ESM Conversion (#347)

* initial esm conversion Signed-off-by: Brian DeHamer <[email protected]> * esm'ify jest tests Signed-off-by: Brian DeHamer <[email protected]> * lint issues Signed-off-by: Brian DeHamer <[email protected]> * debug mock Signed-off-by: Brian DeHamer <[email protected]> * glob updated Signed-off-by: Brian DeHamer <[email protected]> * async all file functions Signed-off-by: Brian DeHamer <[email protected]> * update @actions/github Signed-off-by: Brian DeHamer <[email protected]> * update @actions/attest Signed-off-by: Brian DeHamer <[email protected]> * rebuild package-lock.json Signed-off-by: Brian DeHamer <[email protected]> * use experimental flag for jest in ci Signed-off-by: Brian DeHamer <[email protected]> * remove stray istanbul ignore Signed-off-by: Brian DeHamer <[email protected]> * Optimize getSubjectFromPath to avoid concurrent stat calls Co-authored-by: bdehamer <[email protected]> * Fix boundary condition for MAX_SUBJECT_COUNT check Co-authored-by: bdehamer <[email protected]> * Improve error message clarity for subject count limit Co-authored-by: bdehamer <[email protected]> * Update test to match new error message format Co-authored-by: bdehamer <[email protected]> * rebuild dist Signed-off-by: Brian DeHamer <[email protected]> * Fix parseSBOMFromPath to check file size before reading Co-authored-by: bdehamer <[email protected]> * Build package with updated changes Co-authored-by: bdehamer <[email protected]> --------- Signed-off-by: Brian DeHamer <[email protected]> Co-authored-by: copilot-swe-agent[bot] <[email protected]> Co-authored-by: bdehamer <[email protected]>
2026-02-18 08:52:30 -08:00
parent dc4ad3cc6c
commit 7d7ff4475a
17 changed files with 39433 additions and 48804 deletions
@@ -5,10 +5,10 @@ import {
  attest,
  createStorageRecord
 } from '@actions/attest'
-import { attachArtifactToImage, getRegistryCredentials } from '@sigstore/oci'
-import { formatSubjectDigest } from './subject'
 import * as core from '@actions/core'
 import * as github from '@actions/github'
+import { attachArtifactToImage, getRegistryCredentials } from '@sigstore/oci'
+import { formatSubjectDigest } from './subject'

 const OCI_TIMEOUT = 30000
 const OCI_RETRY = 3
@@ -1,6 +1,6 @@
 import * as core from '@actions/core'
 import * as github from '@actions/github'
-import fs from 'fs'
+import fs from 'fs/promises'
 import os from 'os'
 import path from 'path'
 import { AttestResult, SigstoreInstance, createAttestation } from './attest'
@@ -13,7 +13,7 @@ import {
 import { SEARCH_PUBLIC_GOOD_URL } from './endpoints'
 import { PredicateInputs, predicateFromInputs } from './predicate'
 import { generateProvenancePredicate } from './provenance'
-import { parseSBOMFromPath, generateSBOMPredicate } from './sbom'
+import { generateSBOMPredicate, parseSBOMFromPath } from './sbom'
 import * as style from './style'
 import {
  SubjectInputs,
@@ -90,7 +90,7 @@ export async function run(inputs: RunInputs): Promise<void> {
    // Generate predicate based on attestation type
    const predicate = await getPredicateForType(attestationType, inputs)

-    const outputPath = path.join(tempDir(), ATTESTATION_FILE_NAME)
+    const outputPath = path.join(await tempDir(), ATTESTATION_FILE_NAME)
    core.setOutput('bundle-path', outputPath)

    const att = await createAttestation(subjects, predicate, {
@@ -103,7 +103,7 @@ export async function run(inputs: RunInputs): Promise<void> {
    logAttestation(subjects, att, sigstoreInstance)

    // Write attestation bundle to output file
-    fs.writeFileSync(outputPath, JSON.stringify(att.bundle) + os.EOL, {
+    await fs.writeFile(outputPath, JSON.stringify(att.bundle) + os.EOL, {
      encoding: 'utf-8',
      flag: 'a'
    })
@@ -113,7 +113,7 @@ export async function run(inputs: RunInputs): Promise<void> {
    if (baseDir) {
      const outputSummaryPath = path.join(baseDir, ATTESTATION_PATHS_FILE_NAME)
      // Append the output path to the attestations paths file
-      fs.appendFileSync(outputSummaryPath, outputPath + os.EOL, {
+      await fs.appendFile(outputSummaryPath, outputPath + os.EOL, {
        encoding: 'utf-8',
        flag: 'a'
      })
@@ -128,6 +128,7 @@ export async function run(inputs: RunInputs): Promise<void> {
      core.setOutput('attestation-id', att.attestationID)
      core.setOutput('attestation-url', attestationURL(att.attestationID))
    }
+
    if (att.storageRecordIds) {
      core.setOutput('storage-record-ids', att.storageRecordIds.join(','))
    }
@@ -220,7 +221,7 @@ const logSummary = async (attestation: AttestResult): Promise<void> => {
  }
 }

-const tempDir = (): string => {
+const tempDir = async (): Promise<string> => {
  const basePath = process.env['RUNNER_TEMP']

  /* istanbul ignore if */
@@ -228,7 +229,7 @@ const tempDir = (): string => {
    throw new Error('Missing RUNNER_TEMP environment variable')
  }

-  return fs.mkdtempSync(path.join(basePath, path.sep))
+  return fs.mkdtemp(path.join(basePath, path.sep))
 }

 const attestationURL = (id: string): string =>
@@ -1,4 +1,4 @@
-import fs from 'fs'
+import fs from 'fs/promises'

 import type { Predicate } from '@actions/attest'

@@ -12,7 +12,9 @@ const MAX_PREDICATE_SIZE_BYTES = 16 * 1024 * 1024

 // Returns the predicate specified by the action's inputs. The predicate value
 // may be specified as a path to a file or as a string.
-export const predicateFromInputs = (inputs: PredicateInputs): Predicate => {
+export const predicateFromInputs = async (
+  inputs: PredicateInputs
+): Promise<Predicate> => {
  const { predicateType, predicate, predicatePath } = inputs

  if (!predicateType) {
@@ -30,18 +32,22 @@ export const predicateFromInputs = (inputs: PredicateInputs): Predicate => {
  let params: string = predicate

  if (predicatePath) {
-    if (!fs.existsSync(predicatePath)) {
+    try {
+      await fs.access(predicatePath)
+    } catch {
      throw new Error(`predicate file not found: ${predicatePath}`)
    }

+    const stat = await fs.stat(predicatePath)
+
    /* istanbul ignore next */
-    if (fs.statSync(predicatePath).size > MAX_PREDICATE_SIZE_BYTES) {
+    if (stat.size > MAX_PREDICATE_SIZE_BYTES) {
      throw new Error(
        `predicate file exceeds maximum allowed size: ${MAX_PREDICATE_SIZE_BYTES} bytes`
      )
    }

-    params = fs.readFileSync(predicatePath, 'utf-8')
+    params = await fs.readFile(predicatePath, 'utf-8')
  } else {
    if (predicate.length > MAX_PREDICATE_SIZE_BYTES) {
      throw new Error(
@@ -1,4 +1,4 @@
-import fs from 'fs'
+import fs from 'fs/promises'

 import type { Predicate } from '@actions/attest'

@@ -11,18 +11,24 @@ export type SBOM = {
 const MAX_SBOM_SIZE_BYTES = 16 * 1024 * 1024

 export const parseSBOMFromPath = async (filePath: string): Promise<SBOM> => {
-  if (!fs.existsSync(filePath)) {
-    throw new Error(`SBOM file not found: ${filePath}`)
+  let stats
+  try {
+    stats = await fs.stat(filePath)
+  } catch (error) {
+    const err = error as NodeJS.ErrnoException
+    if (err.code === 'ENOENT') {
+      throw new Error('SBOM file not found')
+    }
+    throw error
  }

-  const stats = fs.statSync(filePath)
  if (stats.size > MAX_SBOM_SIZE_BYTES) {
    throw new Error(
      `SBOM file exceeds maximum allowed size: ${MAX_SBOM_SIZE_BYTES} bytes`
    )
  }

-  const fileContent = await fs.promises.readFile(filePath, 'utf8')
+  const fileContent = await fs.readFile(filePath, 'utf8')
  const sbom = JSON.parse(fileContent) as object

  if (checkIsSPDX(sbom)) {
@@ -2,7 +2,8 @@ import * as glob from '@actions/glob'
 import assert from 'assert'
 import crypto from 'crypto'
 import { parse } from 'csv-parse/sync'
-import fs from 'fs'
+import { createReadStream } from 'fs'
+import fs from 'fs/promises'
 import os from 'os'
 import path from 'path'

@@ -64,7 +65,7 @@ export const subjectFromInputs = async (
    case !!subjectDigest:
      return [getSubjectFromDigest(subjectDigest, name)]
    case !!subjectChecksums:
-      return getSubjectFromChecksums(subjectChecksums)
+      return await getSubjectFromChecksums(subjectChecksums)
    /* istanbul ignore next */
    default:
      // This should be unreachable, but TS requires a default case
@@ -93,13 +94,18 @@ const getSubjectFromPath = async (
  // Expand the globbed paths to a list of actual paths
  const paths = await glob.create(subjectPaths).then(async g => g.glob())

-  // Filter path list to just the files (not directories)
-  const files = paths.filter(p => fs.statSync(p).isFile())
-
-  if (files.length > MAX_SUBJECT_COUNT) {
-    throw new Error(
-      `Too many subjects specified (${files.length}). The maximum number of subjects is ${MAX_SUBJECT_COUNT}.`
-    )
+  // Filter path list to just the files (not directories), enforcing the maximum
+  const files: string[] = []
+  for (const p of paths) {
+    const stat = await fs.stat(p)
+    if (stat.isFile()) {
+      if (files.length >= MAX_SUBJECT_COUNT) {
+        throw new Error(
+          `Too many subjects specified (>${MAX_SUBJECT_COUNT}). The maximum number of subjects is ${MAX_SUBJECT_COUNT}.`
+        )
+      }
+      files.push(p)
+    }
  }

  for (const file of files) {
@@ -142,16 +148,21 @@ const getSubjectFromDigest = (
  }
 }

-const getSubjectFromChecksums = (subjectChecksums: string): Subject[] => {
-  if (fs.existsSync(subjectChecksums)) {
+const getSubjectFromChecksums = async (
+  subjectChecksums: string
+): Promise<Subject[]> => {
+  try {
+    await fs.access(subjectChecksums)
    return getSubjectFromChecksumsFile(subjectChecksums)
-  } else {
+  } catch {
    return getSubjectFromChecksumsString(subjectChecksums)
  }
 }

-const getSubjectFromChecksumsFile = (checksumsPath: string): Subject[] => {
-  const stats = fs.statSync(checksumsPath)
+const getSubjectFromChecksumsFile = async (
+  checksumsPath: string
+): Promise<Subject[]> => {
+  const stats = await fs.stat(checksumsPath)
  if (!stats.isFile()) {
    throw new Error(`subject checksums file not found: ${checksumsPath}`)
  }
@@ -163,7 +174,7 @@ const getSubjectFromChecksumsFile = (checksumsPath: string): Subject[] => {
    )
  }

-  const checksums = fs.readFileSync(checksumsPath, 'utf-8')
+  const checksums = await fs.readFile(checksumsPath, 'utf-8')
  return getSubjectFromChecksumsString(checksums)
 }

@@ -218,7 +229,7 @@ const digestFile = async (
 ): Promise<string> => {
  return new Promise((resolve, reject) => {
    const hash = crypto.createHash(algorithm).setEncoding('hex')
-    fs.createReadStream(filePath)
+    createReadStream(filePath)
      .once('error', reject)
      .pipe(hash)
      .once('finish', () => resolve(hash.read()))