diff --git a/__tests__/fs-helper.test.ts b/__tests__/fs-helper.test.ts index ec56c50..fa88c90 100644 --- a/__tests__/fs-helper.test.ts +++ b/__tests__/fs-helper.test.ts @@ -249,19 +249,25 @@ describe('ensureCorrectShaCheckedOut', () => { it('does not throw an error if the correct SHA is checked out', async () => { await expect( - fsHelper.ensureCorrectShaCheckedOut(`refs/tags/${tag2}`, commit2, dir) + fsHelper.ensureTagAndRefCheckedOut(`refs/tags/${tag2}`, commit2, dir) ).resolves.toBeUndefined() }) it('throws an error if the correct SHA is not checked out', async () => { await expect( - fsHelper.ensureCorrectShaCheckedOut(`refs/tags/${tag1}`, commit1, dir) + fsHelper.ensureTagAndRefCheckedOut(`refs/tags/${tag1}`, commit1, dir) ).rejects.toThrow() }) it('throws an error if the sha of the tag does not match expected sha', async () => { await expect(async () => - fsHelper.ensureCorrectShaCheckedOut(`refs/tags/${tag1}`, commit2, dir) + fsHelper.ensureTagAndRefCheckedOut(`refs/tags/${tag1}`, commit2, dir) + ).rejects.toThrow() + }) + + it('throws if the provided ref is not a tag ref', async () => { + await expect(async () => + fsHelper.ensureTagAndRefCheckedOut(`refs/heads/main`, commit2, dir) ).rejects.toThrow() }) }) diff --git a/__tests__/main.test.ts b/__tests__/main.test.ts index 6c700df..bb69193 100644 --- a/__tests__/main.test.ts +++ b/__tests__/main.test.ts @@ -51,7 +51,7 @@ describe('run', () => { .spyOn(fsHelper, 'stageActionFiles') .mockImplementation() ensureCorrectShaCheckedOutMock = jest - .spyOn(fsHelper, 'ensureCorrectShaCheckedOut') + .spyOn(fsHelper, 'ensureTagAndRefCheckedOut') .mockImplementation() // GHCR Client mocks diff --git a/badges/coverage.svg b/badges/coverage.svg index edc5ecc..1b46f21 100644 --- a/badges/coverage.svg +++ b/badges/coverage.svg @@ -1 +1 @@ -Coverage: 96.78%Coverage96.78% \ No newline at end of file +Coverage: 96.81%Coverage96.81% \ No newline at end of file diff --git a/dist/index.js b/dist/index.js index 6cbf3a0..59fe060 100644 --- a/dist/index.js +++ b/dist/index.js @@ -104543,7 +104543,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) { return (mod && mod.__esModule) ? mod : { "default": mod }; }; Object.defineProperty(exports, "__esModule", ({ value: true })); -exports.ensureCorrectShaCheckedOut = exports.stageActionFiles = exports.readFileContents = exports.isDirectory = exports.createArchives = exports.createTempDir = void 0; +exports.ensureTagAndRefCheckedOut = exports.stageActionFiles = exports.readFileContents = exports.isDirectory = exports.createArchives = exports.createTempDir = void 0; const fs = __importStar(__nccwpck_require__(57147)); const fs_extra_1 = __importDefault(__nccwpck_require__(5630)); const path = __importStar(__nccwpck_require__(71017)); @@ -104635,7 +104635,10 @@ exports.stageActionFiles = stageActionFiles; // Ensure the correct SHA is checked out for the tag by inspecting the git metadata in the workspace // and comparing it to the information actions provided us. // Provided ref should be in format refs/tags/. -async function ensureCorrectShaCheckedOut(tagRef, expectedSha, gitDir) { +async function ensureTagAndRefCheckedOut(tagRef, expectedSha, gitDir) { + if (!tagRef.startsWith('refs/tags/')) { + throw new Error(`Tag ref provided is not in expected format.`); + } const git = simpleGit.simpleGit(gitDir); const tagCommitSha = await git.raw(['rev-parse', '--verify', tagRef]); if (tagCommitSha.trim() !== expectedSha) { @@ -104646,7 +104649,7 @@ async function ensureCorrectShaCheckedOut(tagRef, expectedSha, gitDir) { throw new Error(`The expected commit associated with the tag ${tagRef} is not checked out.`); } } -exports.ensureCorrectShaCheckedOut = ensureCorrectShaCheckedOut; +exports.ensureTagAndRefCheckedOut = ensureTagAndRefCheckedOut; // Converts a file path to a filemetadata object by querying the fs for relevant metadata. async function fileMetadata(filePath) { const stats = fs.statSync(filePath); @@ -104874,6 +104877,8 @@ async function run() { core.info(`Publishing action package version with options:`); core.info(cfg.serializeOptions(options)); const semverTag = await parseSemverTagFromRef(options); + // Ensure the correct SHA is checked out for the tag we're parsing, otherwise the bundled content will be incorrect. + await fsHelper.ensureTagAndRefCheckedOut(options.ref, options.sha, options.workspaceDir); const stagedActionFilesDir = fsHelper.createTempDir(options.runnerTempDir, 'staging'); fsHelper.stageActionFiles(options.workspaceDir, stagedActionFilesDir); const archiveDir = fsHelper.createTempDir(options.runnerTempDir, 'archives'); @@ -104911,8 +104916,6 @@ async function parseSemverTagFromRef(opts) { if (!semverTag) { throw new Error(`${rawTag} is not a valid semantic version tag, and so cannot be uploaded to the action package.`); } - // Ensure the correct SHA is checked out for the tag we're parsing, otherwise the bundled content will be incorrect. - await fsHelper.ensureCorrectShaCheckedOut(ref, opts.sha, opts.workspaceDir); return semverTag; } // Generate an attestation using the actions toolkit diff --git a/src/fs-helper.ts b/src/fs-helper.ts index 78c6832..ac65815 100644 --- a/src/fs-helper.ts +++ b/src/fs-helper.ts @@ -118,11 +118,15 @@ export function stageActionFiles(actionDir: string, targetDir: string): void { // Ensure the correct SHA is checked out for the tag by inspecting the git metadata in the workspace // and comparing it to the information actions provided us. // Provided ref should be in format refs/tags/. -export async function ensureCorrectShaCheckedOut( +export async function ensureTagAndRefCheckedOut( tagRef: string, expectedSha: string, gitDir: string ): Promise { + if (!tagRef.startsWith('refs/tags/')) { + throw new Error(`Tag ref provided is not in expected format.`) + } + const git: simpleGit.SimpleGit = simpleGit.simpleGit(gitDir) const tagCommitSha = await git.raw(['rev-parse', '--verify', tagRef]) diff --git a/src/main.ts b/src/main.ts index 05462ec..51790a6 100644 --- a/src/main.ts +++ b/src/main.ts @@ -20,6 +20,13 @@ export async function run(): Promise { const semverTag: semver.SemVer = await parseSemverTagFromRef(options) + // Ensure the correct SHA is checked out for the tag we're parsing, otherwise the bundled content will be incorrect. + await fsHelper.ensureTagAndRefCheckedOut( + options.ref, + options.sha, + options.workspaceDir + ) + const stagedActionFilesDir = fsHelper.createTempDir( options.runnerTempDir, 'staging' @@ -94,9 +101,6 @@ async function parseSemverTagFromRef( ) } - // Ensure the correct SHA is checked out for the tag we're parsing, otherwise the bundled content will be incorrect. - await fsHelper.ensureCorrectShaCheckedOut(ref, opts.sha, opts.workspaceDir) - return semverTag }