
    }
+
+    if (highVersion.minor) {
+      // anything higher than a minor bump would result in the wrong version
+      return 'minor'
+    }
+
+    // bumping major/minor/patch all have same result
+    return 'major'
  }

  // add the `pre` prefix if we are going to a prerelease version
@@ -40359,9 +40312,6 @@ module.exports = diff
 /***/ 55082:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {

-"use strict";
-
-
 const compare = __nccwpck_require__(78469)
 const eq = (a, b, loose) => compare(a, b, loose) === 0
 module.exports = eq
@@ -40372,9 +40322,6 @@ module.exports = eq
 /***/ 16599:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {

-"use strict";
-
-
 const compare = __nccwpck_require__(78469)
 const gt = (a, b, loose) => compare(a, b, loose) > 0
 module.exports = gt
@@ -40385,9 +40332,6 @@ module.exports = gt
 /***/ 41236:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {

-"use strict";
-
-
 const compare = __nccwpck_require__(78469)
 const gte = (a, b, loose) => compare(a, b, loose) >= 0
 module.exports = gte
@@ -40398,9 +40342,6 @@ module.exports = gte
 /***/ 62338:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {

-"use strict";
-
-
 const SemVer = __nccwpck_require__(7163)

 const inc = (version, release, options, identifier, identifierBase) => {
@@ -40427,9 +40368,6 @@ module.exports = inc
 /***/ 3872:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {

-"use strict";
-
-
 const compare = __nccwpck_require__(78469)
 const lt = (a, b, loose) => compare(a, b, loose) < 0
 module.exports = lt
@@ -40440,9 +40378,6 @@ module.exports = lt
 /***/ 56717:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {

-"use strict";
-
-
 const compare = __nccwpck_require__(78469)
 const lte = (a, b, loose) => compare(a, b, loose) <= 0
 module.exports = lte
@@ -40453,9 +40388,6 @@ module.exports = lte
 /***/ 68511:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {

-"use strict";
-
-
 const SemVer = __nccwpck_require__(7163)
 const major = (a, loose) => new SemVer(a, loose).major
 module.exports = major
@@ -40466,9 +40398,6 @@ module.exports = major
 /***/ 32603:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {

-"use strict";
-
-
 const SemVer = __nccwpck_require__(7163)
 const minor = (a, loose) => new SemVer(a, loose).minor
 module.exports = minor
@@ -40479,9 +40408,6 @@ module.exports = minor
 /***/ 4974:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {

-"use strict";
-
-
 const compare = __nccwpck_require__(78469)
 const neq = (a, b, loose) => compare(a, b, loose) !== 0
 module.exports = neq
@@ -40492,9 +40418,6 @@ module.exports = neq
 /***/ 16353:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {

-"use strict";
-
-
 const SemVer = __nccwpck_require__(7163)
 const parse = (version, options, throwErrors = false) => {
  if (version instanceof SemVer) {
@@ -40518,9 +40441,6 @@ module.exports = parse
 /***/ 48756:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {

-"use strict";
-
-
 const SemVer = __nccwpck_require__(7163)
 const patch = (a, loose) => new SemVer(a, loose).patch
 module.exports = patch
@@ -40531,9 +40451,6 @@ module.exports = patch
 /***/ 15714:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {

-"use strict";
-
-
 const parse = __nccwpck_require__(16353)
 const prerelease = (version, options) => {
  const parsed = parse(version, options)
@@ -40547,9 +40464,6 @@ module.exports = prerelease
 /***/ 32173:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {

-"use strict";
-
-
 const compare = __nccwpck_require__(78469)
 const rcompare = (a, b, loose) => compare(b, a, loose)
 module.exports = rcompare
@@ -40560,9 +40474,6 @@ module.exports = rcompare
 /***/ 87192:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {

-"use strict";
-
-
 const compareBuild = __nccwpck_require__(37648)
 const rsort = (list, loose) => list.sort((a, b) => compareBuild(b, a, loose))
 module.exports = rsort
@@ -40573,9 +40484,6 @@ module.exports = rsort
 /***/ 68011:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {

-"use strict";
-
-
 const Range = __nccwpck_require__(96782)
 const satisfies = (version, range, options) => {
  try {
@@ -40593,9 +40501,6 @@ module.exports = satisfies
 /***/ 29872:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {

-"use strict";
-
-
 const compareBuild = __nccwpck_require__(37648)
 const sort = (list, loose) => list.sort((a, b) => compareBuild(a, b, loose))
 module.exports = sort
@@ -40606,9 +40511,6 @@ module.exports = sort
 /***/ 58780:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {

-"use strict";
-
-
 const parse = __nccwpck_require__(16353)
 const valid = (version, options) => {
  const v = parse(version, options)
@@ -40622,9 +40524,6 @@ module.exports = valid
 /***/ 62088:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {

-"use strict";
-
-
 // just pre-load all the stuff that index.js lazily exports
 const internalRe = __nccwpck_require__(95471)
 const constants = __nccwpck_require__(45101)
@@ -40721,9 +40620,6 @@ module.exports = {
 /***/ 45101:
 /***/ ((module) => {

-"use strict";
-
-
 // Note: this is the semver.org version of the spec that it implements
 // Not necessarily the package version of this code.
 const SEMVER_SPEC_VERSION = '2.0.0'
@@ -40766,9 +40662,6 @@ module.exports = {
 /***/ 1159:
 /***/ ((module) => {

-"use strict";
-
-
 const debug = (
  typeof process === 'object' &&
  process.env &&
@@ -40785,9 +40678,6 @@ module.exports = debug
 /***/ 73348:
 /***/ ((module) => {

-"use strict";
-
-
 const numeric = /^[0-9]+$/
 const compareIdentifiers = (a, b) => {
  const anum = numeric.test(a)
@@ -40818,9 +40708,6 @@ module.exports = {
 /***/ 61383:
 /***/ ((module) => {

-"use strict";
-
-
 class LRUCache {
  constructor () {
    this.max = 1000
@@ -40868,9 +40755,6 @@ module.exports = LRUCache
 /***/ 70356:
 /***/ ((module) => {

-"use strict";
-
-
 // parse out just the options we care about
 const looseOption = Object.freeze({ loose: true })
 const emptyOpts = Object.freeze({ })
@@ -40893,9 +40777,6 @@ module.exports = parseOptions
 /***/ 95471:
 /***/ ((module, exports, __nccwpck_require__) => {

-"use strict";
-
-
 const {
  MAX_SAFE_COMPONENT_LENGTH,
  MAX_SAFE_BUILD_LENGTH,
@@ -40908,7 +40789,6 @@ exports = module.exports = {}
 const re = exports.re = []
 const safeRe = exports.safeRe = []
 const src = exports.src = []
-const safeSrc = exports.safeSrc = []
 const t = exports.t = {}
 let R = 0

@@ -40941,7 +40821,6 @@ const createToken = (name, value, isGlobal) => {
  debug(name, index, value)
  t[name] = index
  src[index] = value
-  safeSrc[index] = safe
  re[index] = new RegExp(value, isGlobal ? 'g' : undefined)
  safeRe[index] = new RegExp(safe, isGlobal ? 'g' : undefined)
 }
@@ -40974,14 +40853,12 @@ createToken('MAINVERSIONLOOSE', `(${src[t.NUMERICIDENTIFIERLOOSE]})\\.` +

 // ## Pre-release Version Identifier
 // A numeric identifier, or a non-numeric identifier.
-// Non-numberic identifiers include numberic identifiers but can be longer.
-// Therefore non-numberic identifiers must go first.

-createToken('PRERELEASEIDENTIFIER', `(?:${src[t.NONNUMERICIDENTIFIER]
-}|${src[t.NUMERICIDENTIFIER]})`)
+createToken('PRERELEASEIDENTIFIER', `(?:${src[t.NUMERICIDENTIFIER]
+}|${src[t.NONNUMERICIDENTIFIER]})`)

-createToken('PRERELEASEIDENTIFIERLOOSE', `(?:${src[t.NONNUMERICIDENTIFIER]
-}|${src[t.NUMERICIDENTIFIERLOOSE]})`)
+createToken('PRERELEASEIDENTIFIERLOOSE', `(?:${src[t.NUMERICIDENTIFIERLOOSE]
+}|${src[t.NONNUMERICIDENTIFIER]})`)

 // ## Pre-release Version
 // Hyphen, followed by one or more dot-separated pre-release version
@@ -41124,9 +41001,6 @@ createToken('GTE0PRE', '^\\s*>=\\s*0\\.0\\.0-0\\s*$')
 /***/ 12276:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {

-"use strict";
-
-
 // Determine if version is greater than all the versions possible in the range.
 const outside = __nccwpck_require__(10280)
 const gtr = (version, range, options) => outside(version, range, '>', options)
@@ -41138,9 +41012,6 @@ module.exports = gtr
 /***/ 23465:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {

-"use strict";
-
-
 const Range = __nccwpck_require__(96782)
 const intersects = (r1, r2, options) => {
  r1 = new Range(r1, options)
@@ -41155,9 +41026,6 @@ module.exports = intersects
 /***/ 15213:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {

-"use strict";
-
-
 const outside = __nccwpck_require__(10280)
 // Determine if version is less than all the versions possible in the range
 const ltr = (version, range, options) => outside(version, range, '<', options)
@@ -41169,9 +41037,6 @@ module.exports = ltr
 /***/ 73193:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {

-"use strict";
-
-
 const SemVer = __nccwpck_require__(7163)
 const Range = __nccwpck_require__(96782)

@@ -41204,9 +41069,6 @@ module.exports = maxSatisfying
 /***/ 68595:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {

-"use strict";
-
-
 const SemVer = __nccwpck_require__(7163)
 const Range = __nccwpck_require__(96782)
 const minSatisfying = (versions, range, options) => {
@@ -41238,9 +41100,6 @@ module.exports = minSatisfying
 /***/ 51866:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {

-"use strict";
-
-
 const SemVer = __nccwpck_require__(7163)
 const Range = __nccwpck_require__(96782)
 const gt = __nccwpck_require__(16599)
@@ -41309,9 +41168,6 @@ module.exports = minVersion
 /***/ 10280:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {

-"use strict";
-
-
 const SemVer = __nccwpck_require__(7163)
 const Comparator = __nccwpck_require__(89379)
 const { ANY } = Comparator
@@ -41399,9 +41255,6 @@ module.exports = outside
 /***/ 82028:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {

-"use strict";
-
-
 // given a set of versions and a range, create a "simplified" range
 // that includes the same versions that the original range does
 // If the original range is shorter than the simplified one, return that.
@@ -41456,9 +41309,6 @@ module.exports = (versions, range, options) => {
 /***/ 61489:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {

-"use strict";
-
-
 const Range = __nccwpck_require__(96782)
 const Comparator = __nccwpck_require__(89379)
 const { ANY } = Comparator
@@ -41713,9 +41563,6 @@ module.exports = subset
 /***/ 54750:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {

-"use strict";
-
-
 const Range = __nccwpck_require__(96782)

 // Mostly just for testing and legacy API reasons
@@ -41731,9 +41578,6 @@ module.exports = toComparators
 /***/ 64737:
 /***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {

-"use strict";
-
-
 const Range = __nccwpck_require__(96782)
 const validRange = (range, options) => {
  try {
@@ -50830,7 +50674,7 @@ module.exports = {


 const { parseSetCookie } = __nccwpck_require__(8915)
-const { stringify } = __nccwpck_require__(3834)
+const { stringify, getHeadersList } = __nccwpck_require__(3834)
 const { webidl } = __nccwpck_require__(74222)
 const { Headers } = __nccwpck_require__(26349)

@@ -50906,13 +50750,14 @@ function getSetCookies (headers) {

  webidl.brandCheck(headers, Headers, { strict: false })

-  const cookies = headers.getSetCookie()
+  const cookies = getHeadersList(headers).cookies

  if (!cookies) {
    return []
  }

-  return cookies.map((pair) => parseSetCookie(pair))
+  // In older versions of undici, cookies is a list of name:value.
+  return cookies.map((pair) => parseSetCookie(Array.isArray(pair) ? pair[1] : pair))
 }

 /**
@@ -51340,15 +51185,14 @@ module.exports = {
 /***/ }),

 /***/ 3834:
-/***/ ((module) => {
+/***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {

 "use strict";


-/**
- * @param {string} value
- * @returns {boolean}
- */
+const assert = __nccwpck_require__(42613)
+const { kHeadersList } = __nccwpck_require__(36443)
+
 function isCTLExcludingHtab (value) {
  if (value.length === 0) {
    return false
@@ -51609,13 +51453,31 @@ function stringify (cookie) {
  return out.join('; ')
 }

+let kHeadersListNode
+
+function getHeadersList (headers) {
+  if (headers[kHeadersList]) {
+    return headers[kHeadersList]
+  }
+
+  if (!kHeadersListNode) {
+    kHeadersListNode = Object.getOwnPropertySymbols(headers).find(
+      (symbol) => symbol.description === 'headers list'
+    )
+
+    assert(kHeadersListNode, 'Headers cannot be parsed')
+  }
+
+  const headersList = headers[kHeadersListNode]
+  assert(headersList)
+
+  return headersList
+}
+
 module.exports = {
  isCTLExcludingHtab,
-  validateCookieName,
-  validateCookiePath,
-  validateCookieValue,
-  toIMFDate,
-  stringify
+  stringify,
+  getHeadersList
 }


@@ -53544,14 +53406,6 @@ const { isUint8Array, isArrayBuffer } = __nccwpck_require__(98253)
 const { File: UndiciFile } = __nccwpck_require__(63041)
 const { parseMIMEType, serializeAMimeType } = __nccwpck_require__(94322)

-let random
-try {
-  const crypto = __nccwpck_require__(77598)
-  random = (max) => crypto.randomInt(0, max)
-} catch {
-  random = (max) => Math.floor(Math.random(max))
-}
-
 let ReadableStream = globalThis.ReadableStream

 /** @type {globalThis['File']} */
@@ -53637,7 +53491,7 @@ function extractBody (object, keepalive = false) {
    // Set source to a copy of the bytes held by object.
    source = new Uint8Array(object.buffer.slice(object.byteOffset, object.byteOffset + object.byteLength))
  } else if (util.isFormDataLike(object)) {
-    const boundary = `----formdata-undici-0${`${random(1e11)}`.padStart(11, '0')}`
+    const boundary = `----formdata-undici-0${`${Math.floor(Math.random() * 1e11)}`.padStart(11, '0')}`
    const prefix = `--${boundary}\r\nContent-Disposition: form-data`

    /*! formdata-polyfill. MIT License. Jimmy Wärting <https://jimmy.warting.se/opensource> */
@@ -55619,7 +55473,6 @@ const {
  isValidHeaderName,
  isValidHeaderValue
 } = __nccwpck_require__(15523)
-const util = __nccwpck_require__(39023)
 const { webidl } = __nccwpck_require__(74222)
 const assert = __nccwpck_require__(42613)

@@ -56173,9 +56026,6 @@ Object.defineProperties(Headers.prototype, {
  [Symbol.toStringTag]: {
    value: 'Headers',
    configurable: true
-  },
-  [util.inspect.custom]: {
-    enumerable: false
  }
 })

@@ -65352,20 +65202,6 @@ class Pool extends PoolBase {
      ? { ...options.interceptors }
      : undefined
    this[kFactory] = factory
-
-    this.on('connectionError', (origin, targets, error) => {
-      // If a connection error occurs, we remove the client from the pool,
-      // and emit a connectionError event. They will not be re-used.
-      // Fixes https://github.com/nodejs/undici/issues/3895
-      for (const target of targets) {
-        // Do not use kRemoveClient here, as it will close the client,
-        // but the client cannot be closed in this state.
-        const idx = this[kClients].indexOf(target)
-        if (idx !== -1) {
-          this[kClients].splice(idx, 1)
-        }
-      }
-    })
  }

  [kGetDispatcher] () {
@@ -67790,23 +67626,13 @@ var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (
 }) : function(o, v) {
    o["default"] = v;
 });
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.run = run;
 const attest_1 = __nccwpck_require__(11485);
@@ -1,7 +1,7 @@
 {
  "name": "actions/attest-build-provenance",
  "description": "Generate signed build provenance attestations",
-  "version": "1.1.5",
+  "version": "1.1.4",
  "author": "",
  "private": true,
  "homepage": "https://github.com/actions/attest-build-provenance",
@@ -28,7 +28,7 @@
    "ci-test": "jest",
    "format:write": "prettier --write **/*.ts",
    "format:check": "prettier --check **/*.ts",
-    "lint:eslint": "npx eslint . -c ./.github/linters/eslint.config.mjs",
+    "lint:eslint": "npx eslint . -c ./.github/linters/.eslintrc.yml",
    "lint:markdown": "npx markdownlint --config .github/linters/.markdown-lint.yml \"*.md\"",
    "lint": "npm run lint:eslint && npm run lint:markdown",
    "package": "ncc build src/index.ts --license licenses.txt",
@@ -70,24 +70,27 @@
    ]
  },
  "dependencies": {
-    "@actions/attest": "^1.6.0",
+    "@actions/attest": "^1.5.0",
    "@actions/core": "^1.11.1"
  },
  "devDependencies": {
-    "@eslint/js": "^9.28.0",
    "@types/jest": "^29.5.14",
-    "@types/node": "^22.15.29",
-    "@vercel/ncc": "^0.38.3",
-    "eslint": "^9.28.0",
-    "eslint-plugin-import": "^2.31.0",
-    "eslint-plugin-jest": "^28.12.0",
+    "@types/node": "^22.8.7",
+    "@typescript-eslint/eslint-plugin": "^7.17.0",
+    "@typescript-eslint/parser": "^7.18.0",
+    "@vercel/ncc": "^0.38.2",
+    "eslint": "^8.57.1",
+    "eslint-plugin-github": "^5.0.2",
+    "eslint-plugin-jest": "^28.8.3",
+    "eslint-plugin-jsonc": "^2.16.0",
+    "eslint-plugin-prettier": "^5.2.1",
    "jest": "^29.7.0",
    "jose": "^5.9.6",
-    "markdownlint-cli": "^0.45.0",
-    "nock": "^14.0.5",
-    "prettier": "^3.5.3",
-    "ts-jest": "^29.3.4",
-    "typescript": "^5.8.3",
-    "typescript-eslint": "^8.33.0"
+    "markdownlint-cli": "^0.42.0",
+    "nock": "^13.5.5",
+    "prettier": "^3.3.3",
+    "prettier-eslint": "^16.3.0",
+    "ts-jest": "^29.2.5",
+    "typescript": "^5.6.3"
  }
 }