From 6c4739c7685742c279770f6e7a558a15c155a432 Mon Sep 17 00:00:00 2001
From: Conor Sloan <conorsloan@github.com>
Date: Thu, 23 Nov 2023 14:37:29 +0000
Subject: [PATCH] Sanitize repo name when including in a layer title

These titles were previously including the filename as {org}/{repo}_{version} which means when clients download the layer they think it needs to be unwrapped into a folder called {org}.
This is not what we want, so we should instead rename the file as {org}-{repo}_{version}. e.g. from myorg/myrepo_myversion.zip to myorg-myrepo_myversion.zip
---
 __tests__/oci-container.test.ts | 11 ++++++-----
 dist/index.js                   | 14 ++++++++++----
 src/oci-container.ts            | 15 +++++++++++----
 3 files changed, 27 insertions(+), 13 deletions(-)

diff --git a/__tests__/oci-container.test.ts b/__tests__/oci-container.test.ts
index dbaf031..ffb4b4d 100644
--- a/__tests__/oci-container.test.ts
+++ b/__tests__/oci-container.test.ts
@@ -4,7 +4,8 @@ import { FileMetadata } from '../src/fs-helper'
 describe('createActionPackageManigest', () => {
   it('creates a manifest containing the provided information', () => {
     const date = new Date()
-    const repo = 'test-repo'
+    const repo = 'test-org/test-repo'
+    const sanitizedRepo = 'test-org-test-repo'
     const version = '1.0.0'
     const tarFile: FileMetadata = {
       path: '/test/test/test',
@@ -43,7 +44,7 @@ describe('createActionPackageManigest', () => {
                     "size":${tarFile.size},
                     "digest":"${tarFile.sha256}",
                     "annotations":{
-                        "org.opencontainers.image.title":"${repo}-${version}.tar.gz"
+                        "org.opencontainers.image.title":"${sanitizedRepo}_${version}.tar.gz"
                     }
                 },
                 {
@@ -51,7 +52,7 @@ describe('createActionPackageManigest', () => {
                     "size":${tarFile.size},
                     "digest":"${tarFile.sha256}",
                     "annotations":{
-                        "org.opencontainers.image.title":"${repo}-${version}.zip"
+                        "org.opencontainers.image.title":"${sanitizedRepo}_${version}.zip"
                     }
                 }
             ],
@@ -74,8 +75,8 @@ describe('createActionPackageManigest', () => {
         size: 100,
         sha256: '1234567890'
       },
-      'test-repo',
-      '1.0.0',
+      repo,
+      version,
       date
     )
 
diff --git a/dist/index.js b/dist/index.js
index 061511f..ce106e3 100644
--- a/dist/index.js
+++ b/dist/index.js
@@ -74819,8 +74819,9 @@ exports.createActionPackageManifest = void 0;
 // Given a name and archive metadata, creates a manifest in the format expected by GHCR for an Actions Package.
 function createActionPackageManifest(tarFile, zipFile, repository, version, created) {
     const configLayer = createConfigLayer();
-    const tarLayer = createTarLayer(tarFile, repository, version);
-    const zipLayer = createZipLayer(zipFile, repository, version);
+    const sanitizedRepo = sanitizeRepository(repository);
+    const tarLayer = createTarLayer(tarFile, sanitizedRepo, version);
+    const zipLayer = createZipLayer(zipFile, sanitizedRepo, version);
     const manifest = {
         schemaVersion: 2,
         mediaType: 'application/vnd.oci.image.manifest.v1+json',
@@ -74855,7 +74856,7 @@ function createZipLayer(zipFile, repository, version) {
         size: zipFile.size,
         digest: zipFile.sha256,
         annotations: {
-            'org.opencontainers.image.title': `${repository}-${version}.zip`
+            'org.opencontainers.image.title': `${repository}_${version}.zip`
         }
     };
     return zipLayer;
@@ -74866,11 +74867,16 @@ function createTarLayer(tarFile, repository, version) {
         size: tarFile.size,
         digest: tarFile.sha256,
         annotations: {
-            'org.opencontainers.image.title': `${repository}-${version}.tar.gz`
+            'org.opencontainers.image.title': `${repository}_${version}.tar.gz`
         }
     };
     return tarLayer;
 }
+// Remove slashes so we can use the repository in a filename
+// repository usually includes the namespace too, e.g. my-org/my-repo
+function sanitizeRepository(repository) {
+    return repository.replace('/', '-');
+}
 
 
 /***/ }),
diff --git a/src/oci-container.ts b/src/oci-container.ts
index 2c743e9..a5b73b1 100644
--- a/src/oci-container.ts
+++ b/src/oci-container.ts
@@ -25,8 +25,9 @@ export function createActionPackageManifest(
   created: Date
 ): Manifest {
   const configLayer = createConfigLayer()
-  const tarLayer = createTarLayer(tarFile, repository, version)
-  const zipLayer = createZipLayer(zipFile, repository, version)
+  const sanitizedRepo = sanitizeRepository(repository)
+  const tarLayer = createTarLayer(tarFile, sanitizedRepo, version)
+  const zipLayer = createZipLayer(zipFile, sanitizedRepo, version)
 
   const manifest: Manifest = {
     schemaVersion: 2,
@@ -70,7 +71,7 @@ function createZipLayer(
     size: zipFile.size,
     digest: zipFile.sha256,
     annotations: {
-      'org.opencontainers.image.title': `${repository}-${version}.zip`
+      'org.opencontainers.image.title': `${repository}_${version}.zip`
     }
   }
 
@@ -87,9 +88,15 @@ function createTarLayer(
     size: tarFile.size,
     digest: tarFile.sha256,
     annotations: {
-      'org.opencontainers.image.title': `${repository}-${version}.tar.gz`
+      'org.opencontainers.image.title': `${repository}_${version}.tar.gz`
     }
   }
 
   return tarLayer
 }
+
+// Remove slashes so we can use the repository in a filename
+// repository usually includes the namespace too, e.g. my-org/my-repo
+function sanitizeRepository(repository: string): string {
+  return repository.replace('/', '-')
+}