re-integrate toolkit code to main action

src/api-client.ts

@@ -0,0 +1,53 @@
+export async function getRepositoryMetadata(
+  githubAPIURL: string,
+  repository: string,
+  token: string
+): Promise<{ repoId: string; ownerId: string }> {
+  const response = await fetch(`${githubAPIURL}/repos/${repository}`, {
+    method: 'GET',
+    headers: {
+      Authorization: `Bearer ${token}`,
+      Accept: 'application/vnd.github.v3+json'
+    }
+  })
+
+  if (!response.ok) {
+    throw new Error(
+      `Failed to fetch repository metadata due to bad status code: ${response.status}`
+    )
+  }
+
+  const data = await response.json()
+
+  // Check that the response contains the expected data
+  if (!data.id || !data.owner.id) {
+    throw new Error(
+      `Failed to fetch repository metadata: unexpected response format`
+    )
+  }
+
+  return { repoId: String(data.id), ownerId: String(data.owner.id) }
+}
+
+export async function getContainerRegistryURL(
+  githubAPIURL: string
+): Promise<URL> {
+  const response = await fetch(
+    `${githubAPIURL}/packages/container-registry-url`
+  )
+  if (!response.ok) {
+    throw new Error(
+      `Failed to fetch container registry url due to bad status code: ${response.status}`
+    )
+  }
+  const data = await response.json()
+
+  if (!data.url) {
+    throw new Error(
+      `Failed to fetch repository metadata: unexpected response format`
+    )
+  }
+
+  const registryURL: URL = new URL(data.url)
+  return registryURL
+}

src/config.ts

@@ -1,4 +1,4 @@
-import * as iaToolkit from '@immutable-actions/toolkit'
+import * as apiClient from './api-client'
 import * as core from '@actions/core'
 import * as github from '@actions/github'
 
@@ -91,7 +91,7 @@ export async function resolvePublishActionOptions(): Promise<PublishActionOption
 
   // Required Values fetched from the GitHub API
   const containerRegistryUrl: URL =
-    await iaToolkit.getContainerRegistryURL(apiBaseUrl)
+    await apiClient.getContainerRegistryURL(apiBaseUrl)
 
   const isEnterprise =
     !githubServerUrl.includes('https://github.com') &&

src/fs-helper.ts

@@ -0,0 +1,138 @@
+import * as fs from 'fs'
+import fsExtra from 'fs-extra'
+import * as path from 'path'
+import * as tar from 'tar'
+import * as archiver from 'archiver'
+import * as crypto from 'crypto'
+
+export interface FileMetadata {
+  path: string
+  size: number
+  sha256: string
+}
+
+// Simple convenience around creating subdirectories in the same base temporary directory
+export function createTempDir(tmpDirPath: string, subDirName: string): string {
+  const tempDir = path.join(tmpDirPath, subDirName)
+
+  if (!fs.existsSync(tempDir)) {
+    fs.mkdirSync(tempDir, { recursive: true })
+  }
+
+  return tempDir
+}
+
+// Creates both a tar.gz and zip archive of the given directory and returns the paths to both archives (stored in the provided target directory)
+// as well as the size/sha256 hash of each file.
+export async function createArchives(
+  distPath: string,
+  archiveTargetPath: string
+): Promise<{ zipFile: FileMetadata; tarFile: FileMetadata }> {
+  const zipPath = path.join(archiveTargetPath, `archive.zip`)
+  const tarPath = path.join(archiveTargetPath, `archive.tar.gz`)
+
+  const createZipPromise = new Promise<FileMetadata>((resolve, reject) => {
+    const output = fs.createWriteStream(zipPath)
+    const archive = archiver.create('zip')
+
+    output.on('error', (err: Error) => {
+      reject(err)
+    })
+
+    archive.on('error', (err: Error) => {
+      reject(err)
+    })
+
+    output.on('close', () => {
+      resolve(fileMetadata(zipPath))
+    })
+
+    archive.pipe(output)
+    archive.directory(distPath, false)
+    archive.finalize()
+  })
+
+  const createTarPromise = new Promise<FileMetadata>((resolve, reject) => {
+    tar
+      .c(
+        {
+          file: tarPath,
+          C: distPath,
+          gzip: true
+        },
+        ['.']
+      )
+      // eslint-disable-next-line github/no-then
+      .catch(err => {
+        reject(err)
+      })
+      // eslint-disable-next-line github/no-then
+      .then(() => {
+        resolve(fileMetadata(tarPath))
+      })
+  })
+
+  const [zipFile, tarFile] = await Promise.all([
+    createZipPromise,
+    createTarPromise
+  ])
+
+  return { zipFile, tarFile }
+}
+
+export function isDirectory(dirPath: string): boolean {
+  return fs.existsSync(dirPath) && fs.lstatSync(dirPath).isDirectory()
+}
+
+export function readFileContents(filePath: string): Buffer {
+  return fs.readFileSync(filePath)
+}
+
+// Copy actions files from sourceDir to targetDir, excluding files and folders not relevant to the action
+// Errors if the repo appears to not contain any action files, such as an action.yml file
+export function stageActionFiles(actionDir: string, targetDir: string): void {
+  let actionYmlFound = false
+
+  fsExtra.copySync(actionDir, targetDir, {
+    filter: (src: string) => {
+      const basename = path.basename(src)
+
+      if (basename === 'action.yml' || basename === 'action.yaml') {
+        actionYmlFound = true
+      }
+
+      // Filter out hidden folers like .git and .github
+      return basename === '.' || !basename.startsWith('.')
+    }
+  })
+
+  if (!actionYmlFound) {
+    throw new Error(
+      `No action.yml or action.yaml file found in source repository`
+    )
+  }
+}
+
+// Converts a file path to a filemetadata object by querying the fs for relevant metadata.
+async function fileMetadata(filePath: string): Promise<FileMetadata> {
+  const stats = fs.statSync(filePath)
+  const size = stats.size
+  const hash = crypto.createHash('sha256')
+  const fileStream = fs.createReadStream(filePath)
+  return new Promise((resolve, reject) => {
+    fileStream.on('data', data => {
+      hash.update(data)
+    })
+    fileStream.on('end', () => {
+      const sha256 = hash.digest('hex')
+      resolve({
+        path: filePath,
+        size,
+        sha256: `sha256:${sha256}`
+      })
+    })
+    fileStream.on('error', err => {
+      reject(err)
+    })
+  })
+}

src/ghcr-client.ts

@@ -0,0 +1,216 @@
+import * as core from '@actions/core'
+import { FileMetadata } from './fs-helper'
+import * as ociContainer from './oci-container'
+import * as fsHelper from './fs-helper'
+
+// Publish the OCI artifact and return the URL where it can be downloaded
+export async function publishOCIArtifact(
+  token: string,
+  registry: URL,
+  repository: string,
+  semver: string,
+  zipFile: FileMetadata,
+  tarFile: FileMetadata,
+  manifest: ociContainer.Manifest
+): Promise<{ packageURL: URL; manifestDigest: string }> {
+  const b64Token = Buffer.from(token).toString('base64')
+
+  const checkBlobEndpoint = new URL(
+    `v2/${repository}/blobs/`,
+    registry
+  ).toString()
+  const uploadBlobEndpoint = new URL(
+    `v2/${repository}/blobs/uploads/`,
+    registry
+  ).toString()
+  const manifestEndpoint = new URL(
+    `v2/${repository}/manifests/${semver}`,
+    registry
+  ).toString()
+
+  core.info(
+    `Creating GHCR package for release with semver:${semver} with path:"${zipFile.path}" and "${tarFile.path}".`
+  )
+
+  const layerUploads: Promise<void>[] = manifest.layers.map(async layer => {
+    switch (layer.mediaType) {
+      case 'application/vnd.github.actions.package.layer.v1.tar+gzip':
+        return uploadLayer(
+          layer,
+          tarFile,
+          registry,
+          checkBlobEndpoint,
+          uploadBlobEndpoint,
+          b64Token
+        )
+      case 'application/vnd.github.actions.package.layer.v1.zip':
+        return uploadLayer(
+          layer,
+          zipFile,
+          registry,
+          checkBlobEndpoint,
+          uploadBlobEndpoint,
+          b64Token
+        )
+      case 'application/vnd.oci.empty.v1+json':
+        return uploadLayer(
+          layer,
+          { path: '', size: 2, sha256: layer.digest },
+          registry,
+          checkBlobEndpoint,
+          uploadBlobEndpoint,
+          b64Token
+        )
+      default:
+        throw new Error(`Unknown media type ${layer.mediaType}`)
+    }
+  })
+
+  await Promise.all(layerUploads)
+
+  const digest = await uploadManifest(
+    JSON.stringify(manifest),
+    manifestEndpoint,
+    b64Token
+  )
+
+  return {
+    packageURL: new URL(`${repository}:${semver}`, registry),
+    manifestDigest: digest
+  }
+}
+
+async function uploadLayer(
+  layer: ociContainer.Layer,
+  file: FileMetadata,
+  registryURL: URL,
+  checkBlobEndpoint: string,
+  uploadBlobEndpoint: string,
+  b64Token: string
+): Promise<void> {
+  const checkExistsResponse = await fetchWithDebug(
+    checkBlobEndpoint + layer.digest,
+    {
+      method: 'HEAD',
+      headers: {
+        Authorization: `Bearer ${b64Token}`
+      }
+    }
+  )
+
+  if (
+    checkExistsResponse.status === 200 ||
+    checkExistsResponse.status === 202
+  ) {
+    core.info(`Layer ${layer.digest} already exists. Skipping upload.`)
+    return
+  }
+
+  if (checkExistsResponse.status !== 404) {
+    throw new Error(
+      `Unexpected response from blob check for layer ${layer.digest}: ${checkExistsResponse.status} ${checkExistsResponse.statusText}`
+    )
+  }
+
+  core.info(`Uploading layer ${layer.digest}.`)
+
+  const initiateUploadResponse = await fetchWithDebug(uploadBlobEndpoint, {
+    method: 'POST',
+    headers: {
+      Authorization: `Bearer ${b64Token}`
+    },
+    body: JSON.stringify(layer)
+  })
+
+  if (initiateUploadResponse.status !== 202) {
+    core.error(
+      `Unexpected response from upload post ${uploadBlobEndpoint}: ${initiateUploadResponse.status}`
+    )
+    throw new Error(
+      `Unexpected response from POST upload ${initiateUploadResponse.status}`
+    )
+  }
+
+  const locationResponseHeader = initiateUploadResponse.headers.get('location')
+  if (locationResponseHeader === undefined) {
+    throw new Error(
+      `No location header in response from upload post ${uploadBlobEndpoint} for layer ${layer.digest}`
+    )
+  }
+
+  const pathname = `${locationResponseHeader}?digest=${layer.digest}`
+  const uploadBlobUrl = new URL(pathname, registryURL).toString()
+
+  // TODO: must we handle the empty config layer? Maybe we can just skip calling this at all
+  let data: Buffer
+  if (layer.mediaType === 'application/vnd.oci.empty.v1+json') {
+    data = Buffer.from('{}')
+  } else {
+    data = fsHelper.readFileContents(file.path)
+  }
+
+  const putResponse = await fetchWithDebug(uploadBlobUrl, {
+    method: 'PUT',
+    headers: {
+      Authorization: `Bearer ${b64Token}`,
+      'Content-Type': 'application/octet-stream',
+      'Accept-Encoding': 'gzip',
+      'Content-Length': layer.size.toString()
+    },
+    body: data
+  })
+
+  if (putResponse.status !== 201) {
+    throw new Error(
+      `Unexpected response from PUT upload ${putResponse.status} for layer ${layer.digest}`
+    )
+  }
+}
+
+// Uploads the manifest and returns the digest returned by GHCR
+async function uploadManifest(
+  manifestJSON: string,
+  manifestEndpoint: string,
+  b64Token: string
+): Promise<string> {
+  core.info(`Uploading manifest to ${manifestEndpoint}.`)
+
+  const putResponse = await fetchWithDebug(manifestEndpoint, {
+    method: 'PUT',
+    headers: {
+      Authorization: `Bearer ${b64Token}`,
+      'Content-Type': 'application/vnd.oci.image.manifest.v1+json'
+    },
+    body: manifestJSON
+  })
+
+  if (putResponse.status !== 201) {
+    throw new Error(
+      `Unexpected response from PUT manifest ${putResponse.status}`
+    )
+  }
+
+  const digestResponseHeader = putResponse.headers.get('docker-content-digest')
+  if (digestResponseHeader === undefined || digestResponseHeader === null) {
+    throw new Error(
+      `No digest header in response from PUT manifest ${manifestEndpoint}`
+    )
+  }
+
+  return digestResponseHeader
+}
+
+const fetchWithDebug = async (
+  url: string,
+  config: RequestInit = {}
+): Promise<Response> => {
+  core.debug(`Request from ${url} with config: ${JSON.stringify(config)}`)
+  try {
+    const response = await fetch(url, config)
+    core.debug(`Response with ${JSON.stringify(response)}`)
+    return response
+  } catch (error) {
+    core.debug(`Error with ${error}`)
+    throw error
+  }
+}

src/main.ts

@@ -1,6 +1,8 @@
 import * as core from '@actions/core'
 import semver from 'semver'
-import * as iaToolkit from '@immutable-actions/toolkit'
+import * as fsHelper from './fs-helper'
+import * as ociContainer from './oci-container'
+import * as ghcr from './ghcr-client'
 import * as attest from '@actions/attest'
 import * as cfg from './config'
 
@@ -18,22 +20,19 @@ export async function run(): Promise<void> {
 
     const semverTag: semver.SemVer = parseSemverTagFromRef(options.ref)
 
-    const stagedActionFilesDir = iaToolkit.createTempDir(
+    const stagedActionFilesDir = fsHelper.createTempDir(
       options.runnerTempDir,
       'staging'
     )
-    iaToolkit.stageActionFiles(options.workspaceDir, stagedActionFilesDir)
+    fsHelper.stageActionFiles(options.workspaceDir, stagedActionFilesDir)
 
-    const archiveDir = iaToolkit.createTempDir(
-      options.runnerTempDir,
-      'archives'
-    )
-    const archives = await iaToolkit.createArchives(
+    const archiveDir = fsHelper.createTempDir(options.runnerTempDir, 'archives')
+    const archives = await fsHelper.createArchives(
       stagedActionFilesDir,
       archiveDir
     )
 
-    const manifest = iaToolkit.createActionPackageManifest(
+    const manifest = ociContainer.createActionPackageManifest(
       archives.tarFile,
       archives.zipFile,
       options.nameWithOwner,
@@ -44,7 +43,7 @@ export async function run(): Promise<void> {
       new Date()
     )
 
-    const { packageURL, manifestDigest } = await iaToolkit.publishOCIArtifact(
+    const { packageURL, manifestDigest } = await ghcr.publishOCIArtifact(
       options.token,
       options.containerRegistryUrl,
       options.nameWithOwner,

src/oci-container.ts

@@ -0,0 +1,105 @@
+import { FileMetadata } from './fs-helper'
+
+export interface Manifest {
+  schemaVersion: number
+  mediaType: string
+  artifactType: string
+  config: Layer
+  layers: Layer[]
+  annotations: { [key: string]: string }
+}
+
+export interface Layer {
+  mediaType: string
+  size: number
+  digest: string
+  annotations?: { [key: string]: string }
+}
+
+// Given a name and archive metadata, creates a manifest in the format expected by GHCR for an Actions Package.
+export function createActionPackageManifest(
+  tarFile: FileMetadata,
+  zipFile: FileMetadata,
+  repository: string,
+  repoId: string,
+  ownerId: string,
+  sourceCommit: string,
+  version: string,
+  created: Date
+): Manifest {
+  const configLayer = createConfigLayer()
+  const sanitizedRepo = sanitizeRepository(repository)
+  const tarLayer = createTarLayer(tarFile, sanitizedRepo, version)
+  const zipLayer = createZipLayer(zipFile, sanitizedRepo, version)
+
+  const manifest: Manifest = {
+    schemaVersion: 2,
+    mediaType: 'application/vnd.oci.image.manifest.v1+json',
+    artifactType: 'application/vnd.github.actions.package.v1+json',
+    config: configLayer,
+    layers: [configLayer, tarLayer, zipLayer],
+    annotations: {
+      'org.opencontainers.image.created': created.toISOString(),
+      'action.tar.gz.digest': tarFile.sha256,
+      'action.zip.digest': zipFile.sha256,
+      'com.github.package.type': 'actions_oci_pkg',
+      'com.github.package.version': version,
+      'com.github.source.repo.id': repoId,
+      'com.github.source.repo.owner.id': ownerId,
+      'com.github.source.commit': sourceCommit
+    }
+  }
+
+  return manifest
+}
+
+function createConfigLayer(): Layer {
+  const configLayer: Layer = {
+    mediaType: 'application/vnd.oci.empty.v1+json',
+    size: 2,
+    digest:
+      'sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a'
+  }
+
+  return configLayer
+}
+
+function createZipLayer(
+  zipFile: FileMetadata,
+  repository: string,
+  version: string
+): Layer {
+  const zipLayer: Layer = {
+    mediaType: 'application/vnd.github.actions.package.layer.v1.zip',
+    size: zipFile.size,
+    digest: zipFile.sha256,
+    annotations: {
+      'org.opencontainers.image.title': `${repository}_${version}.zip`
+    }
+  }
+
+  return zipLayer
+}
+
+function createTarLayer(
+  tarFile: FileMetadata,
+  repository: string,
+  version: string
+): Layer {
+  const tarLayer: Layer = {
+    mediaType: 'application/vnd.github.actions.package.layer.v1.tar+gzip',
+    size: tarFile.size,
+    digest: tarFile.sha256,
+    annotations: {
+      'org.opencontainers.image.title': `${repository}_${version}.tar.gz`
+    }
+  }
+
+  return tarLayer
+}
+
+// Remove slashes so we can use the repository in a filename
+// repository usually includes the namespace too, e.g. my-org/my-repo
+function sanitizeRepository(repository: string): string {
+  return repository.replace('/', '-')
+}