try macos-latest-large

Signed-off-by: Brian DeHamer <bdehamer@github.com>

.github/CONTRIBUTING.md

@@ -43,7 +43,7 @@ Note that before a PR will be accepted, you must ensure:
 1. In a new branch, create a new Lerna package:
 
 ```console
-$ npm run create-package new-package
+$ npm run new-package [name]
 ```
 
 This will ask you some questions about the new package. Start with `0.0.0` as the first version (look generally at some of the other packages for how the package.json is structured).

.github/workflows/artifact-tests.yml

@@ -72,7 +72,7 @@ jobs:
             console.log('Successfully blocked second artifact upload')
           }
   verify:
-    name: Verify
+    name: Verify and Delete
     runs-on: ubuntu-latest
     needs: [upload]
     steps:
@@ -164,3 +164,31 @@ jobs:
               }
             }
           }
+    - name: Delete Artifacts
+      uses: actions/github-script@v7
+      with:
+        script: |
+          const {default: artifactClient} = require('./packages/artifact/lib/artifact')
+
+          const artifactsToDelete = [
+            'my-artifact-ubuntu-latest',
+            'my-artifact-windows-latest',
+            'my-artifact-macos-latest'
+          ]
+
+          for (const artifactName of artifactsToDelete) {
+            const {id} = await artifactClient.deleteArtifact(artifactName)
+          }
+
+          const {artifacts} = await artifactClient.listArtifacts({latest: true})
+          const foundArtifacts = artifacts.filter(artifact =>
+            artifactsToDelete.includes(artifact.name)
+          )
+
+          if (foundArtifacts.length !== 0) {
+            console.log('Unexpected length of found artifacts:', foundArtifacts)
+            throw new Error(
+              `Expected 0 artifacts but found ${foundArtifacts.length} artifacts.`
+            )
+          }
+

.github/workflows/audit.yml

@@ -18,10 +18,10 @@ jobs:
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
 
     - name: Set Node.js 20.x
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@v4
       with:
         node-version: 20.x
 
@@ -32,7 +32,7 @@ jobs:
       run: npm run bootstrap
 
     - name: audit tools (without allow-list)
-      run: npm audit --audit-level=moderate
+      run: npm audit --audit-level=moderate --omit dev
 
     - name: audit packages
       run: npm run audit-all

.github/workflows/cache-tests.yml

@@ -22,10 +22,10 @@ jobs:
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
 
     - name: Set Node.js 20.x
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@v4
       with:
         node-version: 20.x
 

.github/workflows/codeql.yml

@@ -20,7 +20,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL

.github/workflows/releases.yml

@@ -1,11 +1,13 @@
 name: Publish NPM
 
+run-name: Publish NPM - ${{ github.event.inputs.package }}
+
 on:
   workflow_dispatch:
     inputs:
       package:
         required: true
-        description: 'core, artifact, cache, exec, github, glob, http-client, io, tool-cache'
+        description: 'core, artifact, cache, exec, github, glob, http-client, io, tool-cache, attest'
 
 jobs:
   test:
@@ -13,13 +15,13 @@ jobs:
 
     steps:
       - name: setup repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: verify package exists
         run: ls packages/${{ github.event.inputs.package }}
 
       - name: Set Node.js 20.x
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
           node-version: 20.x
 
@@ -40,7 +42,7 @@ jobs:
         working-directory: packages/${{ github.event.inputs.package }}
 
       - name: upload artifact
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: ${{ github.event.inputs.package }}
           path: packages/${{ github.event.inputs.package }}/*.tgz
@@ -49,10 +51,13 @@ jobs:
     runs-on: macos-latest
     needs: test
     environment: npm-publish
+    permissions:
+      contents: read
+      id-token: write
     steps:
 
       - name: download artifact
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
           name: ${{ github.event.inputs.package }}
 
@@ -62,7 +67,7 @@ jobs:
           NPM_TOKEN: ${{ secrets.TOKEN }}
 
       - name: publish
-        run: npm publish *.tgz
+        run: npm publish --provenance *.tgz
 
       - name: notify slack on failure
         if: failure()

.github/workflows/unit-tests.yml

@@ -16,17 +16,17 @@ jobs:
 
     strategy:
       matrix:
-        runs-on: [ubuntu-latest, macos-latest, windows-latest]
+        runs-on: [ubuntu-latest, macos-latest-large, windows-latest]
       fail-fast: false
 
     runs-on: ${{ matrix.runs-on }}
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
 
     - name: Set Node.js 20.x
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@v4
       with:
         node-version: 20.x
 

.github/workflows/update-github.yaml

@@ -9,7 +9,7 @@ jobs:
     if: ${{ github.repository_owner == 'actions' }}
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Update Octokit
       working-directory: packages/github 
       run: |

CODEOWNERS

@@ -2,3 +2,4 @@
 
 /packages/artifact/   @actions/artifacts-actions
 /packages/cache/      @actions/actions-cache
+/packages/attest/      @actions/package-security

README.md

@@ -102,6 +102,15 @@ $ npm install @actions/cache
 ```
 <br/>
 
+:lock_with_ink_pen: [@actions/attest](packages/attest)
+
+Provides functions to write attestations for workflow artifacts. Read more [here](packages/attest)
+
+```bash
+$ npm install @actions/attest
+```
+<br/>
+
 ## Creating an Action with the Toolkit
 
 :question: [Choosing an action type](docs/action-types.md)

docs/action-types.md

@@ -32,7 +32,7 @@ jobs:
         os: [ubuntu-16.04, windows-2019]
     runs-on: ${{matrix.os}}
     actions:
-    - uses: actions/setup-node@v3
+    - uses: actions/setup-node@v4
       with:
         version: ${{matrix.node}}
     - run: | 

docs/container-action.md

@@ -18,7 +18,7 @@ e.g. To use https://github.com/actions/setup-node, users will author:
 
 ```yaml
 steps:
-    using: actions/setup-node@v3
+    using: actions/setup-node@v4
 ```
 
 # Define Metadata

package.json

@@ -13,7 +13,7 @@
     "lint": "eslint packages/**/*.ts",
     "lint-fix": "eslint packages/**/*.ts --fix",
     "new-package": "scripts/create-package",
-    "test": "jest --testTimeout 60000"
+    "test": "jest --testTimeout 70000"
   },
   "devDependencies": {
     "@types/jest": "^29.5.4",
@@ -27,7 +27,7 @@
     "eslint-plugin-prettier": "^5.0.0",
     "flow-bin": "^0.115.0",
     "jest": "^29.6.4",
-    "lerna": "^7.1.4",
+    "lerna": "^6.4.1",
     "nx": "16.6.0",
     "prettier": "^3.0.0",
     "ts-jest": "^29.1.1",

packages/artifact/README.md

@@ -12,6 +12,7 @@ This is the core library that powers the [`@actions/upload-artifact`](https://gi
   - [Quick Start](#quick-start)
   - [Examples](#examples)
     - [Upload and Download](#upload-and-download)
+    - [Delete an Artifact](#delete-an-artifact)
     - [Downloading from other workflow runs or repos](#downloading-from-other-workflow-runs-or-repos)
     - [Speeding up large uploads](#speeding-up-large-uploads)
   - [Additional Resources](#additional-resources)
@@ -106,6 +107,41 @@ const {downloadPath} = await artifact.downloadArtifact(id, {
 console.log(`Downloaded artifact ${id} to: ${downloadPath}`)
 ```
 
+### Delete an Artifact
+
+To delete an artifact, all you need is the name.
+
+```js
+const {id} = await artifact.deleteArtifact(
+  // name of the artifact
+  'my-artifact'
+)
+
+console.log(`Deleted Artifact ID '${id}'`)
+```
+
+It also supports options to delete from other repos/runs given a github token with `actions:write` permissions on the target repository is supplied.
+
+```js
+const findBy = {
+  // must have actions:write permission on target repository
+  token: process.env['GITHUB_TOKEN'],
+  workflowRunId: 123,
+  repositoryOwner: 'actions',
+  repositoryName: 'toolkit'
+}
+
+
+const {id} = await artifact.deleteArtifact(
+  // name of the artifact
+  'my-artifact',
+  // options to find by other repo/owner
+  { findBy }
+)
+
+console.log(`Deleted Artifact ID '${id}' from ${findBy.repositoryOwner}/ ${findBy.repositoryName}`)
+```
+
 ### Downloading from other workflow runs or repos
 
 It may be useful to download Artifacts from other workflow runs, or even other repositories. By default, the permissions are scoped so they can only download Artifacts within the current workflow run. To elevate permissions for this scenario, you must specify `options.findBy` to `downloadArtifact`.

packages/artifact/RELEASES.md

@@ -1,15 +1,142 @@
 # @actions/artifact Releases
 
-### 0.1.0
+### 2.1.11
 
-- Initial release
+- Fixed a bug with relative symlinks resolution [#1844](https://github.com/actions/toolkit/pull/1844)
+- Use native `crypto` [#1815](https://github.com/actions/toolkit/pull/1815)
 
-### 0.2.0
+### 2.1.10
 
-- Fixes to TCP connections not closing
-- GZip file compression to speed up downloads
-- Improved logging and output
-- Extra documentation
+- Fixed a regression with symlinks not being automatically resolved [#1830](https://github.com/actions/toolkit/pull/1830)
+- Fixed a regression with chunk timeout [#1786](https://github.com/actions/toolkit/pull/1786)
+
+### 2.1.9
+
+- Fixed artifact upload chunk timeout logic [#1774](https://github.com/actions/toolkit/pull/1774)
+- Use lazy stream to prevent issues with open file limits [#1771](https://github.com/actions/toolkit/pull/1771)
+
+### 2.1.8
+
+- Allows `*.localhost` domains for hostname checks for local development.
+
+### 2.1.7
+
+- Update unzip-stream dependency and reverted to using `unzip.Extract()`
+
+### 2.1.6
+
+- Will retry on invalid request responses.
+
+### 2.1.5
+
+- Bumped `archiver` dependency to 7.0.1
+
+### 2.1.4
+
+- Adds info-level logging for zip extraction
+
+### 2.1.3
+
+- Fixes a bug in the extract logic updated in 2.1.2
+
+### 2.1.2
+
+- Updated the stream extract functionality to use `unzip.Parse()` instead of `unzip.Extract()` for greater control of unzipping artifacts
+
+### 2.1.1
+
+- Updated `isGhes` check to include `.ghe.com` and `.ghe.localhost` as accepted hosts
+
+### 2.1.0
+
+- Added `ArtifactClient#deleteArtifact` to delete artifacts by name [#1626](https://github.com/actions/toolkit/pull/1626)
+- Update error messaging to be more useful [#1628](https://github.com/actions/toolkit/pull/1628)
+
+### 2.0.1
+
+- Patch to fix transient request timeouts https://github.com/actions/download-artifact/issues/249
+
+### 2.0.0
+
+- Major release. Supports new Artifact backend for improved speed, reliability and behavior.
+- Numerous API changes, [some breaking](./README.md#breaking-changes).
+
+- [Blog post with more info](https://github.blog/2024-02-12-get-started-with-v4-of-github-actions-artifacts/)
+
+### 1.1.1
+
+- Fixed a bug in Node16 where if an HTTP download finished too quickly (<1ms, e.g. when it's mocked) we attempt to delete a temp file that has not been created yet [#1278](https://github.com/actions/toolkit/pull/1278/commits/b9de68a590daf37c6747e38d3cb4f1dd2cfb791c)
+
+### 1.1.0
+
+- Add `x-actions-results-crc64` and `x-actions-results-md5` checksum headers on upload [#1063](https://github.com/actions/toolkit/pull/1063)
+
+### 1.0.2
+
+- Update to v2.0.1 of `@actions/http-client` [#1087](https://github.com/actions/toolkit/pull/1087)
+
+### 1.0.1
+
+- Update to v2.0.0 of `@actions/http-client`
+
+### 1.0.0
+
+- Update `lockfileVersion` to `v2` in `package-lock.json` [#1009](https://github.com/actions/toolkit/pull/1009)
+
+### 0.6.1
+
+- Fix for failing 0 byte file uploads on Windows [#962](https://github.com/actions/toolkit/pull/962)
+
+### 0.6.0
+
+- Support upload from named pipes [#748](https://github.com/actions/toolkit/pull/748)
+- Fixes to percentage values being greater than 100% when downloading all artifacts [#889](https://github.com/actions/toolkit/pull/889)
+- Improved logging and output during artifact upload [#949](https://github.com/actions/toolkit/pull/949)
+- Improvements to client-side validation for certain invalid characters not allowed during upload: [#951](https://github.com/actions/toolkit/pull/951)
+- Faster upload speeds for certain types of large files by exempting gzip compression [#956](https://github.com/actions/toolkit/pull/956)
+- More detailed logging when dealing with chunked uploads [#957](https://github.com/actions/toolkit/pull/957)
+  
+### 0.5.2
+
+- Add HTTP 500 as a retryable status code for artifact upload and download.
+  
+### 0.5.1
+
+- Bump @actions/http-client to version 1.0.11 to fix proxy related issues during artifact upload and download
+
+### 0.5.0
+
+- Improved retry-ability for all http calls during artifact upload and download if an error is encountered
+
+### 0.4.2
+
+- Improved retry-ability when a partial artifact download is encountered
+
+### 0.4.1
+
+- Update to latest @actions/core version
+
+### 0.4.0
+
+- Add option to specify custom retentions on artifacts
+- 
+### 0.3.5
+
+- Retry in the event of a 413 response
+
+### 0.3.3
+
+- Increase chunk size during upload from 4MB to 8MB
+- Improve user-agent strings during API calls to help internally diagnose issues
+
+### 0.3.2
+
+- Fix to ensure readstreams get correctly reset in the event of a retry
+
+### 0.3.1
+
+- Fix to ensure temporary gzip files get correctly deleted during artifact upload
+- Remove spaces as a forbidden character during upload
 
 ### 0.3.0
 
@@ -20,88 +147,13 @@
 - Clearer error message if storage quota has been reached
 - Improved logging and output during artifact download
 
-### 0.3.1
+### 0.2.0
 
-- Fix to ensure temporary gzip files get correctly deleted during artifact upload
-- Remove spaces as a forbidden character during upload
+- Fixes to TCP connections not closing
+- GZip file compression to speed up downloads
+- Improved logging and output
+- Extra documentation
 
-### 0.3.2
+### 0.1.0
 
-- Fix to ensure readstreams get correctly reset in the event of a retry
-
-### 0.3.3
-
-- Increase chunk size during upload from 4MB to 8MB
-- Improve user-agent strings during API calls to help internally diagnose issues
-
-### 0.3.5
-
-- Retry in the event of a 413 response
-
-### 0.4.0
-
-- Add option to specify custom retentions on artifacts
-
-### 0.4.1
-
-- Update to latest @actions/core version
-
-### 0.4.2
-
-- Improved retry-ability when a partial artifact download is encountered
-
-### 0.5.0
-
-- Improved retry-ability for all http calls during artifact upload and download if an error is encountered
-
-### 0.5.1
-
-- Bump @actions/http-client to version 1.0.11 to fix proxy related issues during artifact upload and download
-
-### 0.5.2
-
-- Add HTTP 500 as a retryable status code for artifact upload and download.
-
-### 0.6.0
-
-- Support upload from named pipes [#748](https://github.com/actions/toolkit/pull/748)
-- Fixes to percentage values being greater than 100% when downloading all artifacts [#889](https://github.com/actions/toolkit/pull/889)
-- Improved logging and output during artifact upload [#949](https://github.com/actions/toolkit/pull/949)
-- Improvements to client-side validation for certain invalid characters not allowed during upload: [#951](https://github.com/actions/toolkit/pull/951)
-- Faster upload speeds for certain types of large files by exempting gzip compression [#956](https://github.com/actions/toolkit/pull/956)
-- More detailed logging when dealing with chunked uploads [#957](https://github.com/actions/toolkit/pull/957)
-
-### 0.6.1
-
-- Fix for failing 0 byte file uploads on Windows [#962](https://github.com/actions/toolkit/pull/962)
-
-### 1.0.0
-
-- Update `lockfileVersion` to `v2` in `package-lock.json` [#1009](https://github.com/actions/toolkit/pull/1009)
-
-### 1.0.1
-
-- Update to v2.0.0 of `@actions/http-client`
-
-### 1.0.2
-
-- Update to v2.0.1 of `@actions/http-client` [#1087](https://github.com/actions/toolkit/pull/1087)
-
-### 1.1.0
-
-- Add `x-actions-results-crc64` and `x-actions-results-md5` checksum headers on upload [#1063](https://github.com/actions/toolkit/pull/1063)
-
-### 1.1.1
-
-- Fixed a bug in Node16 where if an HTTP download finished too quickly (<1ms, e.g. when it's mocked) we attempt to delete a temp file that has not been created yet [#1278](https://github.com/actions/toolkit/pull/1278/commits/b9de68a590daf37c6747e38d3cb4f1dd2cfb791c)
-
-### 2.0.0
-
-- Major release. Supports new Artifact backend for improved speed, reliability and behavior.
-- Numerous API changes, [some breaking](./README.md#breaking-changes).
-
-- Blog post with more info: TBD
-
-### 2.0.1
-
-- Patch to fix transient request timeouts https://github.com/actions/download-artifact/issues/249
+- Initial release

packages/artifact/__tests__/artifact-http-client.test.ts

@@ -116,6 +116,54 @@ describe('artifact-http-client', () => {
     expect(mockPost).toHaveBeenCalledTimes(2)
   })
 
+  it('should retry if invalid body response', async () => {
+    const mockPost = jest
+      .fn(() => {
+        const msgSucceeded = new http.IncomingMessage(new net.Socket())
+        msgSucceeded.statusCode = 200
+        return {
+          message: msgSucceeded,
+          readBody: async () => {
+            return Promise.resolve(
+              `{"ok": true, "signedUploadUrl": "http://localhost:8080/upload"}`
+            )
+          }
+        }
+      })
+      .mockImplementationOnce(() => {
+        const msgFailed = new http.IncomingMessage(new net.Socket())
+        msgFailed.statusCode = 502
+        msgFailed.statusMessage = 'Bad Gateway'
+        return {
+          message: msgFailed,
+          readBody: async () => {
+            return Promise.resolve('💥')
+          }
+        }
+      })
+    const mockHttpClient = (
+      HttpClient as unknown as jest.Mock
+    ).mockImplementation(() => {
+      return {
+        post: mockPost
+      }
+    })
+
+    const client = internalArtifactTwirpClient(clientOptions)
+    const artifact = await client.CreateArtifact({
+      workflowRunBackendId: '1234',
+      workflowJobRunBackendId: '5678',
+      name: 'artifact',
+      version: 4
+    })
+
+    expect(mockHttpClient).toHaveBeenCalledTimes(1)
+    expect(artifact).toBeDefined()
+    expect(artifact.ok).toBe(true)
+    expect(artifact.signedUploadUrl).toBe('http://localhost:8080/upload')
+    expect(mockPost).toHaveBeenCalledTimes(2)
+  })
+
   it('should fail if the request fails 5 times', async () => {
     const mockPost = jest.fn(() => {
       const msgFailed = new http.IncomingMessage(new net.Socket())

packages/artifact/__tests__/config.test.ts

@@ -0,0 +1,32 @@
+import * as config from '../src/internal/shared/config'
+
+beforeEach(() => {
+  jest.resetModules()
+})
+
+describe('isGhes', () => {
+  it('should return false when the request domain is github.com', () => {
+    process.env.GITHUB_SERVER_URL = 'https://github.com'
+    expect(config.isGhes()).toBe(false)
+  })
+
+  it('should return false when the request domain ends with ghe.com', () => {
+    process.env.GITHUB_SERVER_URL = 'https://my.domain.ghe.com'
+    expect(config.isGhes()).toBe(false)
+  })
+
+  it('should return false when the request domain ends with ghe.localhost', () => {
+    process.env.GITHUB_SERVER_URL = 'https://my.domain.ghe.localhost'
+    expect(config.isGhes()).toBe(false)
+  })
+
+  it('should return false when the request domain ends with .localhost', () => {
+    process.env.GITHUB_SERVER_URL = 'https://github.localhost'
+    expect(config.isGhes()).toBe(false)
+  })
+
+  it('should return false when the request domain is specific to an enterprise', () => {
+    process.env.GITHUB_SERVER_URL = 'https://my-enterprise.github.com'
+    expect(config.isGhes()).toBe(true)
+  })
+})

packages/artifact/__tests__/delete-artifacts.test.ts

@@ -0,0 +1,192 @@
+import * as github from '@actions/github'
+import type {RestEndpointMethods} from '@octokit/plugin-rest-endpoint-methods/dist-types/generated/method-types'
+import type {RequestInterface} from '@octokit/types'
+import {
+  deleteArtifactInternal,
+  deleteArtifactPublic
+} from '../src/internal/delete/delete-artifact'
+import * as config from '../src/internal/shared/config'
+import {ArtifactServiceClientJSON, Timestamp} from '../src/generated'
+import * as util from '../src/internal/shared/util'
+import {noopLogs} from './common'
+
+type MockedRequest = jest.MockedFunction<RequestInterface<object>>
+
+type MockedDeleteArtifact = jest.MockedFunction<
+  RestEndpointMethods['actions']['deleteArtifact']
+>
+
+jest.mock('@actions/github', () => ({
+  getOctokit: jest.fn().mockReturnValue({
+    request: jest.fn(),
+    rest: {
+      actions: {
+        deleteArtifact: jest.fn()
+      }
+    }
+  })
+}))
+
+const fixtures = {
+  repo: 'toolkit',
+  owner: 'actions',
+  token: 'ghp_1234567890',
+  runId: 123,
+  backendIds: {
+    workflowRunBackendId: 'c4d7c21f-ba3f-4ddc-a8c8-6f2f626f8422',
+    workflowJobRunBackendId: '760803a1-f890-4d25-9a6e-a3fc01a0c7cf'
+  },
+  artifacts: [
+    {
+      id: 1,
+      name: 'my-artifact',
+      size: 456,
+      createdAt: new Date('2023-12-01')
+    },
+    {
+      id: 2,
+      name: 'my-artifact',
+      size: 456,
+      createdAt: new Date('2023-12-02')
+    }
+  ]
+}
+
+describe('delete-artifact', () => {
+  beforeAll(() => {
+    noopLogs()
+  })
+
+  describe('public', () => {
+    it('should delete an artifact', async () => {
+      const mockRequest = github.getOctokit(fixtures.token)
+        .request as MockedRequest
+      mockRequest.mockResolvedValueOnce({
+        status: 200,
+        headers: {},
+        url: '',
+        data: {
+          artifacts: [
+            {
+              name: fixtures.artifacts[0].name,
+              id: fixtures.artifacts[0].id,
+              size_in_bytes: fixtures.artifacts[0].size,
+              created_at: fixtures.artifacts[0].createdAt.toISOString()
+            }
+          ]
+        }
+      })
+
+      const mockDeleteArtifact = github.getOctokit(fixtures.token).rest.actions
+        .deleteArtifact as MockedDeleteArtifact
+      mockDeleteArtifact.mockResolvedValueOnce({
+        status: 204,
+        headers: {},
+        url: '',
+        data: null as never
+      })
+
+      const response = await deleteArtifactPublic(
+        fixtures.artifacts[0].name,
+        fixtures.runId,
+        fixtures.owner,
+        fixtures.repo,
+        fixtures.token
+      )
+
+      expect(response).toEqual({
+        id: fixtures.artifacts[0].id
+      })
+    })
+
+    it('should fail if non-200 response', async () => {
+      const mockRequest = github.getOctokit(fixtures.token)
+        .request as MockedRequest
+      mockRequest.mockResolvedValueOnce({
+        status: 200,
+        headers: {},
+        url: '',
+        data: {
+          artifacts: [
+            {
+              name: fixtures.artifacts[0].name,
+              id: fixtures.artifacts[0].id,
+              size_in_bytes: fixtures.artifacts[0].size,
+              created_at: fixtures.artifacts[0].createdAt.toISOString()
+            }
+          ]
+        }
+      })
+
+      const mockDeleteArtifact = github.getOctokit(fixtures.token).rest.actions
+        .deleteArtifact as MockedDeleteArtifact
+      mockDeleteArtifact.mockRejectedValue(new Error('boom'))
+
+      await expect(
+        deleteArtifactPublic(
+          fixtures.artifacts[0].name,
+          fixtures.runId,
+          fixtures.owner,
+          fixtures.repo,
+          fixtures.token
+        )
+      ).rejects.toThrow('boom')
+    })
+  })
+
+  describe('internal', () => {
+    beforeEach(() => {
+      jest.spyOn(config, 'getRuntimeToken').mockReturnValue('test-token')
+      jest
+        .spyOn(util, 'getBackendIdsFromToken')
+        .mockReturnValue(fixtures.backendIds)
+      jest
+        .spyOn(config, 'getResultsServiceUrl')
+        .mockReturnValue('https://results.local')
+    })
+
+    it('should delete an artifact', async () => {
+      jest
+        .spyOn(ArtifactServiceClientJSON.prototype, 'ListArtifacts')
+        .mockResolvedValue({
+          artifacts: fixtures.artifacts.map(artifact => ({
+            ...fixtures.backendIds,
+            databaseId: artifact.id.toString(),
+            name: artifact.name,
+            size: artifact.size.toString(),
+            createdAt: Timestamp.fromDate(artifact.createdAt)
+          }))
+        })
+      jest
+        .spyOn(ArtifactServiceClientJSON.prototype, 'DeleteArtifact')
+        .mockResolvedValue({
+          ok: true,
+          artifactId: fixtures.artifacts[0].id.toString()
+        })
+      const response = await deleteArtifactInternal(fixtures.artifacts[0].name)
+      expect(response).toEqual({
+        id: fixtures.artifacts[0].id
+      })
+    })
+
+    it('should fail if non-200 response', async () => {
+      jest
+        .spyOn(ArtifactServiceClientJSON.prototype, 'ListArtifacts')
+        .mockResolvedValue({
+          artifacts: fixtures.artifacts.map(artifact => ({
+            ...fixtures.backendIds,
+            databaseId: artifact.id.toString(),
+            name: artifact.name,
+            size: artifact.size.toString(),
+            createdAt: Timestamp.fromDate(artifact.createdAt)
+          }))
+        })
+      jest
+        .spyOn(ArtifactServiceClientJSON.prototype, 'DeleteArtifact')
+        .mockRejectedValue(new Error('boom'))
+      await expect(
+        deleteArtifactInternal(fixtures.artifacts[0].id)
+      ).rejects.toThrow('boom')
+    })
+  })
+})

packages/artifact/__tests__/download-artifact.test.ts

@@ -121,6 +121,16 @@ const mockGetArtifactFailure = jest.fn(() => {
   }
 })
 
+const mockGetArtifactMalicious = jest.fn(() => {
+  const message = new http.IncomingMessage(new net.Socket())
+  message.statusCode = 200
+  message.push(fs.readFileSync(path.join(__dirname, 'fixtures', 'evil.zip'))) // evil.zip contains files that are formatted x/../../etc/hosts
+  message.push(null)
+  return {
+    message
+  }
+})
+
 describe('download-artifact', () => {
   describe('public', () => {
     beforeEach(setup)
@@ -170,6 +180,59 @@ describe('download-artifact', () => {
       expect(response.downloadPath).toBe(fixtures.workspaceDir)
     })
 
+    it('should not allow path traversal from malicious artifacts', async () => {
+      const downloadArtifactMock = github.getOctokit(fixtures.token).rest
+        .actions.downloadArtifact as MockedDownloadArtifact
+      downloadArtifactMock.mockResolvedValueOnce({
+        headers: {
+          location: fixtures.blobStorageUrl
+        },
+        status: 302,
+        url: '',
+        data: Buffer.from('')
+      })
+
+      const mockHttpClient = (HttpClient as jest.Mock).mockImplementation(
+        () => {
+          return {
+            get: mockGetArtifactMalicious
+          }
+        }
+      )
+
+      const response = await downloadArtifactPublic(
+        fixtures.artifactID,
+        fixtures.repositoryOwner,
+        fixtures.repositoryName,
+        fixtures.token
+      )
+
+      expect(downloadArtifactMock).toHaveBeenCalledWith({
+        owner: fixtures.repositoryOwner,
+        repo: fixtures.repositoryName,
+        artifact_id: fixtures.artifactID,
+        archive_format: 'zip',
+        request: {
+          redirect: 'manual'
+        }
+      })
+
+      expect(mockHttpClient).toHaveBeenCalledWith(getUserAgentString())
+      expect(mockGetArtifactMalicious).toHaveBeenCalledWith(
+        fixtures.blobStorageUrl
+      )
+
+      // ensure path traversal was not possible
+      expect(
+        fs.existsSync(path.join(fixtures.workspaceDir, 'x/etc/hosts'))
+      ).toBe(true)
+      expect(
+        fs.existsSync(path.join(fixtures.workspaceDir, 'y/etc/hosts'))
+      ).toBe(true)
+
+      expect(response.downloadPath).toBe(fixtures.workspaceDir)
+    })
+
     it('should successfully download an artifact to user defined path', async () => {
       const customPath = path.join(testDir, 'custom')
 

packages/artifact/__tests__/upload-artifact.test.ts

@@ -1,257 +1,173 @@
 import * as uploadZipSpecification from '../src/internal/upload/upload-zip-specification'
 import * as zip from '../src/internal/upload/zip'
 import * as util from '../src/internal/shared/util'
-import * as retention from '../src/internal/upload/retention'
 import * as config from '../src/internal/shared/config'
-import {Timestamp, ArtifactServiceClientJSON} from '../src/generated'
+import {ArtifactServiceClientJSON} from '../src/generated'
 import * as blobUpload from '../src/internal/upload/blob-upload'
 import {uploadArtifact} from '../src/internal/upload/upload-artifact'
 import {noopLogs} from './common'
 import {FilesNotFoundError} from '../src/internal/shared/errors'
+import {BlockBlobUploadStreamOptions} from '@azure/storage-blob'
+import * as fs from 'fs'
+import * as path from 'path'
+import unzip from 'unzip-stream'
+
+const uploadStreamMock = jest.fn()
+const blockBlobClientMock = jest.fn().mockImplementation(() => ({
+  uploadStream: uploadStreamMock
+}))
+
+jest.mock('@azure/storage-blob', () => ({
+  BlobClient: jest.fn().mockImplementation(() => {
+    return {
+      getBlockBlobClient: blockBlobClientMock
+    }
+  })
+}))
+
+const fixtures = {
+  uploadDirectory: path.join(__dirname, '_temp', 'plz-upload'),
+  files: [
+    {name: 'file1.txt', content: 'test 1 file content'},
+    {name: 'file2.txt', content: 'test 2 file content'},
+    {name: 'file3.txt', content: 'test 3 file content'},
+    {
+      name: 'real.txt',
+      content: 'from a symlink'
+    },
+    {
+      name: 'relative.txt',
+      content: 'from a symlink',
+      symlink: 'real.txt',
+      relative: true
+    },
+    {
+      name: 'absolute.txt',
+      content: 'from a symlink',
+      symlink: 'real.txt',
+      relative: false
+    }
+  ],
+  backendIDs: {
+    workflowRunBackendId: '67dbcc20-e851-4452-a7c3-2cc0d2e0ec67',
+    workflowJobRunBackendId: '5f49179d-3386-4c38-85f7-00f8138facd0'
+  },
+  runtimeToken: 'test-token',
+  resultsServiceURL: 'http://results.local',
+  inputs: {
+    artifactName: 'test-artifact',
+    files: [
+      '/home/user/files/plz-upload/file1.txt',
+      '/home/user/files/plz-upload/file2.txt',
+      '/home/user/files/plz-upload/dir/file3.txt'
+    ],
+    rootDirectory: '/home/user/files/plz-upload'
+  }
+}
 
 describe('upload-artifact', () => {
+  beforeAll(() => {
+    fs.mkdirSync(fixtures.uploadDirectory, {
+      recursive: true
+    })
+
+    for (const file of fixtures.files) {
+      if (file.symlink) {
+        let symlinkPath = file.symlink
+        if (!file.relative) {
+          symlinkPath = path.join(fixtures.uploadDirectory, file.symlink)
+        }
+
+        if (!fs.existsSync(path.join(fixtures.uploadDirectory, file.name))) {
+          fs.symlinkSync(
+            symlinkPath,
+            path.join(fixtures.uploadDirectory, file.name),
+            'file'
+          )
+        }
+      } else {
+        fs.writeFileSync(
+          path.join(fixtures.uploadDirectory, file.name),
+          file.content
+        )
+      }
+    }
+  })
+
   beforeEach(() => {
     noopLogs()
+    jest
+      .spyOn(uploadZipSpecification, 'validateRootDirectory')
+      .mockReturnValue()
+    jest
+      .spyOn(util, 'getBackendIdsFromToken')
+      .mockReturnValue(fixtures.backendIDs)
+    jest
+      .spyOn(uploadZipSpecification, 'getUploadZipSpecification')
+      .mockReturnValue(
+        fixtures.files.map(file => ({
+          sourcePath: path.join(fixtures.uploadDirectory, file.name),
+          destinationPath: file.name,
+          stats: new fs.Stats()
+        }))
+      )
+    jest.spyOn(config, 'getRuntimeToken').mockReturnValue(fixtures.runtimeToken)
+    jest
+      .spyOn(config, 'getResultsServiceUrl')
+      .mockReturnValue(fixtures.resultsServiceURL)
   })
 
   afterEach(() => {
     jest.restoreAllMocks()
   })
 
-  it('should successfully upload an artifact', () => {
-    const mockDate = new Date('2020-01-01')
-    jest
-      .spyOn(uploadZipSpecification, 'validateRootDirectory')
-      .mockReturnValue()
-    jest
-      .spyOn(uploadZipSpecification, 'getUploadZipSpecification')
-      .mockReturnValue([
-        {
-          sourcePath: '/home/user/files/plz-upload/file1.txt',
-          destinationPath: 'file1.txt'
-        },
-        {
-          sourcePath: '/home/user/files/plz-upload/file2.txt',
-          destinationPath: 'file2.txt'
-        },
-        {
-          sourcePath: '/home/user/files/plz-upload/dir/file3.txt',
-          destinationPath: 'dir/file3.txt'
-        }
-      ])
-
-    jest
-      .spyOn(zip, 'createZipUploadStream')
-      .mockReturnValue(Promise.resolve(new zip.ZipUploadStream(1)))
-    jest.spyOn(util, 'getBackendIdsFromToken').mockReturnValue({
-      workflowRunBackendId: '1234',
-      workflowJobRunBackendId: '5678'
-    })
-    jest
-      .spyOn(retention, 'getExpiration')
-      .mockReturnValue(Timestamp.fromDate(mockDate))
-    jest
-      .spyOn(ArtifactServiceClientJSON.prototype, 'CreateArtifact')
-      .mockReturnValue(
-        Promise.resolve({
-          ok: true,
-          signedUploadUrl: 'https://signed-upload-url.com'
-        })
-      )
-    jest.spyOn(blobUpload, 'uploadZipToBlobStorage').mockReturnValue(
-      Promise.resolve({
-        uploadSize: 1234,
-        sha256Hash: 'test-sha256-hash'
-      })
-    )
-    jest
-      .spyOn(ArtifactServiceClientJSON.prototype, 'FinalizeArtifact')
-      .mockReturnValue(Promise.resolve({ok: true, artifactId: '1'}))
-
-    // ArtifactHttpClient mocks
-    jest.spyOn(config, 'getRuntimeToken').mockReturnValue('test-token')
-    jest
-      .spyOn(config, 'getResultsServiceUrl')
-      .mockReturnValue('https://test-url.com')
-
-    const uploadResp = uploadArtifact(
-      'test-artifact',
-      [
-        '/home/user/files/plz-upload/file1.txt',
-        '/home/user/files/plz-upload/file2.txt',
-        '/home/user/files/plz-upload/dir/file3.txt'
-      ],
-      '/home/user/files/plz-upload'
-    )
-
-    expect(uploadResp).resolves.toEqual({size: 1234, id: 1})
-  })
-
-  it('should throw an error if the root directory is invalid', () => {
-    jest
-      .spyOn(uploadZipSpecification, 'validateRootDirectory')
-      .mockImplementation(() => {
-        throw new Error('Invalid root directory')
-      })
-
-    const uploadResp = uploadArtifact(
-      'test-artifact',
-      [
-        '/home/user/files/plz-upload/file1.txt',
-        '/home/user/files/plz-upload/file2.txt',
-        '/home/user/files/plz-upload/dir/file3.txt'
-      ],
-      '/home/user/files/plz-upload'
-    )
-
-    expect(uploadResp).rejects.toThrow('Invalid root directory')
-  })
-
-  it('should reject if there are no files to upload', () => {
-    jest
-      .spyOn(uploadZipSpecification, 'validateRootDirectory')
-      .mockReturnValue()
+  it('should reject if there are no files to upload', async () => {
     jest
       .spyOn(uploadZipSpecification, 'getUploadZipSpecification')
+      .mockClear()
       .mockReturnValue([])
 
     const uploadResp = uploadArtifact(
-      'test-artifact',
-      [
-        '/home/user/files/plz-upload/file1.txt',
-        '/home/user/files/plz-upload/file2.txt',
-        '/home/user/files/plz-upload/dir/file3.txt'
-      ],
-      '/home/user/files/plz-upload'
+      fixtures.inputs.artifactName,
+      fixtures.inputs.files,
+      fixtures.inputs.rootDirectory
     )
-    expect(uploadResp).rejects.toThrowError(FilesNotFoundError)
+    await expect(uploadResp).rejects.toThrowError(FilesNotFoundError)
   })
 
-  it('should reject if no backend IDs are found', () => {
-    jest
-      .spyOn(uploadZipSpecification, 'validateRootDirectory')
-      .mockReturnValue()
-    jest
-      .spyOn(uploadZipSpecification, 'getUploadZipSpecification')
-      .mockReturnValue([
-        {
-          sourcePath: '/home/user/files/plz-upload/file1.txt',
-          destinationPath: 'file1.txt'
-        },
-        {
-          sourcePath: '/home/user/files/plz-upload/file2.txt',
-          destinationPath: 'file2.txt'
-        },
-        {
-          sourcePath: '/home/user/files/plz-upload/dir/file3.txt',
-          destinationPath: 'dir/file3.txt'
-        }
-      ])
-
-    jest
-      .spyOn(zip, 'createZipUploadStream')
-      .mockReturnValue(Promise.resolve(new zip.ZipUploadStream(1)))
+  it('should reject if no backend IDs are found', async () => {
+    jest.spyOn(util, 'getBackendIdsFromToken').mockRestore()
 
     const uploadResp = uploadArtifact(
-      'test-artifact',
-      [
-        '/home/user/files/plz-upload/file1.txt',
-        '/home/user/files/plz-upload/file2.txt',
-        '/home/user/files/plz-upload/dir/file3.txt'
-      ],
-      '/home/user/files/plz-upload'
+      fixtures.inputs.artifactName,
+      fixtures.inputs.files,
+      fixtures.inputs.rootDirectory
     )
 
-    expect(uploadResp).rejects.toThrow()
+    await expect(uploadResp).rejects.toThrow()
   })
 
-  it('should return false if the creation request fails', () => {
-    const mockDate = new Date('2020-01-01')
-    jest
-      .spyOn(uploadZipSpecification, 'validateRootDirectory')
-      .mockReturnValue()
-    jest
-      .spyOn(uploadZipSpecification, 'getUploadZipSpecification')
-      .mockReturnValue([
-        {
-          sourcePath: '/home/user/files/plz-upload/file1.txt',
-          destinationPath: 'file1.txt'
-        },
-        {
-          sourcePath: '/home/user/files/plz-upload/file2.txt',
-          destinationPath: 'file2.txt'
-        },
-        {
-          sourcePath: '/home/user/files/plz-upload/dir/file3.txt',
-          destinationPath: 'dir/file3.txt'
-        }
-      ])
-
+  it('should return false if the creation request fails', async () => {
     jest
       .spyOn(zip, 'createZipUploadStream')
       .mockReturnValue(Promise.resolve(new zip.ZipUploadStream(1)))
-    jest.spyOn(util, 'getBackendIdsFromToken').mockReturnValue({
-      workflowRunBackendId: '1234',
-      workflowJobRunBackendId: '5678'
-    })
-    jest
-      .spyOn(retention, 'getExpiration')
-      .mockReturnValue(Timestamp.fromDate(mockDate))
     jest
       .spyOn(ArtifactServiceClientJSON.prototype, 'CreateArtifact')
       .mockReturnValue(Promise.resolve({ok: false, signedUploadUrl: ''}))
 
-    // ArtifactHttpClient mocks
-    jest.spyOn(config, 'getRuntimeToken').mockReturnValue('test-token')
-    jest
-      .spyOn(config, 'getResultsServiceUrl')
-      .mockReturnValue('https://test-url.com')
-
     const uploadResp = uploadArtifact(
-      'test-artifact',
-      [
-        '/home/user/files/plz-upload/file1.txt',
-        '/home/user/files/plz-upload/file2.txt',
-        '/home/user/files/plz-upload/dir/file3.txt'
-      ],
-      '/home/user/files/plz-upload'
+      fixtures.inputs.artifactName,
+      fixtures.inputs.files,
+      fixtures.inputs.rootDirectory
     )
 
-    expect(uploadResp).rejects.toThrow()
+    await expect(uploadResp).rejects.toThrow()
   })
 
-  it('should return false if blob storage upload is unsuccessful', () => {
-    const mockDate = new Date('2020-01-01')
-    jest
-      .spyOn(uploadZipSpecification, 'validateRootDirectory')
-      .mockReturnValue()
-    jest
-      .spyOn(uploadZipSpecification, 'getUploadZipSpecification')
-      .mockReturnValue([
-        {
-          sourcePath: '/home/user/files/plz-upload/file1.txt',
-          destinationPath: 'file1.txt'
-        },
-        {
-          sourcePath: '/home/user/files/plz-upload/file2.txt',
-          destinationPath: 'file2.txt'
-        },
-        {
-          sourcePath: '/home/user/files/plz-upload/dir/file3.txt',
-          destinationPath: 'dir/file3.txt'
-        }
-      ])
-
+  it('should return false if blob storage upload is unsuccessful', async () => {
     jest
       .spyOn(zip, 'createZipUploadStream')
       .mockReturnValue(Promise.resolve(new zip.ZipUploadStream(1)))
-    jest.spyOn(util, 'getBackendIdsFromToken').mockReturnValue({
-      workflowRunBackendId: '1234',
-      workflowJobRunBackendId: '5678'
-    })
-    jest
-      .spyOn(retention, 'getExpiration')
-      .mockReturnValue(Timestamp.fromDate(mockDate))
     jest
       .spyOn(ArtifactServiceClientJSON.prototype, 'CreateArtifact')
       .mockReturnValue(
@@ -264,57 +180,19 @@ describe('upload-artifact', () => {
       .spyOn(blobUpload, 'uploadZipToBlobStorage')
       .mockReturnValue(Promise.reject(new Error('boom')))
 
-    // ArtifactHttpClient mocks
-    jest.spyOn(config, 'getRuntimeToken').mockReturnValue('test-token')
-    jest
-      .spyOn(config, 'getResultsServiceUrl')
-      .mockReturnValue('https://test-url.com')
-
     const uploadResp = uploadArtifact(
-      'test-artifact',
-      [
-        '/home/user/files/plz-upload/file1.txt',
-        '/home/user/files/plz-upload/file2.txt',
-        '/home/user/files/plz-upload/dir/file3.txt'
-      ],
-      '/home/user/files/plz-upload'
+      fixtures.inputs.artifactName,
+      fixtures.inputs.files,
+      fixtures.inputs.rootDirectory
     )
 
-    expect(uploadResp).rejects.toThrow()
+    await expect(uploadResp).rejects.toThrow()
   })
 
-  it('should reject if finalize artifact fails', () => {
-    const mockDate = new Date('2020-01-01')
-    jest
-      .spyOn(uploadZipSpecification, 'validateRootDirectory')
-      .mockReturnValue()
-    jest
-      .spyOn(uploadZipSpecification, 'getUploadZipSpecification')
-      .mockReturnValue([
-        {
-          sourcePath: '/home/user/files/plz-upload/file1.txt',
-          destinationPath: 'file1.txt'
-        },
-        {
-          sourcePath: '/home/user/files/plz-upload/file2.txt',
-          destinationPath: 'file2.txt'
-        },
-        {
-          sourcePath: '/home/user/files/plz-upload/dir/file3.txt',
-          destinationPath: 'dir/file3.txt'
-        }
-      ])
-
+  it('should reject if finalize artifact fails', async () => {
     jest
       .spyOn(zip, 'createZipUploadStream')
       .mockReturnValue(Promise.resolve(new zip.ZipUploadStream(1)))
-    jest.spyOn(util, 'getBackendIdsFromToken').mockReturnValue({
-      workflowRunBackendId: '1234',
-      workflowJobRunBackendId: '5678'
-    })
-    jest
-      .spyOn(retention, 'getExpiration')
-      .mockReturnValue(Timestamp.fromDate(mockDate))
     jest
       .spyOn(ArtifactServiceClientJSON.prototype, 'CreateArtifact')
       .mockReturnValue(
@@ -333,22 +211,161 @@ describe('upload-artifact', () => {
       .spyOn(ArtifactServiceClientJSON.prototype, 'FinalizeArtifact')
       .mockReturnValue(Promise.resolve({ok: false, artifactId: ''}))
 
-    // ArtifactHttpClient mocks
-    jest.spyOn(config, 'getRuntimeToken').mockReturnValue('test-token')
-    jest
-      .spyOn(config, 'getResultsServiceUrl')
-      .mockReturnValue('https://test-url.com')
-
     const uploadResp = uploadArtifact(
-      'test-artifact',
-      [
-        '/home/user/files/plz-upload/file1.txt',
-        '/home/user/files/plz-upload/file2.txt',
-        '/home/user/files/plz-upload/dir/file3.txt'
-      ],
-      '/home/user/files/plz-upload'
+      fixtures.inputs.artifactName,
+      fixtures.inputs.files,
+      fixtures.inputs.rootDirectory
     )
 
-    expect(uploadResp).rejects.toThrow()
+    await expect(uploadResp).rejects.toThrow()
+  })
+
+  it('should successfully upload an artifact', async () => {
+    jest
+      .spyOn(uploadZipSpecification, 'getUploadZipSpecification')
+      .mockRestore()
+
+    jest
+      .spyOn(ArtifactServiceClientJSON.prototype, 'CreateArtifact')
+      .mockReturnValue(
+        Promise.resolve({
+          ok: true,
+          signedUploadUrl: 'https://signed-upload-url.local'
+        })
+      )
+    jest
+      .spyOn(ArtifactServiceClientJSON.prototype, 'FinalizeArtifact')
+      .mockReturnValue(
+        Promise.resolve({
+          ok: true,
+          artifactId: '1'
+        })
+      )
+
+    let loadedBytes = 0
+    const uploadedZip = path.join(
+      fixtures.uploadDirectory,
+      '..',
+      'uploaded.zip'
+    )
+    uploadStreamMock.mockImplementation(
+      async (
+        stream: NodeJS.ReadableStream,
+        bufferSize?: number,
+        maxConcurrency?: number,
+        options?: BlockBlobUploadStreamOptions
+      ) => {
+        const {onProgress} = options || {}
+
+        if (fs.existsSync(uploadedZip)) {
+          fs.unlinkSync(uploadedZip)
+        }
+        const uploadedZipStream = fs.createWriteStream(uploadedZip)
+
+        onProgress?.({loadedBytes: 0})
+        return new Promise((resolve, reject) => {
+          stream.on('data', chunk => {
+            loadedBytes += chunk.length
+            uploadedZipStream.write(chunk)
+            onProgress?.({loadedBytes})
+          })
+          stream.on('end', () => {
+            onProgress?.({loadedBytes})
+            uploadedZipStream.end()
+            resolve({})
+          })
+          stream.on('error', err => {
+            reject(err)
+          })
+        })
+      }
+    )
+
+    const {id, size} = await uploadArtifact(
+      fixtures.inputs.artifactName,
+      fixtures.files.map(file =>
+        path.join(fixtures.uploadDirectory, file.name)
+      ),
+      fixtures.uploadDirectory
+    )
+
+    expect(id).toBe(1)
+    expect(size).toBe(loadedBytes)
+
+    const extractedDirectory = path.join(
+      fixtures.uploadDirectory,
+      '..',
+      'extracted'
+    )
+    if (fs.existsSync(extractedDirectory)) {
+      fs.rmdirSync(extractedDirectory, {recursive: true})
+    }
+
+    const extract = new Promise((resolve, reject) => {
+      fs.createReadStream(uploadedZip)
+        .pipe(unzip.Extract({path: extractedDirectory}))
+        .on('close', () => {
+          resolve(true)
+        })
+        .on('error', err => {
+          reject(err)
+        })
+    })
+
+    await expect(extract).resolves.toBe(true)
+    for (const file of fixtures.files) {
+      const filePath = path.join(extractedDirectory, file.name)
+      expect(fs.existsSync(filePath)).toBe(true)
+      expect(fs.readFileSync(filePath, 'utf8')).toBe(file.content)
+    }
+  })
+
+  it('should throw an error uploading blob chunks get delayed', async () => {
+    jest
+      .spyOn(ArtifactServiceClientJSON.prototype, 'CreateArtifact')
+      .mockReturnValue(
+        Promise.resolve({
+          ok: true,
+          signedUploadUrl: 'https://signed-upload-url.local'
+        })
+      )
+    jest
+      .spyOn(ArtifactServiceClientJSON.prototype, 'FinalizeArtifact')
+      .mockReturnValue(
+        Promise.resolve({
+          ok: true,
+          artifactId: '1'
+        })
+      )
+    jest
+      .spyOn(config, 'getResultsServiceUrl')
+      .mockReturnValue('https://results.local')
+
+    jest.spyOn(config, 'getUploadChunkTimeout').mockReturnValue(2_000)
+
+    uploadStreamMock.mockImplementation(
+      async (
+        stream: NodeJS.ReadableStream,
+        bufferSize?: number,
+        maxConcurrency?: number,
+        options?: BlockBlobUploadStreamOptions
+      ) => {
+        const {onProgress, abortSignal} = options || {}
+        onProgress?.({loadedBytes: 0})
+        return new Promise(resolve => {
+          abortSignal?.addEventListener('abort', () => {
+            resolve({})
+          })
+        })
+      }
+    )
+
+    const uploadResp = uploadArtifact(
+      fixtures.inputs.artifactName,
+      fixtures.inputs.files,
+      fixtures.inputs.rootDirectory
+    )
+
+    await expect(uploadResp).rejects.toThrow('Upload progress stalled.')
   })
 })

packages/artifact/__tests__/upload-zip-specification.test.ts

@@ -305,4 +305,22 @@ describe('Search', () => {
       }
     }
   })
+
+  it('Upload Specification - Includes symlinks', async () => {
+    const targetPath = path.join(root, 'link-dir', 'symlink-me.txt')
+    await fs.mkdir(path.dirname(targetPath), {recursive: true})
+    await fs.writeFile(targetPath, 'symlink file content')
+
+    const uploadPath = path.join(root, 'upload-dir', 'symlink.txt')
+    await fs.mkdir(path.dirname(uploadPath), {recursive: true})
+    await fs.symlink(targetPath, uploadPath, 'file')
+
+    const specifications = getUploadZipSpecification([uploadPath], root)
+    expect(specifications.length).toEqual(1)
+    expect(specifications[0].sourcePath).toEqual(uploadPath)
+    expect(specifications[0].destinationPath).toEqual(
+      path.join('/upload-dir', 'symlink.txt')
+    )
+    expect(specifications[0].stats.isSymbolicLink()).toBe(true)
+  })
 })

packages/artifact/docs/faq.md

@@ -3,6 +3,8 @@
 - [Frequently Asked Questions](#frequently-asked-questions)
   - [Supported Characters](#supported-characters)
   - [Compression? ZIP? How is my artifact stored?](#compression-zip-how-is-my-artifact-stored)
+  - [Which versions of the artifacts packages are compatible?](#which-versions-of-the-artifacts-packages-are-compatible)
+  - [How long will my artifact be available?](#how-long-will-my-artifact-be-available)
 
 ## Supported Characters
 
@@ -33,3 +35,28 @@ The value can range from 0 to 9:
 
 Higher levels will result in better compression, but will take longer to complete.
 For large files that are not easily compressed, a value of 0 is recommended for significantly faster uploads.
+
+## Which versions of the artifacts packages are compatible?
+[actions/upload-artifact](https://github.com/actions/upload-artifact) and [actions/download-artifact](https://github.com/actions/download-artifact), leverage [GitHub Actions toolkit](https://github.com/actions/toolkit) and are typically used together to upload and download artifacts in your workflows.
+
+| upload-artifact | download-artifact | toolkit |
+|---|---|---|
+| v4 | v4 | v2 |
+| < v3 | < v3 | < v1 |
+
+Use matching versions of `actions/upload-artifact` and `actions/download-artifact` to ensure compatibility.
+
+In your GitHub Actions workflow YAML file, you specify the version of the actions you want to use. For example:
+
+```yaml
+  uses: actions/upload-artifact@v4
+  # ...
+  uses: actions/download-artifact@v4
+  # ...
+```
+
+**Release Notes:**
+Check the release notes for each repository to see if there are any specific notes about compatibility or changes in behavior.
+
+## How long will my artifact be available?
+The default retention period is **90 days**. For more information, visit: https://github.com/actions/upload-artifact?tab=readme-ov-file#retention-period 

packages/artifact/docs/generated/README.md

@@ -11,11 +11,14 @@
 - [FilesNotFoundError](classes/FilesNotFoundError.md)
 - [GHESNotSupportedError](classes/GHESNotSupportedError.md)
 - [InvalidResponseError](classes/InvalidResponseError.md)
+- [NetworkError](classes/NetworkError.md)
+- [UsageError](classes/UsageError.md)
 
 ### Interfaces
 
 - [Artifact](interfaces/Artifact.md)
 - [ArtifactClient](interfaces/ArtifactClient.md)
+- [DeleteArtifactResponse](interfaces/DeleteArtifactResponse.md)
 - [DownloadArtifactOptions](interfaces/DownloadArtifactOptions.md)
 - [DownloadArtifactResponse](interfaces/DownloadArtifactResponse.md)
 - [FindOptions](interfaces/FindOptions.md)
@@ -37,4 +40,4 @@
 
 #### Defined in
 
-[src/artifact.ts:7](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/artifact.ts#L7)
+[src/artifact.ts:7](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/artifact.ts#L7)

packages/artifact/docs/generated/classes/ArtifactNotFoundError.md

@@ -48,7 +48,7 @@ Error.constructor
 
 #### Defined in
 
-[src/internal/shared/errors.ts:24](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/shared/errors.ts#L24)
+[src/internal/shared/errors.ts:24](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/shared/errors.ts#L24)
 
 ## Properties
 

packages/artifact/docs/generated/classes/DefaultArtifactClient.md

@@ -16,6 +16,7 @@ The default artifact client that is used by the artifact action(s).
 
 ### Methods
 
+- [deleteArtifact](DefaultArtifactClient.md#deleteartifact)
 - [downloadArtifact](DefaultArtifactClient.md#downloadartifact)
 - [getArtifact](DefaultArtifactClient.md#getartifact)
 - [listArtifacts](DefaultArtifactClient.md#listartifacts)
@@ -33,6 +34,37 @@ The default artifact client that is used by the artifact action(s).
 
 ## Methods
 
+### deleteArtifact
+
+▸ **deleteArtifact**(`artifactName`, `options?`): `Promise`\<[`DeleteArtifactResponse`](../interfaces/DeleteArtifactResponse.md)\>
+
+Delete an Artifact
+
+If `options.findBy` is specified, this will use the public Delete Artifact API https://docs.github.com/en/rest/actions/artifacts?apiVersion=2022-11-28#delete-an-artifact
+
+#### Parameters
+
+| Name | Type | Description |
+| :------ | :------ | :------ |
+| `artifactName` | `string` | The name of the artifact to delete |
+| `options?` | [`FindOptions`](../interfaces/FindOptions.md) | Extra options that allow for the customization of the delete behavior |
+
+#### Returns
+
+`Promise`\<[`DeleteArtifactResponse`](../interfaces/DeleteArtifactResponse.md)\>
+
+single DeleteArtifactResponse object
+
+#### Implementation of
+
+[ArtifactClient](../interfaces/ArtifactClient.md).[deleteArtifact](../interfaces/ArtifactClient.md#deleteartifact)
+
+#### Defined in
+
+[src/internal/client.ts:248](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/client.ts#L248)
+
+___
+
 ### downloadArtifact
 
 ▸ **downloadArtifact**(`artifactId`, `options?`): `Promise`\<[`DownloadArtifactResponse`](../interfaces/DownloadArtifactResponse.md)\>
@@ -45,7 +77,7 @@ If `options.findBy` is specified, this will use the public Download Artifact API
 
 | Name | Type | Description |
 | :------ | :------ | :------ |
-| `artifactId` | `number` | The name of the artifact to download |
+| `artifactId` | `number` | The id of the artifact to download |
 | `options?` | [`DownloadArtifactOptions`](../interfaces/DownloadArtifactOptions.md) & [`FindOptions`](../interfaces/FindOptions.md) | Extra options that allow for the customization of the download behavior |
 
 #### Returns
@@ -60,7 +92,7 @@ single DownloadArtifactResponse object
 
 #### Defined in
 
-[src/internal/client.ts:119](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/client.ts#L119)
+[src/internal/client.ts:138](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/client.ts#L138)
 
 ___
 
@@ -95,7 +127,7 @@ If there are multiple artifacts with the same name in the same workflow run this
 
 #### Defined in
 
-[src/internal/client.ts:193](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/client.ts#L193)
+[src/internal/client.ts:212](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/client.ts#L212)
 
 ___
 
@@ -127,7 +159,7 @@ ListArtifactResponse object
 
 #### Defined in
 
-[src/internal/client.ts:157](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/client.ts#L157)
+[src/internal/client.ts:176](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/client.ts#L176)
 
 ___
 
@@ -158,4 +190,4 @@ single UploadArtifactResponse object
 
 #### Defined in
 
-[src/internal/client.ts:94](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/client.ts#L94)
+[src/internal/client.ts:113](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/client.ts#L113)

packages/artifact/docs/generated/classes/FilesNotFoundError.md

@@ -49,7 +49,7 @@ Error.constructor
 
 #### Defined in
 
-[src/internal/shared/errors.ts:4](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/shared/errors.ts#L4)
+[src/internal/shared/errors.ts:4](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/shared/errors.ts#L4)
 
 ## Properties
 
@@ -59,7 +59,7 @@ Error.constructor
 
 #### Defined in
 
-[src/internal/shared/errors.ts:2](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/shared/errors.ts#L2)
+[src/internal/shared/errors.ts:2](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/shared/errors.ts#L2)
 
 ___
 

packages/artifact/docs/generated/classes/GHESNotSupportedError.md

@@ -48,7 +48,7 @@ Error.constructor
 
 #### Defined in
 
-[src/internal/shared/errors.ts:31](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/shared/errors.ts#L31)
+[src/internal/shared/errors.ts:31](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/shared/errors.ts#L31)
 
 ## Properties
 

packages/artifact/docs/generated/classes/InvalidResponseError.md

@@ -48,7 +48,7 @@ Error.constructor
 
 #### Defined in
 
-[src/internal/shared/errors.ts:17](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/shared/errors.ts#L17)
+[src/internal/shared/errors.ts:17](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/shared/errors.ts#L17)
 
 ## Properties
 

packages/artifact/docs/generated/classes/NetworkError.md

@@ -0,0 +1,201 @@
+[@actions/artifact](../README.md) / NetworkError
+
+# Class: NetworkError
+
+## Hierarchy
+
+- `Error`
+
+  ↳ **`NetworkError`**
+
+## Table of contents
+
+### Constructors
+
+- [constructor](NetworkError.md#constructor)
+
+### Properties
+
+- [code](NetworkError.md#code)
+- [message](NetworkError.md#message)
+- [name](NetworkError.md#name)
+- [stack](NetworkError.md#stack)
+- [prepareStackTrace](NetworkError.md#preparestacktrace)
+- [stackTraceLimit](NetworkError.md#stacktracelimit)
+
+### Methods
+
+- [captureStackTrace](NetworkError.md#capturestacktrace)
+- [isNetworkErrorCode](NetworkError.md#isnetworkerrorcode)
+
+## Constructors
+
+### constructor
+
+• **new NetworkError**(`code`): [`NetworkError`](NetworkError.md)
+
+#### Parameters
+
+| Name | Type |
+| :------ | :------ |
+| `code` | `string` |
+
+#### Returns
+
+[`NetworkError`](NetworkError.md)
+
+#### Overrides
+
+Error.constructor
+
+#### Defined in
+
+[src/internal/shared/errors.ts:42](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/shared/errors.ts#L42)
+
+## Properties
+
+### code
+
+• **code**: `string`
+
+#### Defined in
+
+[src/internal/shared/errors.ts:40](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/shared/errors.ts#L40)
+
+___
+
+### message
+
+• **message**: `string`
+
+#### Inherited from
+
+Error.message
+
+#### Defined in
+
+node_modules/typescript/lib/lib.es5.d.ts:1068
+
+___
+
+### name
+
+• **name**: `string`
+
+#### Inherited from
+
+Error.name
+
+#### Defined in
+
+node_modules/typescript/lib/lib.es5.d.ts:1067
+
+___
+
+### stack
+
+• `Optional` **stack**: `string`
+
+#### Inherited from
+
+Error.stack
+
+#### Defined in
+
+node_modules/typescript/lib/lib.es5.d.ts:1069
+
+___
+
+### prepareStackTrace
+
+▪ `Static` `Optional` **prepareStackTrace**: (`err`: `Error`, `stackTraces`: `CallSite`[]) => `any`
+
+#### Type declaration
+
+▸ (`err`, `stackTraces`): `any`
+
+Optional override for formatting stack traces
+
+##### Parameters
+
+| Name | Type |
+| :------ | :------ |
+| `err` | `Error` |
+| `stackTraces` | `CallSite`[] |
+
+##### Returns
+
+`any`
+
+**`See`**
+
+https://v8.dev/docs/stack-trace-api#customizing-stack-traces
+
+#### Inherited from
+
+Error.prepareStackTrace
+
+#### Defined in
+
+node_modules/@types/node/globals.d.ts:11
+
+___
+
+### stackTraceLimit
+
+▪ `Static` **stackTraceLimit**: `number`
+
+#### Inherited from
+
+Error.stackTraceLimit
+
+#### Defined in
+
+node_modules/@types/node/globals.d.ts:13
+
+## Methods
+
+### captureStackTrace
+
+▸ **captureStackTrace**(`targetObject`, `constructorOpt?`): `void`
+
+Create .stack property on a target object
+
+#### Parameters
+
+| Name | Type |
+| :------ | :------ |
+| `targetObject` | `object` |
+| `constructorOpt?` | `Function` |
+
+#### Returns
+
+`void`
+
+#### Inherited from
+
+Error.captureStackTrace
+
+#### Defined in
+
+node_modules/@types/node/globals.d.ts:4
+
+___
+
+### isNetworkErrorCode
+
+▸ **isNetworkErrorCode**(`code?`): `boolean`
+
+#### Parameters
+
+| Name | Type |
+| :------ | :------ |
+| `code?` | `string` |
+
+#### Returns
+
+`boolean`
+
+#### Defined in
+
+[src/internal/shared/errors.ts:49](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/shared/errors.ts#L49)

packages/artifact/docs/generated/classes/UsageError.md

@@ -0,0 +1,184 @@
+[@actions/artifact](../README.md) / UsageError
+
+# Class: UsageError
+
+## Hierarchy
+
+- `Error`
+
+  ↳ **`UsageError`**
+
+## Table of contents
+
+### Constructors
+
+- [constructor](UsageError.md#constructor)
+
+### Properties
+
+- [message](UsageError.md#message)
+- [name](UsageError.md#name)
+- [stack](UsageError.md#stack)
+- [prepareStackTrace](UsageError.md#preparestacktrace)
+- [stackTraceLimit](UsageError.md#stacktracelimit)
+
+### Methods
+
+- [captureStackTrace](UsageError.md#capturestacktrace)
+- [isUsageErrorMessage](UsageError.md#isusageerrormessage)
+
+## Constructors
+
+### constructor
+
+• **new UsageError**(): [`UsageError`](UsageError.md)
+
+#### Returns
+
+[`UsageError`](UsageError.md)
+
+#### Overrides
+
+Error.constructor
+
+#### Defined in
+
+[src/internal/shared/errors.ts:62](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/shared/errors.ts#L62)
+
+## Properties
+
+### message
+
+• **message**: `string`
+
+#### Inherited from
+
+Error.message
+
+#### Defined in
+
+node_modules/typescript/lib/lib.es5.d.ts:1068
+
+___
+
+### name
+
+• **name**: `string`
+
+#### Inherited from
+
+Error.name
+
+#### Defined in
+
+node_modules/typescript/lib/lib.es5.d.ts:1067
+
+___
+
+### stack
+
+• `Optional` **stack**: `string`
+
+#### Inherited from
+
+Error.stack
+
+#### Defined in
+
+node_modules/typescript/lib/lib.es5.d.ts:1069
+
+___
+
+### prepareStackTrace
+
+▪ `Static` `Optional` **prepareStackTrace**: (`err`: `Error`, `stackTraces`: `CallSite`[]) => `any`
+
+#### Type declaration
+
+▸ (`err`, `stackTraces`): `any`
+
+Optional override for formatting stack traces
+
+##### Parameters
+
+| Name | Type |
+| :------ | :------ |
+| `err` | `Error` |
+| `stackTraces` | `CallSite`[] |
+
+##### Returns
+
+`any`
+
+**`See`**
+
+https://v8.dev/docs/stack-trace-api#customizing-stack-traces
+
+#### Inherited from
+
+Error.prepareStackTrace
+
+#### Defined in
+
+node_modules/@types/node/globals.d.ts:11
+
+___
+
+### stackTraceLimit
+
+▪ `Static` **stackTraceLimit**: `number`
+
+#### Inherited from
+
+Error.stackTraceLimit
+
+#### Defined in
+
+node_modules/@types/node/globals.d.ts:13
+
+## Methods
+
+### captureStackTrace
+
+▸ **captureStackTrace**(`targetObject`, `constructorOpt?`): `void`
+
+Create .stack property on a target object
+
+#### Parameters
+
+| Name | Type |
+| :------ | :------ |
+| `targetObject` | `object` |
+| `constructorOpt?` | `Function` |
+
+#### Returns
+
+`void`
+
+#### Inherited from
+
+Error.captureStackTrace
+
+#### Defined in
+
+node_modules/@types/node/globals.d.ts:4
+
+___
+
+### isUsageErrorMessage
+
+▸ **isUsageErrorMessage**(`msg?`): `boolean`
+
+#### Parameters
+
+| Name | Type |
+| :------ | :------ |
+| `msg?` | `string` |
+
+#### Returns
+
+`boolean`
+
+#### Defined in
+
+[src/internal/shared/errors.ts:68](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/shared/errors.ts#L68)

packages/artifact/docs/generated/interfaces/Artifact.md

@@ -23,7 +23,7 @@ The time when the artifact was created
 
 #### Defined in
 
-[src/internal/shared/interfaces.ts:123](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/shared/interfaces.ts#L123)
+[src/internal/shared/interfaces.ts:123](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/shared/interfaces.ts#L123)
 
 ___
 
@@ -35,7 +35,7 @@ The ID of the artifact
 
 #### Defined in
 
-[src/internal/shared/interfaces.ts:113](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/shared/interfaces.ts#L113)
+[src/internal/shared/interfaces.ts:113](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/shared/interfaces.ts#L113)
 
 ___
 
@@ -47,7 +47,7 @@ The name of the artifact
 
 #### Defined in
 
-[src/internal/shared/interfaces.ts:108](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/shared/interfaces.ts#L108)
+[src/internal/shared/interfaces.ts:108](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/shared/interfaces.ts#L108)
 
 ___
 
@@ -59,4 +59,4 @@ The size of the artifact in bytes
 
 #### Defined in
 
-[src/internal/shared/interfaces.ts:118](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/shared/interfaces.ts#L118)
+[src/internal/shared/interfaces.ts:118](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/shared/interfaces.ts#L118)

packages/artifact/docs/generated/interfaces/ArtifactClient.md

@@ -12,6 +12,7 @@ Generic interface for the artifact client.
 
 ### Methods
 
+- [deleteArtifact](ArtifactClient.md#deleteartifact)
 - [downloadArtifact](ArtifactClient.md#downloadartifact)
 - [getArtifact](ArtifactClient.md#getartifact)
 - [listArtifacts](ArtifactClient.md#listartifacts)
@@ -19,6 +20,33 @@ Generic interface for the artifact client.
 
 ## Methods
 
+### deleteArtifact
+
+▸ **deleteArtifact**(`artifactName`, `options?`): `Promise`\<[`DeleteArtifactResponse`](DeleteArtifactResponse.md)\>
+
+Delete an Artifact
+
+If `options.findBy` is specified, this will use the public Delete Artifact API https://docs.github.com/en/rest/actions/artifacts?apiVersion=2022-11-28#delete-an-artifact
+
+#### Parameters
+
+| Name | Type | Description |
+| :------ | :------ | :------ |
+| `artifactName` | `string` | The name of the artifact to delete |
+| `options?` | [`FindOptions`](FindOptions.md) | Extra options that allow for the customization of the delete behavior |
+
+#### Returns
+
+`Promise`\<[`DeleteArtifactResponse`](DeleteArtifactResponse.md)\>
+
+single DeleteArtifactResponse object
+
+#### Defined in
+
+[src/internal/client.ts:103](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/client.ts#L103)
+
+___
+
 ### downloadArtifact
 
 ▸ **downloadArtifact**(`artifactId`, `options?`): `Promise`\<[`DownloadArtifactResponse`](DownloadArtifactResponse.md)\>
@@ -31,7 +59,7 @@ If `options.findBy` is specified, this will use the public Download Artifact API
 
 | Name | Type | Description |
 | :------ | :------ | :------ |
-| `artifactId` | `number` | The name of the artifact to download |
+| `artifactId` | `number` | The id of the artifact to download |
 | `options?` | [`DownloadArtifactOptions`](DownloadArtifactOptions.md) & [`FindOptions`](FindOptions.md) | Extra options that allow for the customization of the download behavior |
 
 #### Returns
@@ -42,7 +70,7 @@ single DownloadArtifactResponse object
 
 #### Defined in
 
-[src/internal/client.ts:84](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/client.ts#L84)
+[src/internal/client.ts:89](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/client.ts#L89)
 
 ___
 
@@ -73,7 +101,7 @@ If there are multiple artifacts with the same name in the same workflow run this
 
 #### Defined in
 
-[src/internal/client.ts:70](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/client.ts#L70)
+[src/internal/client.ts:75](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/client.ts#L75)
 
 ___
 
@@ -101,7 +129,7 @@ ListArtifactResponse object
 
 #### Defined in
 
-[src/internal/client.ts:52](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/client.ts#L52)
+[src/internal/client.ts:57](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/client.ts#L57)
 
 ___
 
@@ -128,4 +156,4 @@ single UploadArtifactResponse object
 
 #### Defined in
 
-[src/internal/client.ts:35](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/client.ts#L35)
+[src/internal/client.ts:40](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/client.ts#L40)

packages/artifact/docs/generated/interfaces/DeleteArtifactResponse.md

@@ -0,0 +1,23 @@
+[@actions/artifact](../README.md) / DeleteArtifactResponse
+
+# Interface: DeleteArtifactResponse
+
+Response from the server when deleting an artifact
+
+## Table of contents
+
+### Properties
+
+- [id](DeleteArtifactResponse.md#id)
+
+## Properties
+
+### id
+
+• **id**: `number`
+
+The id of the artifact that was deleted
+
+#### Defined in
+
+[src/internal/shared/interfaces.ts:158](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/shared/interfaces.ts#L158)

packages/artifact/docs/generated/interfaces/DownloadArtifactOptions.md

@@ -20,4 +20,4 @@ Denotes where the artifact will be downloaded to. If not specified then the arti
 
 #### Defined in
 
-[src/internal/shared/interfaces.ts:98](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/shared/interfaces.ts#L98)
+[src/internal/shared/interfaces.ts:98](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/shared/interfaces.ts#L98)

packages/artifact/docs/generated/interfaces/DownloadArtifactResponse.md

@@ -20,4 +20,4 @@ The path where the artifact was downloaded to
 
 #### Defined in
 
-[src/internal/shared/interfaces.ts:88](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/shared/interfaces.ts#L88)
+[src/internal/shared/interfaces.ts:88](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/shared/interfaces.ts#L88)

packages/artifact/docs/generated/interfaces/FindOptions.md

@@ -27,4 +27,4 @@ The criteria for finding Artifact(s) out of the scope of the current run.
 
 #### Defined in
 
-[src/internal/shared/interfaces.ts:131](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/shared/interfaces.ts#L131)
+[src/internal/shared/interfaces.ts:131](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/shared/interfaces.ts#L131)

packages/artifact/docs/generated/interfaces/GetArtifactResponse.md

@@ -20,4 +20,4 @@ Metadata about the artifact that was found
 
 #### Defined in
 
-[src/internal/shared/interfaces.ts:57](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/shared/interfaces.ts#L57)
+[src/internal/shared/interfaces.ts:57](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/shared/interfaces.ts#L57)

packages/artifact/docs/generated/interfaces/ListArtifactsOptions.md

@@ -21,4 +21,4 @@ In the case of reruns, this can be useful to avoid duplicates
 
 #### Defined in
 
-[src/internal/shared/interfaces.ts:68](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/shared/interfaces.ts#L68)
+[src/internal/shared/interfaces.ts:68](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/shared/interfaces.ts#L68)

packages/artifact/docs/generated/interfaces/ListArtifactsResponse.md

@@ -20,4 +20,4 @@ A list of artifacts that were found
 
 #### Defined in
 
-[src/internal/shared/interfaces.ts:78](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/shared/interfaces.ts#L78)
+[src/internal/shared/interfaces.ts:78](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/shared/interfaces.ts#L78)

packages/artifact/docs/generated/interfaces/UploadArtifactOptions.md

@@ -28,7 +28,7 @@ For large files that are not easily compressed, a value of 0 is recommended for
 
 #### Defined in
 
-[src/internal/shared/interfaces.ts:47](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/shared/interfaces.ts#L47)
+[src/internal/shared/interfaces.ts:47](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/shared/interfaces.ts#L47)
 
 ___
 
@@ -52,4 +52,4 @@ input of 0 assumes default retention setting.
 
 #### Defined in
 
-[src/internal/shared/interfaces.ts:36](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/shared/interfaces.ts#L36)
+[src/internal/shared/interfaces.ts:36](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/shared/interfaces.ts#L36)

packages/artifact/docs/generated/interfaces/UploadArtifactResponse.md

@@ -22,7 +22,7 @@ This ID can be used as input to other APIs to download, delete or get more infor
 
 #### Defined in
 
-[src/internal/shared/interfaces.ts:14](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/shared/interfaces.ts#L14)
+[src/internal/shared/interfaces.ts:14](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/shared/interfaces.ts#L14)
 
 ___
 
@@ -34,4 +34,4 @@ Total size of the artifact in bytes. Not provided if no artifact was uploaded
 
 #### Defined in
 
-[src/internal/shared/interfaces.ts:8](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/shared/interfaces.ts#L8)
+[src/internal/shared/interfaces.ts:8](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/shared/interfaces.ts#L8)

packages/artifact/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@actions/artifact",
-  "version": "2.0.1",
+  "version": "2.1.11",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@actions/artifact",
-      "version": "2.0.1",
+      "version": "2.1.11",
       "license": "MIT",
       "dependencies": {
         "@actions/core": "^1.10.0",
@@ -18,8 +18,7 @@
         "@octokit/plugin-retry": "^3.0.9",
         "@octokit/request-error": "^5.0.0",
         "@protobuf-ts/plugin": "^2.2.3-alpha.1",
-        "archiver": "^5.3.1",
-        "crypto": "^1.0.1",
+        "archiver": "^7.0.1",
         "jwt-decode": "^3.1.2",
         "twirp-ts": "^2.5.0",
         "unzip-stream": "^0.3.1"
@@ -186,6 +185,22 @@
         "node": ">=14.0.0"
       }
     },
+    "node_modules/@isaacs/cliui": {
+      "version": "8.0.2",
+      "resolved": "https://registry.npmjs.org/@isaacs/cliui/-/cliui-8.0.2.tgz",
+      "integrity": "sha512-O8jcjabXaleOG9DQ0+ARXWZBTfnP4WNAqzuiJK7ll44AmxGKv/J2M4TPjxjY3znBCfvBXFzucm1twdyFybFqEA==",
+      "dependencies": {
+        "string-width": "^5.1.2",
+        "string-width-cjs": "npm:string-width@^4.2.0",
+        "strip-ansi": "^7.0.1",
+        "strip-ansi-cjs": "npm:strip-ansi@^6.0.1",
+        "wrap-ansi": "^8.1.0",
+        "wrap-ansi-cjs": "npm:wrap-ansi@^7.0.0"
+      },
+      "engines": {
+        "node": ">=12"
+      }
+    },
     "node_modules/@octokit/auth-token": {
       "version": "2.5.0",
       "resolved": "https://registry.npmjs.org/@octokit/auth-token/-/auth-token-2.5.0.tgz",
@@ -348,6 +363,15 @@
         "node": ">=8.0.0"
       }
     },
+    "node_modules/@pkgjs/parseargs": {
+      "version": "0.11.0",
+      "resolved": "https://registry.npmjs.org/@pkgjs/parseargs/-/parseargs-0.11.0.tgz",
+      "integrity": "sha512-+1VkjdD0QBLPodGrJUeqarH8VAIvQODIbwh9XpP5Syisf7YoQgsJKPNFoqqLQlu+VQ/tVSshMR6loPMn8U+dPg==",
+      "optional": true,
+      "engines": {
+        "node": ">=14"
+      }
+    },
     "node_modules/@protobuf-ts/plugin": {
       "version": "2.9.1",
       "resolved": "https://registry.npmjs.org/@protobuf-ts/plugin/-/plugin-2.9.1.tgz",
@@ -480,74 +504,120 @@
         "@types/node": "*"
       }
     },
+    "node_modules/abort-controller": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/abort-controller/-/abort-controller-3.0.0.tgz",
+      "integrity": "sha512-h8lQ8tacZYnR3vNQTgibj+tODHI5/+l06Au2Pcriv/Gmet0eaj4TwWH41sO9wnHDiQsEj19q0drzdWdeAHtweg==",
+      "dependencies": {
+        "event-target-shim": "^5.0.0"
+      },
+      "engines": {
+        "node": ">=6.5"
+      }
+    },
+    "node_modules/ansi-regex": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.0.1.tgz",
+      "integrity": "sha512-n5M855fKb2SsfMIiFFoVrABHJC8QtHwVx+mHWP3QcEqBHYienj5dHSgjbxtC0WEZXYt4wcD6zrQElDPhFuZgfA==",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-regex?sponsor=1"
+      }
+    },
     "node_modules/ansi-sequence-parser": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/ansi-sequence-parser/-/ansi-sequence-parser-1.1.1.tgz",
       "integrity": "sha512-vJXt3yiaUL4UU546s3rPXlsry/RnM730G1+HkpKE012AN0sx1eOrxSu95oKDIonskeLTijMgqWZ3uDEe3NFvyg==",
       "dev": true
     },
+    "node_modules/ansi-styles": {
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-6.2.1.tgz",
+      "integrity": "sha512-bN798gFfQX+viw3R7yrGWRqnrN2oRkEkUjjl4JNn4E8GxxbjtG3FbrEIIY3l8/hrwUwIeCZvi4QuOTP4MErVug==",
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
     "node_modules/archiver": {
-      "version": "5.3.1",
-      "resolved": "https://registry.npmjs.org/archiver/-/archiver-5.3.1.tgz",
-      "integrity": "sha512-8KyabkmbYrH+9ibcTScQ1xCJC/CGcugdVIwB+53f5sZziXgwUh3iXlAlANMxcZyDEfTHMe6+Z5FofV8nopXP7w==",
+      "version": "7.0.1",
+      "resolved": "https://registry.npmjs.org/archiver/-/archiver-7.0.1.tgz",
+      "integrity": "sha512-ZcbTaIqJOfCc03QwD468Unz/5Ir8ATtvAHsK+FdXbDIbGfihqh9mrvdcYunQzqn4HrvWWaFyaxJhGZagaJJpPQ==",
       "dependencies": {
-        "archiver-utils": "^2.1.0",
-        "async": "^3.2.3",
-        "buffer-crc32": "^0.2.1",
-        "readable-stream": "^3.6.0",
-        "readdir-glob": "^1.0.0",
-        "tar-stream": "^2.2.0",
-        "zip-stream": "^4.1.0"
+        "archiver-utils": "^5.0.2",
+        "async": "^3.2.4",
+        "buffer-crc32": "^1.0.0",
+        "readable-stream": "^4.0.0",
+        "readdir-glob": "^1.1.2",
+        "tar-stream": "^3.0.0",
+        "zip-stream": "^6.0.1"
       },
       "engines": {
-        "node": ">= 10"
+        "node": ">= 14"
       }
     },
     "node_modules/archiver-utils": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/archiver-utils/-/archiver-utils-2.1.0.tgz",
-      "integrity": "sha512-bEL/yUb/fNNiNTuUz979Z0Yg5L+LzLxGJz8x79lYmR54fmTIb6ob/hNQgkQnIUDWIFjZVQwl9Xs356I6BAMHfw==",
+      "version": "5.0.2",
+      "resolved": "https://registry.npmjs.org/archiver-utils/-/archiver-utils-5.0.2.tgz",
+      "integrity": "sha512-wuLJMmIBQYCsGZgYLTy5FIB2pF6Lfb6cXMSF8Qywwk3t20zWnAi7zLcQFdKQmIB8wyZpY5ER38x08GbwtR2cLA==",
       "dependencies": {
-        "glob": "^7.1.4",
+        "glob": "^10.0.0",
         "graceful-fs": "^4.2.0",
+        "is-stream": "^2.0.1",
         "lazystream": "^1.0.0",
-        "lodash.defaults": "^4.2.0",
-        "lodash.difference": "^4.5.0",
-        "lodash.flatten": "^4.4.0",
-        "lodash.isplainobject": "^4.0.6",
-        "lodash.union": "^4.6.0",
+        "lodash": "^4.17.15",
         "normalize-path": "^3.0.0",
-        "readable-stream": "^2.0.0"
+        "readable-stream": "^4.0.0"
       },
       "engines": {
-        "node": ">= 6"
+        "node": ">= 14"
       }
     },
-    "node_modules/archiver-utils/node_modules/readable-stream": {
-      "version": "2.3.8",
-      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-2.3.8.tgz",
-      "integrity": "sha512-8p0AUk4XODgIewSi0l8Epjs+EVnWiK7NoDIEGU0HhE7+ZyY8D1IMY7odu5lRrFXGg71L15KG8QrPmum45RTtdA==",
+    "node_modules/archiver-utils/node_modules/brace-expansion": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.1.tgz",
+      "integrity": "sha512-XnAIvQ8eM+kC6aULx6wuQiwVsnzsi9d3WxzV3FpWTGA19F621kwdbsAcFKXgKUHZWsy+mY6iL1sHTxWEFCytDA==",
       "dependencies": {
-        "core-util-is": "~1.0.0",
-        "inherits": "~2.0.3",
-        "isarray": "~1.0.0",
-        "process-nextick-args": "~2.0.0",
-        "safe-buffer": "~5.1.1",
-        "string_decoder": "~1.1.1",
-        "util-deprecate": "~1.0.1"
+        "balanced-match": "^1.0.0"
       }
     },
-    "node_modules/archiver-utils/node_modules/safe-buffer": {
-      "version": "5.1.2",
-      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.1.2.tgz",
-      "integrity": "sha512-Gd2UZBJDkXlY7GbJxfsE8/nvKkUEU1G38c1siN6QP6a9PT9MmHB8GnpscSmMJSoF8LOIrt8ud/wPtojys4G6+g=="
-    },
-    "node_modules/archiver-utils/node_modules/string_decoder": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.1.1.tgz",
-      "integrity": "sha512-n/ShnvDi6FHbbVfviro+WojiFzv+s8MPMHBczVePfUpDJLwoLT0ht1l4YwBCbi8pJAveEEdnkHyPyTP/mzRfwg==",
+    "node_modules/archiver-utils/node_modules/glob": {
+      "version": "10.3.12",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-10.3.12.tgz",
+      "integrity": "sha512-TCNv8vJ+xz4QiqTpfOJA7HvYv+tNIRHKfUWw/q+v2jdgN4ebz+KY9tGx5J4rHP0o84mNP+ApH66HRX8us3Khqg==",
       "dependencies": {
-        "safe-buffer": "~5.1.0"
+        "foreground-child": "^3.1.0",
+        "jackspeak": "^2.3.6",
+        "minimatch": "^9.0.1",
+        "minipass": "^7.0.4",
+        "path-scurry": "^1.10.2"
+      },
+      "bin": {
+        "glob": "dist/esm/bin.mjs"
+      },
+      "engines": {
+        "node": ">=16 || 14 >=14.17"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/archiver-utils/node_modules/minimatch": {
+      "version": "9.0.4",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.4.tgz",
+      "integrity": "sha512-KqWh+VchfxcMNRAJjj2tnsSJdNbHsVgnkBhTNrW7AjVo6OvLtxw8zfT9oLw1JSohlFzJ8jCoTgaoXvJ+kHt6fw==",
+      "dependencies": {
+        "brace-expansion": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=16 || 14 >=14.17"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
       }
     },
     "node_modules/async": {
@@ -560,11 +630,22 @@
       "resolved": "https://registry.npmjs.org/asynckit/-/asynckit-0.4.0.tgz",
       "integrity": "sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q=="
     },
+    "node_modules/b4a": {
+      "version": "1.6.6",
+      "resolved": "https://registry.npmjs.org/b4a/-/b4a-1.6.6.tgz",
+      "integrity": "sha512-5Tk1HLk6b6ctmjIkAcU/Ujv/1WqiDl0F0JdRCR80VsOcUlHcu7pWeWRlOqQLHfDEsVx9YH/aif5AG4ehoCtTmg=="
+    },
     "node_modules/balanced-match": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
       "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw=="
     },
+    "node_modules/bare-events": {
+      "version": "2.2.2",
+      "resolved": "https://registry.npmjs.org/bare-events/-/bare-events-2.2.2.tgz",
+      "integrity": "sha512-h7z00dWdG0PYOQEvChhOSWvOfkIKsdZGkWr083FgN/HyoQuebSew/cgirYqh9SCuy/hRvxc5Vy6Fw8xAmYHLkQ==",
+      "optional": true
+    },
     "node_modules/base64-js": {
       "version": "1.5.1",
       "resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz",
@@ -601,16 +682,6 @@
         "node": "*"
       }
     },
-    "node_modules/bl": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/bl/-/bl-4.1.0.tgz",
-      "integrity": "sha512-1W07cM9gS6DcLperZfFSj+bWLtaPGSOHWhPiGzXmvVJbRLdG82sH/Kn8EtW1VqWVA54AKf2h5k5BbnIbwF3h6w==",
-      "dependencies": {
-        "buffer": "^5.5.0",
-        "inherits": "^2.0.4",
-        "readable-stream": "^3.4.0"
-      }
-    },
     "node_modules/bottleneck": {
       "version": "2.19.5",
       "resolved": "https://registry.npmjs.org/bottleneck/-/bottleneck-2.19.5.tgz",
@@ -626,9 +697,9 @@
       }
     },
     "node_modules/buffer": {
-      "version": "5.7.1",
-      "resolved": "https://registry.npmjs.org/buffer/-/buffer-5.7.1.tgz",
-      "integrity": "sha512-EHcyIPBQ4BSGlvjB16k5KgAJ27CIsHY/2JBmCRReo48y9rQ3MaUzWX3KVlBa4U7MyX02HdVj0K7C3WaB3ju7FQ==",
+      "version": "6.0.3",
+      "resolved": "https://registry.npmjs.org/buffer/-/buffer-6.0.3.tgz",
+      "integrity": "sha512-FTiCpNxtwiZZHEZbcbTIcZjERVICn9yq/pDFkTl95/AxzD1naBctN7YO68riM/gLSDY7sdrMby8hofADYuuqOA==",
       "funding": [
         {
           "type": "github",
@@ -645,15 +716,15 @@
       ],
       "dependencies": {
         "base64-js": "^1.3.1",
-        "ieee754": "^1.1.13"
+        "ieee754": "^1.2.1"
       }
     },
     "node_modules/buffer-crc32": {
-      "version": "0.2.13",
-      "resolved": "https://registry.npmjs.org/buffer-crc32/-/buffer-crc32-0.2.13.tgz",
-      "integrity": "sha512-VO9Ht/+p3SN7SKWqcrgEzjGbRSJYTx+Q1pTQC0wrWqHx0vpJraQ6GtHx8tvcg1rlK1byhU5gccxgOgj7B0TDkQ==",
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/buffer-crc32/-/buffer-crc32-1.0.0.tgz",
+      "integrity": "sha512-Db1SbgBS/fg/392AblrMJk97KggmvYhr4pB5ZIMTWtaivCPMWLkmb7m21cJvpvgK+J3nsU2CmmixNBZx4vFj/w==",
       "engines": {
-        "node": "*"
+        "node": ">=8.0.0"
       }
     },
     "node_modules/buffers": {
@@ -684,6 +755,22 @@
         "node": "*"
       }
     },
+    "node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA=="
+    },
     "node_modules/combined-stream": {
       "version": "1.0.8",
       "resolved": "https://registry.npmjs.org/combined-stream/-/combined-stream-1.0.8.tgz",
@@ -704,17 +791,18 @@
       }
     },
     "node_modules/compress-commons": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/compress-commons/-/compress-commons-4.1.1.tgz",
-      "integrity": "sha512-QLdDLCKNV2dtoTorqgxngQCMA+gWXkM/Nwu7FpeBhk/RdkzimqC3jueb/FDmaZeXh+uby1jkBqE3xArsLBE5wQ==",
+      "version": "6.0.2",
+      "resolved": "https://registry.npmjs.org/compress-commons/-/compress-commons-6.0.2.tgz",
+      "integrity": "sha512-6FqVXeETqWPoGcfzrXb37E50NP0LXT8kAMu5ooZayhWWdgEY4lBEEcbQNXtkuKQsGduxiIcI4gOTsxTmuq/bSg==",
       "dependencies": {
-        "buffer-crc32": "^0.2.13",
-        "crc32-stream": "^4.0.2",
+        "crc-32": "^1.2.0",
+        "crc32-stream": "^6.0.0",
+        "is-stream": "^2.0.1",
         "normalize-path": "^3.0.0",
-        "readable-stream": "^3.6.0"
+        "readable-stream": "^4.0.0"
       },
       "engines": {
-        "node": ">= 10"
+        "node": ">= 14"
       }
     },
     "node_modules/concat-map": {
@@ -739,22 +827,29 @@
       }
     },
     "node_modules/crc32-stream": {
-      "version": "4.0.2",
-      "resolved": "https://registry.npmjs.org/crc32-stream/-/crc32-stream-4.0.2.tgz",
-      "integrity": "sha512-DxFZ/Hk473b/muq1VJ///PMNLj0ZMnzye9thBpmjpJKCc5eMgB95aK8zCGrGfQ90cWo561Te6HK9D+j4KPdM6w==",
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/crc32-stream/-/crc32-stream-6.0.0.tgz",
+      "integrity": "sha512-piICUB6ei4IlTv1+653yq5+KoqfBYmj9bw6LqXoOneTMDXk5nM1qt12mFW1caG3LlJXEKW1Bp0WggEmIfQB34g==",
       "dependencies": {
         "crc-32": "^1.2.0",
-        "readable-stream": "^3.4.0"
+        "readable-stream": "^4.0.0"
       },
       "engines": {
-        "node": ">= 10"
+        "node": ">= 14"
       }
     },
-    "node_modules/crypto": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/crypto/-/crypto-1.0.1.tgz",
-      "integrity": "sha512-VxBKmeNcqQdiUQUW2Tzq0t377b54N2bMtXO/qiLa+6eRRmmC4qT3D4OnTGoT/U6O9aklQ/jTwbOtRMTTY8G0Ig==",
-      "deprecated": "This package is no longer supported. It's now a built-in Node module. If you've depended on crypto, you should switch to the one that's built-in."
+    "node_modules/cross-spawn": {
+      "version": "7.0.3",
+      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.3.tgz",
+      "integrity": "sha512-iRDPJKUPVEND7dHPO8rkbOnPpyDygcDFtWjpeWNCgy8WP2rXcxXL8TskReQl6OrB2G7+UJrags1q15Fudc7G6w==",
+      "dependencies": {
+        "path-key": "^3.1.0",
+        "shebang-command": "^2.0.0",
+        "which": "^2.0.1"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
     },
     "node_modules/delayed-stream": {
       "version": "1.0.0",
@@ -781,12 +876,22 @@
         "dot-object": "bin/dot-object"
       }
     },
-    "node_modules/end-of-stream": {
-      "version": "1.4.4",
-      "resolved": "https://registry.npmjs.org/end-of-stream/-/end-of-stream-1.4.4.tgz",
-      "integrity": "sha512-+uw1inIHVPQoaVuHzRyXd21icM+cnt4CzD5rW+NC1wjOUSTOs+Te7FOv7AhN7vS9x/oIyhLP5PR1H+phQAHu5Q==",
-      "dependencies": {
-        "once": "^1.4.0"
+    "node_modules/eastasianwidth": {
+      "version": "0.2.0",
+      "resolved": "https://registry.npmjs.org/eastasianwidth/-/eastasianwidth-0.2.0.tgz",
+      "integrity": "sha512-I88TYZWc9XiYHRQ4/3c5rjjfgkjhLyW2luGIheGERbNQ6OY7yTybanSpDXZa8y7VUP9YmDcYa+eyq4ca7iLqWA=="
+    },
+    "node_modules/emoji-regex": {
+      "version": "9.2.2",
+      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-9.2.2.tgz",
+      "integrity": "sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg=="
+    },
+    "node_modules/event-target-shim": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/event-target-shim/-/event-target-shim-5.0.1.tgz",
+      "integrity": "sha512-i/2XbnSz/uxRCU6+NdVJgKWDTM427+MqYbkQzD321DuCQJUqOuJKIA0IM2+W2xtYHdKOmZ4dR6fExsd4SXL+WQ==",
+      "engines": {
+        "node": ">=6"
       }
     },
     "node_modules/events": {
@@ -797,6 +902,26 @@
         "node": ">=0.8.x"
       }
     },
+    "node_modules/fast-fifo": {
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/fast-fifo/-/fast-fifo-1.3.2.tgz",
+      "integrity": "sha512-/d9sfos4yxzpwkDkuN7k2SqFKtYNmCTzgfEpz82x34IM9/zc8KGxQoXg1liNC/izpRM/MBdt44Nmx41ZWqk+FQ=="
+    },
+    "node_modules/foreground-child": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/foreground-child/-/foreground-child-3.1.1.tgz",
+      "integrity": "sha512-TMKDUnIte6bfb5nWv7V/caI169OHgvwjb7V4WkeUvbQQdjr5rWKqHFiKWb/fcOwB+CzBT+qbWjvj+DVwRskpIg==",
+      "dependencies": {
+        "cross-spawn": "^7.0.0",
+        "signal-exit": "^4.0.1"
+      },
+      "engines": {
+        "node": ">=14"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
     "node_modules/form-data": {
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.0.tgz",
@@ -810,11 +935,6 @@
         "node": ">= 6"
       }
     },
-    "node_modules/fs-constants": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/fs-constants/-/fs-constants-1.0.0.tgz",
-      "integrity": "sha512-y6OAwoSIf7FyjMIv94u+b5rdheZEjzR63GTyZJm5qh4Bi+2YgwLCcI/fPFZkL5PSixOt6ZNKm+w+Hfp/Bciwow=="
-    },
     "node_modules/fs.realpath": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz",
@@ -898,6 +1018,14 @@
       "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
       "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ=="
     },
+    "node_modules/is-fullwidth-code-point": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
+      "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/is-plain-object": {
       "version": "5.0.0",
       "resolved": "https://registry.npmjs.org/is-plain-object/-/is-plain-object-5.0.0.tgz",
@@ -906,11 +1034,44 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/is-stream": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/is-stream/-/is-stream-2.0.1.tgz",
+      "integrity": "sha512-hFoiJiTl63nn+kstHGBtewWSKnQLpyb155KHheA1l39uvtO9nWIop1p3udqPcUd/xbF1VLMO4n7OI6p7RbngDg==",
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
     "node_modules/isarray": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/isarray/-/isarray-1.0.0.tgz",
       "integrity": "sha512-VLghIWNM6ELQzo7zwmcg0NmTVyWKYjvIeM83yjp0wRDTmUnrM678fQbcKBo6n2CJEF0szoG//ytg+TKla89ALQ=="
     },
+    "node_modules/isexe": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
+      "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw=="
+    },
+    "node_modules/jackspeak": {
+      "version": "2.3.6",
+      "resolved": "https://registry.npmjs.org/jackspeak/-/jackspeak-2.3.6.tgz",
+      "integrity": "sha512-N3yCS/NegsOBokc8GAdM8UcmfsKiSS8cipheD/nivzr700H+nsMOxJjQnvwOcRYVuFkdH0wGUvW2WbXGmrZGbQ==",
+      "dependencies": {
+        "@isaacs/cliui": "^8.0.2"
+      },
+      "engines": {
+        "node": ">=14"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      },
+      "optionalDependencies": {
+        "@pkgjs/parseargs": "^0.11.0"
+      }
+    },
     "node_modules/jsonc-parser": {
       "version": "3.2.0",
       "resolved": "https://registry.npmjs.org/jsonc-parser/-/jsonc-parser-3.2.0.tgz",
@@ -965,31 +1126,6 @@
       "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.21.tgz",
       "integrity": "sha512-v2kDEe57lecTulaDIuNTPy3Ry4gLGJ6Z1O3vE1krgXZNrsQ+LFTGHVxVjcXPs17LhbZVGedAJv8XZ1tvj5FvSg=="
     },
-    "node_modules/lodash.defaults": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/lodash.defaults/-/lodash.defaults-4.2.0.tgz",
-      "integrity": "sha512-qjxPLHd3r5DnsdGacqOMU6pb/avJzdh9tFX2ymgoZE27BmjXrNy/y4LoaiTeAb+O3gL8AfpJGtqfX/ae2leYYQ=="
-    },
-    "node_modules/lodash.difference": {
-      "version": "4.5.0",
-      "resolved": "https://registry.npmjs.org/lodash.difference/-/lodash.difference-4.5.0.tgz",
-      "integrity": "sha512-dS2j+W26TQ7taQBGN8Lbbq04ssV3emRw4NY58WErlTO29pIqS0HmoT5aJ9+TUQ1N3G+JOZSji4eugsWwGp9yPA=="
-    },
-    "node_modules/lodash.flatten": {
-      "version": "4.4.0",
-      "resolved": "https://registry.npmjs.org/lodash.flatten/-/lodash.flatten-4.4.0.tgz",
-      "integrity": "sha512-C5N2Z3DgnnKr0LOpv/hKCgKdb7ZZwafIrsesve6lmzvZIRZRGaZ/l6Q8+2W7NaT+ZwO3fFlSCzCzrDCFdJfZ4g=="
-    },
-    "node_modules/lodash.isplainobject": {
-      "version": "4.0.6",
-      "resolved": "https://registry.npmjs.org/lodash.isplainobject/-/lodash.isplainobject-4.0.6.tgz",
-      "integrity": "sha512-oSXzaWypCMHkPC3NvBEaPHf0KsA5mvPrOPgQWDsbg8n7orZ290M0BmC/jgRZ4vcJ6DTAhjrsSYgdsW/F+MFOBA=="
-    },
-    "node_modules/lodash.union": {
-      "version": "4.6.0",
-      "resolved": "https://registry.npmjs.org/lodash.union/-/lodash.union-4.6.0.tgz",
-      "integrity": "sha512-c4pB2CdGrGdjMKYLA+XiRDO7Y0PRQbm/Gzg8qMj+QH+pFVAoTp5sBpO0odL3FjoPCGjK96p6qsP+yQoiLoOBcw=="
-    },
     "node_modules/lower-case": {
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/lower-case/-/lower-case-2.0.2.tgz",
@@ -998,6 +1134,14 @@
         "tslib": "^2.0.3"
       }
     },
+    "node_modules/lru-cache": {
+      "version": "10.2.0",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.2.0.tgz",
+      "integrity": "sha512-2bIM8x+VAf6JT4bKAljS1qUWgMsqZRPGJS6FSahIMPVvctcNhyVp7AJu7quxOW9jwkryBReKZY5tY5JYv2n/7Q==",
+      "engines": {
+        "node": "14 || >=16.14"
+      }
+    },
     "node_modules/lunr": {
       "version": "2.3.9",
       "resolved": "https://registry.npmjs.org/lunr/-/lunr-2.3.9.tgz",
@@ -1054,6 +1198,14 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/minipass": {
+      "version": "7.0.4",
+      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.0.4.tgz",
+      "integrity": "sha512-jYofLM5Dam9279rdkWzqHozUo4ybjdZmCsDHePy5V/PbBcVMiSZR97gmAy45aqi8CK1lG2ECd356FU86avfwUQ==",
+      "engines": {
+        "node": ">=16 || 14 >=14.17"
+      }
+    },
     "node_modules/mkdirp": {
       "version": "0.5.6",
       "resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-0.5.6.tgz",
@@ -1132,10 +1284,33 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/path-key": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
+      "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/path-scurry": {
+      "version": "1.10.2",
+      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-1.10.2.tgz",
+      "integrity": "sha512-7xTavNy5RQXnsjANvVvMkEjvloOinkAjv/Z6Ildz9v2RinZ4SBKTWFOVRbaF8p0vpHnyjV/UwNDdKuUv6M5qcA==",
+      "dependencies": {
+        "lru-cache": "^10.2.0",
+        "minipass": "^5.0.0 || ^6.0.2 || ^7.0.0"
+      },
+      "engines": {
+        "node": ">=16 || 14 >=14.17"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
     "node_modules/path-to-regexp": {
-      "version": "6.2.1",
-      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-6.2.1.tgz",
-      "integrity": "sha512-JLyh7xT1kizaEvcaXOQwOc2/Yhw6KZOvPf1S8401UyLk86CU79LN3vl7ztXGm/pZ+YjoyAJ4rxmHwbkBXJX+yw=="
+      "version": "6.3.0",
+      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-6.3.0.tgz",
+      "integrity": "sha512-Yhpw4T9C6hPpgPeA28us07OJeqZ5EzQTkbfwuhsUg0c237RomFoETJgmp2sa3F/41gfLE6G5cqcYwznmeEeOlQ=="
     },
     "node_modules/prettier": {
       "version": "2.8.8",
@@ -1164,17 +1339,24 @@
       "resolved": "https://registry.npmjs.org/process-nextick-args/-/process-nextick-args-2.0.1.tgz",
       "integrity": "sha512-3ouUOpQhtgrbOa17J7+uxOTpITYWaGP7/AhoR3+A+/1e9skrzelGi/dXzEYyvbxubEF6Wn2ypscTKiKJFFn1ag=="
     },
+    "node_modules/queue-tick": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/queue-tick/-/queue-tick-1.0.1.tgz",
+      "integrity": "sha512-kJt5qhMxoszgU/62PLP1CJytzd2NKetjSRnyuj31fDd3Rlcz3fzlFdFLD1SItunPwyqEOkca6GbV612BWfaBag=="
+    },
     "node_modules/readable-stream": {
-      "version": "3.6.2",
-      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-3.6.2.tgz",
-      "integrity": "sha512-9u/sniCrY3D5WdsERHzHE4G2YCXqoG5FTHUiCC4SIbr6XcLZBY05ya9EKjYek9O5xOAwjGq+1JdGBAS7Q9ScoA==",
+      "version": "4.5.2",
+      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-4.5.2.tgz",
+      "integrity": "sha512-yjavECdqeZ3GLXNgRXgeQEdz9fvDDkNKyHnbHRFtOr7/LcfgBcmct7t/ET+HaCTqfh06OzoAxrkN/IfjJBVe+g==",
       "dependencies": {
-        "inherits": "^2.0.3",
-        "string_decoder": "^1.1.1",
-        "util-deprecate": "^1.0.1"
+        "abort-controller": "^3.0.0",
+        "buffer": "^6.0.3",
+        "events": "^3.3.0",
+        "process": "^0.11.10",
+        "string_decoder": "^1.3.0"
       },
       "engines": {
-        "node": ">= 6"
+        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
       }
     },
     "node_modules/readdir-glob": {
@@ -1228,6 +1410,25 @@
       "resolved": "https://registry.npmjs.org/sax/-/sax-1.2.4.tgz",
       "integrity": "sha512-NqVDv9TpANUjFm0N8uM5GxL36UgKi9/atZw+x7YFnQ8ckwFGKrl4xX4yWtrey3UJm5nP1kUbnYgLopqWNSRhWw=="
     },
+    "node_modules/shebang-command": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
+      "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
+      "dependencies": {
+        "shebang-regex": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/shebang-regex": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
+      "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/shiki": {
       "version": "0.14.5",
       "resolved": "https://registry.npmjs.org/shiki/-/shiki-0.14.5.tgz",
@@ -1240,6 +1441,17 @@
         "vscode-textmate": "^8.0.0"
       }
     },
+    "node_modules/signal-exit": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-4.1.0.tgz",
+      "integrity": "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==",
+      "engines": {
+        "node": ">=14"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
     "node_modules/source-map": {
       "version": "0.6.1",
       "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
@@ -1249,6 +1461,18 @@
         "node": ">=0.10.0"
       }
     },
+    "node_modules/streamx": {
+      "version": "2.16.1",
+      "resolved": "https://registry.npmjs.org/streamx/-/streamx-2.16.1.tgz",
+      "integrity": "sha512-m9QYj6WygWyWa3H1YY69amr4nVgy61xfjys7xO7kviL5rfIEc2naf+ewFiOA+aEJD7y0JO3h2GoiUv4TDwEGzQ==",
+      "dependencies": {
+        "fast-fifo": "^1.1.0",
+        "queue-tick": "^1.0.1"
+      },
+      "optionalDependencies": {
+        "bare-events": "^2.2.0"
+      }
+    },
     "node_modules/string_decoder": {
       "version": "1.3.0",
       "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.3.0.tgz",
@@ -1257,19 +1481,102 @@
         "safe-buffer": "~5.2.0"
       }
     },
-    "node_modules/tar-stream": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/tar-stream/-/tar-stream-2.2.0.tgz",
-      "integrity": "sha512-ujeqbceABgwMZxEJnk2HDY2DlnUZ+9oEcb1KzTVfYHio0UE6dG71n60d8D2I4qNvleWrrXpmjpt7vZeF1LnMZQ==",
+    "node_modules/string-width": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-5.1.2.tgz",
+      "integrity": "sha512-HnLOCR3vjcY8beoNLtcjZ5/nxn2afmME6lhrDrebokqMap+XbeW8n9TXpPDOqdGK5qcI3oT0GKTW6wC7EMiVqA==",
       "dependencies": {
-        "bl": "^4.0.3",
-        "end-of-stream": "^1.4.1",
-        "fs-constants": "^1.0.0",
-        "inherits": "^2.0.3",
-        "readable-stream": "^3.1.1"
+        "eastasianwidth": "^0.2.0",
+        "emoji-regex": "^9.2.2",
+        "strip-ansi": "^7.0.1"
       },
       "engines": {
-        "node": ">=6"
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/string-width-cjs": {
+      "name": "string-width",
+      "version": "4.2.3",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
+      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
+      "dependencies": {
+        "emoji-regex": "^8.0.0",
+        "is-fullwidth-code-point": "^3.0.0",
+        "strip-ansi": "^6.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/string-width-cjs/node_modules/ansi-regex": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
+      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/string-width-cjs/node_modules/emoji-regex": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
+      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A=="
+    },
+    "node_modules/string-width-cjs/node_modules/strip-ansi": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+      "dependencies": {
+        "ansi-regex": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/strip-ansi": {
+      "version": "7.1.0",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.1.0.tgz",
+      "integrity": "sha512-iq6eVVI64nQQTRYq2KtEg2d2uU7LElhTJwsH4YzIHZshxlgZms/wIc4VoDQTlG/IvVIrBKG06CrZnp0qv7hkcQ==",
+      "dependencies": {
+        "ansi-regex": "^6.0.1"
+      },
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/strip-ansi?sponsor=1"
+      }
+    },
+    "node_modules/strip-ansi-cjs": {
+      "name": "strip-ansi",
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+      "dependencies": {
+        "ansi-regex": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/strip-ansi-cjs/node_modules/ansi-regex": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
+      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/tar-stream": {
+      "version": "3.1.7",
+      "resolved": "https://registry.npmjs.org/tar-stream/-/tar-stream-3.1.7.tgz",
+      "integrity": "sha512-qJj60CXt7IU1Ffyc3NJMjh6EkuCFej46zUqJ4J7pqYlThyd9bO0XBTmcOIhSzZJVWfsLks0+nle/j538YAW9RQ==",
+      "dependencies": {
+        "b4a": "^1.6.4",
+        "fast-fifo": "^1.2.0",
+        "streamx": "^2.15.0"
       }
     },
     "node_modules/tr46": {
@@ -1424,9 +1731,9 @@
       "integrity": "sha512-isyNax3wXoKaulPDZWHQqbmIx1k2tb9fb3GGDBRxCscfYV2Ch7WxPArBsFEG8s/safwXTT7H4QGhaIkTp9447w=="
     },
     "node_modules/unzip-stream": {
-      "version": "0.3.1",
-      "resolved": "https://registry.npmjs.org/unzip-stream/-/unzip-stream-0.3.1.tgz",
-      "integrity": "sha512-RzaGXLNt+CW+T41h1zl6pGz3EaeVhYlK+rdAap+7DxW5kqsqePO8kRtWPaCiVqdhZc86EctSPVYNix30YOMzmw==",
+      "version": "0.3.4",
+      "resolved": "https://registry.npmjs.org/unzip-stream/-/unzip-stream-0.3.4.tgz",
+      "integrity": "sha512-PyofABPVv+d7fL7GOpusx7eRT9YETY2X04PhwbSipdj6bMxVCFJrr+nm0Mxqbf9hUiTin/UsnuFWBXlDZFy0Cw==",
       "dependencies": {
         "binary": "^0.3.0",
         "mkdirp": "^0.5.1"
@@ -1471,12 +1778,110 @@
         "webidl-conversions": "^3.0.0"
       }
     },
+    "node_modules/which": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
+      "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
+      "dependencies": {
+        "isexe": "^2.0.0"
+      },
+      "bin": {
+        "node-which": "bin/node-which"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
     "node_modules/wordwrap": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/wordwrap/-/wordwrap-1.0.0.tgz",
       "integrity": "sha512-gvVzJFlPycKc5dZN4yPkP8w7Dc37BtP1yczEneOb4uq34pXZcvrtRTmWV8W+Ume+XCxKgbjM+nevkyFPMybd4Q==",
       "dev": true
     },
+    "node_modules/wrap-ansi": {
+      "version": "8.1.0",
+      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-8.1.0.tgz",
+      "integrity": "sha512-si7QWI6zUMq56bESFvagtmzMdGOtoxfR+Sez11Mobfc7tm+VkUckk9bW2UeffTGVUbOksxmSw0AA2gs8g71NCQ==",
+      "dependencies": {
+        "ansi-styles": "^6.1.0",
+        "string-width": "^5.0.1",
+        "strip-ansi": "^7.0.1"
+      },
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
+      }
+    },
+    "node_modules/wrap-ansi-cjs": {
+      "name": "wrap-ansi",
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
+      "integrity": "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==",
+      "dependencies": {
+        "ansi-styles": "^4.0.0",
+        "string-width": "^4.1.0",
+        "strip-ansi": "^6.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
+      }
+    },
+    "node_modules/wrap-ansi-cjs/node_modules/ansi-regex": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
+      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/wrap-ansi-cjs/node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/wrap-ansi-cjs/node_modules/emoji-regex": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
+      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A=="
+    },
+    "node_modules/wrap-ansi-cjs/node_modules/string-width": {
+      "version": "4.2.3",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
+      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
+      "dependencies": {
+        "emoji-regex": "^8.0.0",
+        "is-fullwidth-code-point": "^3.0.0",
+        "strip-ansi": "^6.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/wrap-ansi-cjs/node_modules/strip-ansi": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+      "dependencies": {
+        "ansi-regex": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
     "node_modules/wrappy": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
@@ -1511,16 +1916,16 @@
       }
     },
     "node_modules/zip-stream": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/zip-stream/-/zip-stream-4.1.0.tgz",
-      "integrity": "sha512-zshzwQW7gG7hjpBlgeQP9RuyPGNxvJdzR8SUM3QhxCnLjWN2E7j3dOvpeDcQoETfHx0urRS7EtmVToql7YpU4A==",
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/zip-stream/-/zip-stream-6.0.1.tgz",
+      "integrity": "sha512-zK7YHHz4ZXpW89AHXUPbQVGKI7uvkd3hzusTdotCg1UxyaVtg0zFJSTfW/Dq5f7OBBVnq6cZIaC8Ti4hb6dtCA==",
       "dependencies": {
-        "archiver-utils": "^2.1.0",
-        "compress-commons": "^4.1.0",
-        "readable-stream": "^3.6.0"
+        "archiver-utils": "^5.0.0",
+        "compress-commons": "^6.0.2",
+        "readable-stream": "^4.0.0"
       },
       "engines": {
-        "node": ">= 10"
+        "node": ">= 14"
       }
     }
   }

packages/artifact/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actions/artifact",
-  "version": "2.0.1",
+  "version": "2.1.11",
   "preview": true,
   "description": "Actions artifact lib",
   "keywords": [
@@ -49,8 +49,7 @@
     "@octokit/plugin-retry": "^3.0.9",
     "@octokit/request-error": "^5.0.0",
     "@protobuf-ts/plugin": "^2.2.3-alpha.1",
-    "archiver": "^5.3.1",
-    "crypto": "^1.0.1",
+    "archiver": "^7.0.1",
     "jwt-decode": "^3.1.2",
     "twirp-ts": "^2.5.0",
     "unzip-stream": "^0.3.1"
@@ -62,4 +61,4 @@
     "typedoc-plugin-markdown": "^3.17.1",
     "typescript": "^5.2.2"
   }
-}
+}

packages/artifact/src/generated/results/api/v1/artifact.ts

@@ -196,6 +196,36 @@ export interface GetSignedArtifactURLResponse {
      */
     signedUrl: string;
 }
+/**
+ * @generated from protobuf message github.actions.results.api.v1.DeleteArtifactRequest
+ */
+export interface DeleteArtifactRequest {
+    /**
+     * @generated from protobuf field: string workflow_run_backend_id = 1;
+     */
+    workflowRunBackendId: string;
+    /**
+     * @generated from protobuf field: string workflow_job_run_backend_id = 2;
+     */
+    workflowJobRunBackendId: string;
+    /**
+     * @generated from protobuf field: string name = 3;
+     */
+    name: string;
+}
+/**
+ * @generated from protobuf message github.actions.results.api.v1.DeleteArtifactResponse
+ */
+export interface DeleteArtifactResponse {
+    /**
+     * @generated from protobuf field: bool ok = 1;
+     */
+    ok: boolean;
+    /**
+     * @generated from protobuf field: int64 artifact_id = 2;
+     */
+    artifactId: string;
+}
 // @generated message type with reflection information, may provide speed optimized methods
 class CreateArtifactRequest$Type extends MessageType<CreateArtifactRequest> {
     constructor() {
@@ -759,6 +789,121 @@ class GetSignedArtifactURLResponse$Type extends MessageType<GetSignedArtifactURL
  * @generated MessageType for protobuf message github.actions.results.api.v1.GetSignedArtifactURLResponse
  */
 export const GetSignedArtifactURLResponse = new GetSignedArtifactURLResponse$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class DeleteArtifactRequest$Type extends MessageType<DeleteArtifactRequest> {
+    constructor() {
+        super("github.actions.results.api.v1.DeleteArtifactRequest", [
+            { no: 1, name: "workflow_run_backend_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "workflow_job_run_backend_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "name", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<DeleteArtifactRequest>): DeleteArtifactRequest {
+        const message = { workflowRunBackendId: "", workflowJobRunBackendId: "", name: "" };
+        globalThis.Object.defineProperty(message, MESSAGE_TYPE, { enumerable: false, value: this });
+        if (value !== undefined)
+            reflectionMergePartial<DeleteArtifactRequest>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: DeleteArtifactRequest): DeleteArtifactRequest {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string workflow_run_backend_id */ 1:
+                    message.workflowRunBackendId = reader.string();
+                    break;
+                case /* string workflow_job_run_backend_id */ 2:
+                    message.workflowJobRunBackendId = reader.string();
+                    break;
+                case /* string name */ 3:
+                    message.name = reader.string();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: DeleteArtifactRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string workflow_run_backend_id = 1; */
+        if (message.workflowRunBackendId !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.workflowRunBackendId);
+        /* string workflow_job_run_backend_id = 2; */
+        if (message.workflowJobRunBackendId !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.workflowJobRunBackendId);
+        /* string name = 3; */
+        if (message.name !== "")
+            writer.tag(3, WireType.LengthDelimited).string(message.name);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message github.actions.results.api.v1.DeleteArtifactRequest
+ */
+export const DeleteArtifactRequest = new DeleteArtifactRequest$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class DeleteArtifactResponse$Type extends MessageType<DeleteArtifactResponse> {
+    constructor() {
+        super("github.actions.results.api.v1.DeleteArtifactResponse", [
+            { no: 1, name: "ok", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
+            { no: 2, name: "artifact_id", kind: "scalar", T: 3 /*ScalarType.INT64*/ }
+        ]);
+    }
+    create(value?: PartialMessage<DeleteArtifactResponse>): DeleteArtifactResponse {
+        const message = { ok: false, artifactId: "0" };
+        globalThis.Object.defineProperty(message, MESSAGE_TYPE, { enumerable: false, value: this });
+        if (value !== undefined)
+            reflectionMergePartial<DeleteArtifactResponse>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: DeleteArtifactResponse): DeleteArtifactResponse {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* bool ok */ 1:
+                    message.ok = reader.bool();
+                    break;
+                case /* int64 artifact_id */ 2:
+                    message.artifactId = reader.int64().toString();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: DeleteArtifactResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* bool ok = 1; */
+        if (message.ok !== false)
+            writer.tag(1, WireType.Varint).bool(message.ok);
+        /* int64 artifact_id = 2; */
+        if (message.artifactId !== "0")
+            writer.tag(2, WireType.Varint).int64(message.artifactId);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message github.actions.results.api.v1.DeleteArtifactResponse
+ */
+export const DeleteArtifactResponse = new DeleteArtifactResponse$Type();
 /**
  * @generated ServiceType for protobuf service github.actions.results.api.v1.ArtifactService
  */
@@ -766,5 +911,6 @@ export const ArtifactService = new ServiceType("github.actions.results.api.v1.Ar
     { name: "CreateArtifact", options: {}, I: CreateArtifactRequest, O: CreateArtifactResponse },
     { name: "FinalizeArtifact", options: {}, I: FinalizeArtifactRequest, O: FinalizeArtifactResponse },
     { name: "ListArtifacts", options: {}, I: ListArtifactsRequest, O: ListArtifactsResponse },
-    { name: "GetSignedArtifactURL", options: {}, I: GetSignedArtifactURLRequest, O: GetSignedArtifactURLResponse }
+    { name: "GetSignedArtifactURL", options: {}, I: GetSignedArtifactURLRequest, O: GetSignedArtifactURLResponse },
+    { name: "DeleteArtifact", options: {}, I: DeleteArtifactRequest, O: DeleteArtifactResponse }
 ]);

packages/artifact/src/generated/results/api/v1/artifact.twirp.ts

@@ -17,6 +17,8 @@ import {
   ListArtifactsResponse,
   GetSignedArtifactURLRequest,
   GetSignedArtifactURLResponse,
+  DeleteArtifactRequest,
+  DeleteArtifactResponse,
 } from "./artifact";
 
 //==================================//
@@ -43,6 +45,9 @@ export interface ArtifactServiceClient {
   GetSignedArtifactURL(
     request: GetSignedArtifactURLRequest
   ): Promise<GetSignedArtifactURLResponse>;
+  DeleteArtifact(
+    request: DeleteArtifactRequest
+  ): Promise<DeleteArtifactResponse>;
 }
 
 export class ArtifactServiceClientJSON implements ArtifactServiceClient {
@@ -53,6 +58,7 @@ export class ArtifactServiceClientJSON implements ArtifactServiceClient {
     this.FinalizeArtifact.bind(this);
     this.ListArtifacts.bind(this);
     this.GetSignedArtifactURL.bind(this);
+    this.DeleteArtifact.bind(this);
   }
   CreateArtifact(
     request: CreateArtifactRequest
@@ -129,6 +135,26 @@ export class ArtifactServiceClientJSON implements ArtifactServiceClient {
       })
     );
   }
+
+  DeleteArtifact(
+    request: DeleteArtifactRequest
+  ): Promise<DeleteArtifactResponse> {
+    const data = DeleteArtifactRequest.toJson(request, {
+      useProtoFieldName: true,
+      emitDefaultValues: false,
+    });
+    const promise = this.rpc.request(
+      "github.actions.results.api.v1.ArtifactService",
+      "DeleteArtifact",
+      "application/json",
+      data as object
+    );
+    return promise.then((data) =>
+      DeleteArtifactResponse.fromJson(data as any, {
+        ignoreUnknownFields: true,
+      })
+    );
+  }
 }
 
 export class ArtifactServiceClientProtobuf implements ArtifactServiceClient {
@@ -139,6 +165,7 @@ export class ArtifactServiceClientProtobuf implements ArtifactServiceClient {
     this.FinalizeArtifact.bind(this);
     this.ListArtifacts.bind(this);
     this.GetSignedArtifactURL.bind(this);
+    this.DeleteArtifact.bind(this);
   }
   CreateArtifact(
     request: CreateArtifactRequest
@@ -197,6 +224,21 @@ export class ArtifactServiceClientProtobuf implements ArtifactServiceClient {
       GetSignedArtifactURLResponse.fromBinary(data as Uint8Array)
     );
   }
+
+  DeleteArtifact(
+    request: DeleteArtifactRequest
+  ): Promise<DeleteArtifactResponse> {
+    const data = DeleteArtifactRequest.toBinary(request);
+    const promise = this.rpc.request(
+      "github.actions.results.api.v1.ArtifactService",
+      "DeleteArtifact",
+      "application/protobuf",
+      data
+    );
+    return promise.then((data) =>
+      DeleteArtifactResponse.fromBinary(data as Uint8Array)
+    );
+  }
 }
 
 //==================================//
@@ -220,6 +262,10 @@ export interface ArtifactServiceTwirp<T extends TwirpContext = TwirpContext> {
     ctx: T,
     request: GetSignedArtifactURLRequest
   ): Promise<GetSignedArtifactURLResponse>;
+  DeleteArtifact(
+    ctx: T,
+    request: DeleteArtifactRequest
+  ): Promise<DeleteArtifactResponse>;
 }
 
 export enum ArtifactServiceMethod {
@@ -227,6 +273,7 @@ export enum ArtifactServiceMethod {
   FinalizeArtifact = "FinalizeArtifact",
   ListArtifacts = "ListArtifacts",
   GetSignedArtifactURL = "GetSignedArtifactURL",
+  DeleteArtifact = "DeleteArtifact",
 }
 
 export const ArtifactServiceMethodList = [
@@ -234,6 +281,7 @@ export const ArtifactServiceMethodList = [
   ArtifactServiceMethod.FinalizeArtifact,
   ArtifactServiceMethod.ListArtifacts,
   ArtifactServiceMethod.GetSignedArtifactURL,
+  ArtifactServiceMethod.DeleteArtifact,
 ];
 
 export function createArtifactServiceServer<
@@ -333,6 +381,26 @@ function matchArtifactServiceRoute<T extends TwirpContext = TwirpContext>(
           interceptors
         );
       };
+    case "DeleteArtifact":
+      return async (
+        ctx: T,
+        service: ArtifactServiceTwirp,
+        data: Buffer,
+        interceptors?: Interceptor<
+          T,
+          DeleteArtifactRequest,
+          DeleteArtifactResponse
+        >[]
+      ) => {
+        ctx = { ...ctx, methodName: "DeleteArtifact" };
+        await events.onMatch(ctx);
+        return handleArtifactServiceDeleteArtifactRequest(
+          ctx,
+          service,
+          data,
+          interceptors
+        );
+      };
     default:
       events.onNotFound();
       const msg = `no handler found`;
@@ -463,6 +531,35 @@ function handleArtifactServiceGetSignedArtifactURLRequest<
       throw new TwirpError(TwirpErrorCode.BadRoute, msg);
   }
 }
+
+function handleArtifactServiceDeleteArtifactRequest<
+  T extends TwirpContext = TwirpContext
+>(
+  ctx: T,
+  service: ArtifactServiceTwirp,
+  data: Buffer,
+  interceptors?: Interceptor<T, DeleteArtifactRequest, DeleteArtifactResponse>[]
+): Promise<string | Uint8Array> {
+  switch (ctx.contentType) {
+    case TwirpContentType.JSON:
+      return handleArtifactServiceDeleteArtifactJSON<T>(
+        ctx,
+        service,
+        data,
+        interceptors
+      );
+    case TwirpContentType.Protobuf:
+      return handleArtifactServiceDeleteArtifactProtobuf<T>(
+        ctx,
+        service,
+        data,
+        interceptors
+      );
+    default:
+      const msg = "unexpected Content-Type";
+      throw new TwirpError(TwirpErrorCode.BadRoute, msg);
+  }
+}
 async function handleArtifactServiceCreateArtifactJSON<
   T extends TwirpContext = TwirpContext
 >(
@@ -646,6 +743,50 @@ async function handleArtifactServiceGetSignedArtifactURLJSON<
     }) as string
   );
 }
+
+async function handleArtifactServiceDeleteArtifactJSON<
+  T extends TwirpContext = TwirpContext
+>(
+  ctx: T,
+  service: ArtifactServiceTwirp,
+  data: Buffer,
+  interceptors?: Interceptor<T, DeleteArtifactRequest, DeleteArtifactResponse>[]
+) {
+  let request: DeleteArtifactRequest;
+  let response: DeleteArtifactResponse;
+
+  try {
+    const body = JSON.parse(data.toString() || "{}");
+    request = DeleteArtifactRequest.fromJson(body, {
+      ignoreUnknownFields: true,
+    });
+  } catch (e) {
+    if (e instanceof Error) {
+      const msg = "the json request could not be decoded";
+      throw new TwirpError(TwirpErrorCode.Malformed, msg).withCause(e, true);
+    }
+  }
+
+  if (interceptors && interceptors.length > 0) {
+    const interceptor = chainInterceptors(...interceptors) as Interceptor<
+      T,
+      DeleteArtifactRequest,
+      DeleteArtifactResponse
+    >;
+    response = await interceptor(ctx, request!, (ctx, inputReq) => {
+      return service.DeleteArtifact(ctx, inputReq);
+    });
+  } else {
+    response = await service.DeleteArtifact(ctx, request!);
+  }
+
+  return JSON.stringify(
+    DeleteArtifactResponse.toJson(response, {
+      useProtoFieldName: true,
+      emitDefaultValues: false,
+    }) as string
+  );
+}
 async function handleArtifactServiceCreateArtifactProtobuf<
   T extends TwirpContext = TwirpContext
 >(
@@ -797,3 +938,39 @@ async function handleArtifactServiceGetSignedArtifactURLProtobuf<
 
   return Buffer.from(GetSignedArtifactURLResponse.toBinary(response));
 }
+
+async function handleArtifactServiceDeleteArtifactProtobuf<
+  T extends TwirpContext = TwirpContext
+>(
+  ctx: T,
+  service: ArtifactServiceTwirp,
+  data: Buffer,
+  interceptors?: Interceptor<T, DeleteArtifactRequest, DeleteArtifactResponse>[]
+) {
+  let request: DeleteArtifactRequest;
+  let response: DeleteArtifactResponse;
+
+  try {
+    request = DeleteArtifactRequest.fromBinary(data);
+  } catch (e) {
+    if (e instanceof Error) {
+      const msg = "the protobuf request could not be decoded";
+      throw new TwirpError(TwirpErrorCode.Malformed, msg).withCause(e, true);
+    }
+  }
+
+  if (interceptors && interceptors.length > 0) {
+    const interceptor = chainInterceptors(...interceptors) as Interceptor<
+      T,
+      DeleteArtifactRequest,
+      DeleteArtifactResponse
+    >;
+    response = await interceptor(ctx, request!, (ctx, inputReq) => {
+      return service.DeleteArtifact(ctx, inputReq);
+    });
+  } else {
+    response = await service.DeleteArtifact(ctx, request!);
+  }
+
+  return Buffer.from(DeleteArtifactResponse.toBinary(response));
+}

packages/artifact/src/internal/client.ts

@@ -8,13 +8,18 @@ import {
   ListArtifactsOptions,
   ListArtifactsResponse,
   DownloadArtifactResponse,
-  FindOptions
+  FindOptions,
+  DeleteArtifactResponse
 } from './shared/interfaces'
 import {uploadArtifact} from './upload/upload-artifact'
 import {
   downloadArtifactPublic,
   downloadArtifactInternal
 } from './download/download-artifact'
+import {
+  deleteArtifactPublic,
+  deleteArtifactInternal
+} from './delete/delete-artifact'
 import {getArtifactPublic, getArtifactInternal} from './find/get-artifact'
 import {listArtifactsPublic, listArtifactsInternal} from './find/list-artifacts'
 import {GHESNotSupportedError} from './shared/errors'
@@ -77,7 +82,7 @@ export interface ArtifactClient {
    *
    * If `options.findBy` is specified, this will use the public Download Artifact API https://docs.github.com/en/rest/actions/artifacts?apiVersion=2022-11-28#download-an-artifact
    *
-   * @param artifactId The name of the artifact to download
+   * @param artifactId The id of the artifact to download
    * @param options Extra options that allow for the customization of the download behavior
    * @returns single DownloadArtifactResponse object
    */
@@ -85,6 +90,20 @@ export interface ArtifactClient {
     artifactId: number,
     options?: DownloadArtifactOptions & FindOptions
   ): Promise<DownloadArtifactResponse>
+
+  /**
+   * Delete an Artifact
+   *
+   * If `options.findBy` is specified, this will use the public Delete Artifact API https://docs.github.com/en/rest/actions/artifacts?apiVersion=2022-11-28#delete-an-artifact
+   *
+   * @param artifactName The name of the artifact to delete
+   * @param options Extra options that allow for the customization of the delete behavior
+   * @returns single DeleteArtifactResponse object
+   */
+  deleteArtifact(
+    artifactName: string,
+    options?: FindOptions
+  ): Promise<DeleteArtifactResponse>
 }
 
 /**
@@ -225,4 +244,41 @@ If the error persists, please check whether Actions and API requests are operati
       throw error
     }
   }
+
+  async deleteArtifact(
+    artifactName: string,
+    options?: FindOptions
+  ): Promise<DeleteArtifactResponse> {
+    try {
+      if (isGhes()) {
+        throw new GHESNotSupportedError()
+      }
+
+      if (options?.findBy) {
+        const {
+          findBy: {repositoryOwner, repositoryName, workflowRunId, token}
+        } = options
+
+        return deleteArtifactPublic(
+          artifactName,
+          workflowRunId,
+          repositoryOwner,
+          repositoryName,
+          token
+        )
+      }
+
+      return deleteArtifactInternal(artifactName)
+    } catch (error) {
+      warning(
+        `Delete Artifact failed with error: ${error}.
+
+Errors can be temporary, so please try again and optionally run the action with debug mode enabled for more information.
+
+If the error persists, please check whether Actions and API requests are operating normally at [https://githubstatus.com](https://www.githubstatus.com).`
+      )
+
+      throw error
+    }
+  }
 }

packages/artifact/src/internal/delete/delete-artifact.ts

@@ -0,0 +1,109 @@
+import {info, debug} from '@actions/core'
+import {getOctokit} from '@actions/github'
+import {DeleteArtifactResponse} from '../shared/interfaces'
+import {getUserAgentString} from '../shared/user-agent'
+import {getRetryOptions} from '../find/retry-options'
+import {defaults as defaultGitHubOptions} from '@actions/github/lib/utils'
+import {requestLog} from '@octokit/plugin-request-log'
+import {retry} from '@octokit/plugin-retry'
+import {OctokitOptions} from '@octokit/core/dist-types/types'
+import {internalArtifactTwirpClient} from '../shared/artifact-twirp-client'
+import {getBackendIdsFromToken} from '../shared/util'
+import {
+  DeleteArtifactRequest,
+  ListArtifactsRequest,
+  StringValue
+} from '../../generated'
+import {getArtifactPublic} from '../find/get-artifact'
+import {ArtifactNotFoundError, InvalidResponseError} from '../shared/errors'
+
+export async function deleteArtifactPublic(
+  artifactName: string,
+  workflowRunId: number,
+  repositoryOwner: string,
+  repositoryName: string,
+  token: string
+): Promise<DeleteArtifactResponse> {
+  const [retryOpts, requestOpts] = getRetryOptions(defaultGitHubOptions)
+
+  const opts: OctokitOptions = {
+    log: undefined,
+    userAgent: getUserAgentString(),
+    previews: undefined,
+    retry: retryOpts,
+    request: requestOpts
+  }
+
+  const github = getOctokit(token, opts, retry, requestLog)
+
+  const getArtifactResp = await getArtifactPublic(
+    artifactName,
+    workflowRunId,
+    repositoryOwner,
+    repositoryName,
+    token
+  )
+
+  const deleteArtifactResp = await github.rest.actions.deleteArtifact({
+    owner: repositoryOwner,
+    repo: repositoryName,
+    artifact_id: getArtifactResp.artifact.id
+  })
+
+  if (deleteArtifactResp.status !== 204) {
+    throw new InvalidResponseError(
+      `Invalid response from GitHub API: ${deleteArtifactResp.status} (${deleteArtifactResp?.headers?.['x-github-request-id']})`
+    )
+  }
+
+  return {
+    id: getArtifactResp.artifact.id
+  }
+}
+
+export async function deleteArtifactInternal(
+  artifactName
+): Promise<DeleteArtifactResponse> {
+  const artifactClient = internalArtifactTwirpClient()
+
+  const {workflowRunBackendId, workflowJobRunBackendId} =
+    getBackendIdsFromToken()
+
+  const listReq: ListArtifactsRequest = {
+    workflowRunBackendId,
+    workflowJobRunBackendId,
+    nameFilter: StringValue.create({value: artifactName})
+  }
+
+  const listRes = await artifactClient.ListArtifacts(listReq)
+
+  if (listRes.artifacts.length === 0) {
+    throw new ArtifactNotFoundError(
+      `Artifact not found for name: ${artifactName}`
+    )
+  }
+
+  let artifact = listRes.artifacts[0]
+  if (listRes.artifacts.length > 1) {
+    artifact = listRes.artifacts.sort(
+      (a, b) => Number(b.databaseId) - Number(a.databaseId)
+    )[0]
+
+    debug(
+      `More than one artifact found for a single name, returning newest (id: ${artifact.databaseId})`
+    )
+  }
+
+  const req: DeleteArtifactRequest = {
+    workflowRunBackendId: artifact.workflowRunBackendId,
+    workflowJobRunBackendId: artifact.workflowJobRunBackendId,
+    name: artifact.name
+  }
+
+  const res = await artifactClient.DeleteArtifact(req)
+  info(`Artifact '${artifactName}' (ID: ${res.artifactId}) deleted`)
+
+  return {
+    id: Number(res.artifactId)
+  }
+}

packages/artifact/src/internal/find/get-artifact.ts

@@ -49,7 +49,9 @@ export async function getArtifactPublic(
 
   if (getArtifactResp.data.artifacts.length === 0) {
     throw new ArtifactNotFoundError(
-      `Artifact not found for name: ${artifactName}`
+      `Artifact not found for name: ${artifactName}
+        Please ensure that your artifact is not expired and the artifact was uploaded using a compatible version of toolkit/upload-artifact.
+        For more information, visit the GitHub Artifacts FAQ: https://github.com/actions/toolkit/blob/main/packages/artifact/docs/faq.md`
     )
   }
 
@@ -89,7 +91,9 @@ export async function getArtifactInternal(
 
   if (res.artifacts.length === 0) {
     throw new ArtifactNotFoundError(
-      `Artifact not found for name: ${artifactName}`
+      `Artifact not found for name: ${artifactName}
+        Please ensure that your artifact is not expired and the artifact was uploaded using a compatible version of toolkit/upload-artifact.
+        For more information, visit the GitHub Artifacts FAQ: https://github.com/actions/toolkit/blob/main/packages/artifact/docs/faq.md`
     )
   }
 

packages/artifact/src/internal/shared/artifact-twirp-client.ts

@@ -102,7 +102,6 @@ class ArtifactHttpClient implements Rpc {
       } catch (error) {
         if (error instanceof SyntaxError) {
           debug(`Raw Body: ${rawBody}`)
-          throw error
         }
 
         if (error instanceof UsageError) {

packages/artifact/src/internal/shared/config.ts

@@ -27,7 +27,13 @@ export function isGhes(): boolean {
   const ghUrl = new URL(
     process.env['GITHUB_SERVER_URL'] || 'https://github.com'
   )
-  return ghUrl.hostname.toUpperCase() !== 'GITHUB.COM'
+
+  const hostname = ghUrl.hostname.trimEnd().toUpperCase()
+  const isGitHubHost = hostname === 'GITHUB.COM'
+  const isGheHost = hostname.endsWith('.GHE.COM')
+  const isLocalHost = hostname.endsWith('.LOCALHOST')
+
+  return !isGitHubHost && !isGheHost && !isLocalHost
 }
 
 export function getGitHubWorkspaceDir(): string {
@@ -51,3 +57,7 @@ export function getConcurrency(): number {
   const concurrency = 16 * numCPUs
   return concurrency > 300 ? 300 : concurrency
 }
+
+export function getUploadChunkTimeout(): number {
+  return 300_000 // 5 minutes
+}

packages/artifact/src/internal/shared/interfaces.ts

@@ -147,3 +147,13 @@ export interface FindOptions {
     repositoryName: string
   }
 }
+
+/**
+ * Response from the server when deleting an artifact
+ */
+export interface DeleteArtifactResponse {
+  /**
+   * The id of the artifact that was deleted
+   */
+  id: number
+}

packages/artifact/src/internal/upload/blob-upload.ts

@@ -1,7 +1,11 @@
 import {BlobClient, BlockBlobUploadStreamOptions} from '@azure/storage-blob'
 import {TransferProgressEvent} from '@azure/core-http'
 import {ZipUploadStream} from './zip'
-import {getUploadChunkSize, getConcurrency} from '../shared/config'
+import {
+  getUploadChunkSize,
+  getConcurrency,
+  getUploadChunkTimeout
+} from '../shared/config'
 import * as core from '@actions/core'
 import * as crypto from 'crypto'
 import * as stream from 'stream'
@@ -24,6 +28,22 @@ export async function uploadZipToBlobStorage(
   zipUploadStream: ZipUploadStream
 ): Promise<BlobUploadResponse> {
   let uploadByteCount = 0
+  let lastProgressTime = Date.now()
+  const abortController = new AbortController()
+
+  const chunkTimer = async (interval: number): Promise<void> =>
+    new Promise((resolve, reject) => {
+      const timer = setInterval(() => {
+        if (Date.now() - lastProgressTime > interval) {
+          reject(new Error('Upload progress stalled.'))
+        }
+      }, interval)
+
+      abortController.signal.addEventListener('abort', () => {
+        clearInterval(timer)
+        resolve()
+      })
+    })
 
   const maxConcurrency = getConcurrency()
   const bufferSize = getUploadChunkSize()
@@ -37,11 +57,13 @@ export async function uploadZipToBlobStorage(
   const uploadCallback = (progress: TransferProgressEvent): void => {
     core.info(`Uploaded bytes ${progress.loadedBytes}`)
     uploadByteCount = progress.loadedBytes
+    lastProgressTime = Date.now()
   }
 
   const options: BlockBlobUploadStreamOptions = {
     blobHTTPHeaders: {blobContentType: 'zip'},
-    onProgress: uploadCallback
+    onProgress: uploadCallback,
+    abortSignal: abortController.signal
   }
 
   let sha256Hash: string | undefined = undefined
@@ -54,18 +76,22 @@ export async function uploadZipToBlobStorage(
   core.info('Beginning upload of artifact content to blob storage')
 
   try {
-    await blockBlobClient.uploadStream(
-      uploadStream,
-      bufferSize,
-      maxConcurrency,
-      options
-    )
+    await Promise.race([
+      blockBlobClient.uploadStream(
+        uploadStream,
+        bufferSize,
+        maxConcurrency,
+        options
+      ),
+      chunkTimer(getUploadChunkTimeout())
+    ])
   } catch (error) {
     if (NetworkError.isNetworkErrorCode(error?.code)) {
       throw new NetworkError(error?.code)
     }
-
     throw error
+  } finally {
+    abortController.abort()
   }
 
   core.info('Finished uploading artifact content to blob storage!')
@@ -79,7 +105,6 @@ export async function uploadZipToBlobStorage(
       `No data was uploaded to blob storage. Reported upload byte count is 0.`
     )
   }
-
   return {
     uploadSize: uploadByteCount,
     sha256Hash

packages/artifact/src/internal/upload/upload-zip-specification.ts

@@ -13,6 +13,12 @@ export interface UploadZipSpecification {
    * The destination path in a zip for a file
    */
   destinationPath: string
+
+  /**
+   * Information about the file
+   * https://nodejs.org/api/fs.html#class-fsstats
+   */
+  stats: fs.Stats
 }
 
 /**
@@ -75,10 +81,11 @@ export function getUploadZipSpecification(
           - file3.txt
   */
   for (let file of filesToZip) {
-    if (!fs.existsSync(file)) {
+    const stats = fs.lstatSync(file, {throwIfNoEntry: false})
+    if (!stats) {
       throw new Error(`File ${file} does not exist`)
     }
-    if (!fs.statSync(file).isDirectory()) {
+    if (!stats.isDirectory()) {
       // Normalize and resolve, this allows for either absolute or relative paths to be used
       file = normalize(file)
       file = resolve(file)
@@ -94,7 +101,8 @@ export function getUploadZipSpecification(
 
       specification.push({
         sourcePath: file,
-        destinationPath: uploadPath
+        destinationPath: uploadPath,
+        stats
       })
     } else {
       // Empty directory
@@ -103,7 +111,8 @@ export function getUploadZipSpecification(
 
       specification.push({
         sourcePath: null,
-        destinationPath: directoryPath
+        destinationPath: directoryPath,
+        stats
       })
     }
   }

packages/artifact/src/internal/upload/zip.ts

@@ -1,7 +1,7 @@
 import * as stream from 'stream'
+import {realpath} from 'fs/promises'
 import * as archiver from 'archiver'
 import * as core from '@actions/core'
-import {createReadStream} from 'fs'
 import {UploadZipSpecification} from './upload-zip-specification'
 import {getUploadChunkSize} from '../shared/config'
 
@@ -43,8 +43,14 @@ export async function createZipUploadStream(
 
   for (const file of uploadSpecification) {
     if (file.sourcePath !== null) {
-      // Add a normal file to the zip
-      zip.append(createReadStream(file.sourcePath), {
+      // Check if symlink and resolve the source path
+      let sourcePath = file.sourcePath
+      if (file.stats.isSymbolicLink()) {
+        sourcePath = await realpath(file.sourcePath)
+      }
+
+      // Add the file to the zip
+      zip.file(sourcePath, {
         name: file.destinationPath
       })
     } else {

packages/attest/LICENSE.md

@@ -0,0 +1,9 @@
+The MIT License (MIT)
+
+Copyright 2024 GitHub
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

packages/attest/README.md

@@ -0,0 +1,183 @@
+# `@actions/attest`
+
+Functions for generating signed attestations for workflow artifacts.
+
+Attestations bind some subject (a named artifact along with its digest) to a
+predicate (some assertion about that subject) using the [in-toto
+statement](https://github.com/in-toto/attestation/tree/main/spec/v1) format. A
+signature is generated for the attestation using a
+[Sigstore](https://www.sigstore.dev/)-issued signing certificate.
+
+Once the attestation has been created and signed, it will be uploaded to the GH
+attestations API and associated with the repository from which the workflow was
+initiated.
+
+See [Using artifact attestations to establish provenance for builds](https://docs.github.com/en/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds)
+for more information on artifact attestations.
+
+## Usage
+
+### `attest`
+
+The `attest` function takes the supplied subject/predicate pair and generates a
+signed attestation.
+
+```js
+const { attest } = require('@actions/attest');
+const core = require('@actions/core');
+
+async function run() {
+    // In order to persist attestations to the repo, this should be a token with
+    // repository write permissions.
+    const ghToken = core.getInput('gh-token');
+
+    const attestation = await attest({
+        subjectName: 'my-artifact-name',
+        subjectDigest: { 'sha256': '36ab4667...'},
+        predicateType: 'https://in-toto.io/attestation/release',
+        predicate: { . . . },
+        token: ghToken
+    });
+
+    console.log(attestation);
+}
+
+run();
+```
+
+The `attest` function supports the following options:
+
+```typescript
+export type AttestOptions = {
+  // The name of the subject to be attested.
+  subjectName: string
+  // The digest of the subject to be attested. Should be a map of digest
+  // algorithms to their hex-encoded values.
+  subjectDigest: Record<string, string>
+  // URI identifying the content type of the predicate being attested.
+  predicateType: string
+  // Predicate to be attested.
+  predicate: object
+  // GitHub token for writing attestations.
+  token: string
+  // Sigstore instance to use for signing. Must be one of "public-good" or
+  // "github".
+  sigstore?: 'public-good' | 'github'
+  // HTTP headers to include in request to attestations API.
+  headers?: {[header: string]: string | number | undefined}
+  // Whether to skip writing the attestation to the GH attestations API.
+  skipWrite?: boolean
+}
+```
+
+### `attestProvenance`
+
+The `attestProvenance` function accepts the name and digest of some artifact and
+generates a build provenance attestation over those values.
+
+The attestation is formed by first generating a [SLSA provenance
+predicate](https://slsa.dev/spec/v1.0/provenance) populated with
+[metadata](https://github.com/slsa-framework/github-actions-buildtypes/tree/main/workflow/v1)
+pulled from the GitHub Actions run.
+
+```js
+const { attestProvenance } = require('@actions/attest');
+const core = require('@actions/core');
+
+async function run() {
+    // In order to persist attestations to the repo, this should be a token with
+    // repository write permissions.
+    const ghToken = core.getInput('gh-token');
+
+    const attestation = await attestProvenance({
+        subjectName: 'my-artifact-name',
+        subjectDigest: { 'sha256': '36ab4667...'},
+        token: ghToken
+    });
+
+    console.log(attestation);
+}
+
+run();
+```
+
+The `attestProvenance` function supports the following options:
+
+```typescript
+export type AttestProvenanceOptions = {
+  // The name of the subject to be attested.
+  subjectName: string
+  // The digest of the subject to be attested. Should be a map of digest
+  // algorithms to their hex-encoded values.
+  subjectDigest: Record<string, string>
+  // GitHub token for writing attestations.
+  token: string
+  // Sigstore instance to use for signing. Must be one of "public-good" or
+  // "github".
+  sigstore?: 'public-good' | 'github'
+  // HTTP headers to include in request to attestations API.
+  headers?: {[header: string]: string | number | undefined}
+  // Whether to skip writing the attestation to the GH attestations API.
+  skipWrite?: boolean
+  // Issuer URL responsible for minting the OIDC token from which the
+  // provenance data is read. Defaults to
+  // 'https://token.actions.githubusercontent.com".
+  issuer?: string
+}
+```
+
+### `Attestation`
+
+The `Attestation` returned by `attest`/`attestProvenance` has the following
+fields:
+
+```typescript
+export type Attestation = {
+  /*
+   * JSON-serialized Sigstore bundle containing the provenance attestation,
+   * signature, signing certificate and witnessed timestamp.
+   */
+  bundle: SerializedBundle
+  /*
+   * PEM-encoded signing certificate used to sign the attestation.
+   */
+  certificate: string
+  /*
+   * ID of Rekor transparency log entry created for the attestation (if
+   * applicable).
+   */
+  tlogID?: string
+  /*
+   * ID of the persisted attestation (accessible via the GH API).
+   */
+  attestationID?: string
+}
+```
+
+For details about the Sigstore bundle format, see the [Bundle protobuf
+specification](https://github.com/sigstore/protobuf-specs/blob/main/protos/sigstore_bundle.proto).
+
+## Sigstore Instance
+
+When generating the signed attestation there are two different Sigstore
+instances which can be used to issue the signing certificate. By default,
+workflows initiated from public repositories will use the Sigstore public-good
+instance and persist the attestation signature to the public [Rekor transparency
+log](https://docs.sigstore.dev/logging/overview/). Workflows initiated from
+private/internal repositories will use the GitHub-internal Sigstore instance
+which uses a signed timestamp issued by GitHub's timestamp authority in place of
+the public transparency log.
+
+The default Sigstore instance selection can be overridden by passing an explicit
+value of either "public-good" or "github" for the `sigstore` option when calling
+either `attest` or `attestProvenance`.
+
+## Storage
+
+Attestations created by `attest`/`attestProvenance` will be uploaded to the GH
+attestations API and associated with the appropriate repository. Attestation
+storage is only supported for public repositories or repositories which belong
+to a GitHub Enterprise Cloud account.
+
+In order to generate attestations for private, non-Enterprise repositories, the
+`skipWrite` option should be set to `true`.

packages/attest/RELEASES.md

@@ -0,0 +1,43 @@
+# @actions/attest Releases
+
+### 1.4.2
+
+- Fix bug in `buildSLSAProvenancePredicate`/`attestProvenance` when generating provenance statement for enterprise account using customized OIDC issuer value [#1823](https://github.com/actions/toolkit/pull/1823)
+### 1.4.1
+
+- Bump @actions/http-client from 2.2.1 to 2.2.3 [#1805](https://github.com/actions/toolkit/pull/1805)
+
+### 1.4.0
+
+- Add new `headers` parameter to the `attest` and `attestProvenance` functions [#1790](https://github.com/actions/toolkit/pull/1790)
+- Update `buildSLSAProvenancePredicate`/`attestProvenance` to automatically derive default OIDC issuer URL from current execution context [#1796](https://github.com/actions/toolkit/pull/1796)
+### 1.3.1
+
+- Fix bug with proxy support when retrieving JWKS for OIDC issuer [#1776](https://github.com/actions/toolkit/pull/1776)
+
+### 1.3.0
+
+- Dynamic construction of Sigstore API URLs [#1735](https://github.com/actions/toolkit/pull/1735)
+- Switch to new GH provenance build type [#1745](https://github.com/actions/toolkit/pull/1745)
+- Fetch existing Rekor entry on 409 conflict error [#1759](https://github.com/actions/toolkit/pull/1759)
+- Bump @sigstore/bundle from 2.3.0 to 2.3.2 [#1738](https://github.com/actions/toolkit/pull/1738)
+- Bump @sigstore/sign from 2.3.0 to 2.3.2 [#1738](https://github.com/actions/toolkit/pull/1738)
+
+### 1.2.1
+
+- Retry request on attestation persistence failure [#1725](https://github.com/actions/toolkit/pull/1725)
+
+### 1.2.0
+
+- Generate attestations using the v0.3 Sigstore bundle format [#1701](https://github.com/actions/toolkit/pull/1701)
+- Bump @sigstore/bundle from 2.2.0 to 2.3.0 [#1701](https://github.com/actions/toolkit/pull/1701)
+- Bump @sigstore/sign from 2.2.3 to 2.3.0 [#1701](https://github.com/actions/toolkit/pull/1701)
+- Remove dependency on make-fetch-happen [#1714](https://github.com/actions/toolkit/pull/1714)
+
+### 1.1.0
+
+- Updates the `attestProvenance` function to retrieve a token from the GitHub OIDC provider and use the token claims to populate the provenance statement [#1693](https://github.com/actions/toolkit/pull/1693)
+
+### 1.0.0
+
+- Initial release

packages/attest/__tests__/__snapshots__/intoto.test.ts.snap

@@ -0,0 +1,19 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`buildIntotoStatement returns an intoto statement 1`] = `
+{
+  "_type": "https://in-toto.io/Statement/v1",
+  "predicate": {
+    "key": "value",
+  },
+  "predicateType": "predicatey",
+  "subject": [
+    {
+      "digest": {
+        "sha256": "7d070f6b64d9bcc530fe99cc21eaaa4b3c364e0b2d367d7735671fa202a03b32",
+      },
+      "name": "subjecty",
+    },
+  ],
+}
+`;

packages/attest/__tests__/__snapshots__/provenance.test.ts.snap

@@ -0,0 +1,43 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`provenance functions buildSLSAProvenancePredicate returns a provenance hydrated from an OIDC token 1`] = `
+{
+  "params": {
+    "buildDefinition": {
+      "buildType": "https://actions.github.io/buildtypes/workflow/v1",
+      "externalParameters": {
+        "workflow": {
+          "path": ".github/workflows/main.yml",
+          "ref": "main",
+          "repository": "https://foo.ghe.com/owner/repo",
+        },
+      },
+      "internalParameters": {
+        "github": {
+          "event_name": "push",
+          "repository_id": "repo-id",
+          "repository_owner_id": "owner-id",
+          "runner_environment": "github-hosted",
+        },
+      },
+      "resolvedDependencies": [
+        {
+          "digest": {
+            "gitCommit": "babca52ab0c93ae16539e5923cb0d7403b9a093b",
+          },
+          "uri": "git+https://foo.ghe.com/owner/repo@refs/heads/main",
+        },
+      ],
+    },
+    "runDetails": {
+      "builder": {
+        "id": "https://foo.ghe.com/owner/workflows/.github/workflows/publish.yml@main",
+      },
+      "metadata": {
+        "invocationId": "https://foo.ghe.com/owner/repo/actions/runs/run-id/attempts/run-attempt",
+      },
+    },
+  },
+  "type": "https://slsa.dev/provenance/v1",
+}
+`;

packages/attest/__tests__/endpoints.test.ts

@@ -0,0 +1,41 @@
+import {signingEndpoints} from '../src/endpoints'
+
+describe('signingEndpoints', () => {
+  const originalEnv = process.env
+
+  afterEach(() => {
+    process.env = originalEnv
+  })
+
+  describe('when using github.com', () => {
+    beforeEach(async () => {
+      process.env = {
+        ...originalEnv,
+        GITHUB_SERVER_URL: 'https://github.com'
+      }
+    })
+
+    it('returns expected endpoints', async () => {
+      const endpoints = signingEndpoints('github')
+
+      expect(endpoints.fulcioURL).toEqual('https://fulcio.githubapp.com')
+      expect(endpoints.tsaServerURL).toEqual('https://timestamp.githubapp.com')
+    })
+  })
+
+  describe('when using custom domain', () => {
+    beforeEach(async () => {
+      process.env = {
+        ...originalEnv,
+        GITHUB_SERVER_URL: 'https://foo.bar.com'
+      }
+    })
+
+    it('returns a expected endpoints', async () => {
+      const endpoints = signingEndpoints('github')
+
+      expect(endpoints.fulcioURL).toEqual('https://fulcio.foo.bar.com')
+      expect(endpoints.tsaServerURL).toEqual('https://timestamp.foo.bar.com')
+    })
+  })
+})

packages/attest/__tests__/index.test.ts

@@ -0,0 +1,6 @@
+import {attest, attestProvenance} from '../src'
+
+it('exports functions', () => {
+  expect(attestProvenance).toBeInstanceOf(Function)
+  expect(attest).toBeInstanceOf(Function)
+})

packages/attest/__tests__/intoto.test.ts

@@ -0,0 +1,23 @@
+import {buildIntotoStatement} from '../src/intoto'
+import type {Predicate, Subject} from '../src/shared.types'
+
+describe('buildIntotoStatement', () => {
+  const subject: Subject = {
+    name: 'subjecty',
+    digest: {
+      sha256: '7d070f6b64d9bcc530fe99cc21eaaa4b3c364e0b2d367d7735671fa202a03b32'
+    }
+  }
+
+  const predicate: Predicate = {
+    type: 'predicatey',
+    params: {
+      key: 'value'
+    }
+  }
+
+  it('returns an intoto statement', () => {
+    const statement = buildIntotoStatement(subject, predicate)
+    expect(statement).toMatchSnapshot()
+  })
+})

packages/attest/__tests__/oidc.test.ts

@@ -0,0 +1,199 @@
+import * as jose from 'jose'
+import nock from 'nock'
+import {getIDTokenClaims} from '../src/oidc'
+
+describe('getIDTokenClaims', () => {
+  const originalEnv = process.env
+  const issuer = 'https://example.com'
+  const audience = 'nobody'
+  const requestToken = 'token'
+  const openidConfigPath = '/.well-known/openid-configuration'
+  const jwksPath = '/.well-known/jwks.json'
+  const tokenPath = '/token'
+  const openIDConfig = {jwks_uri: `${issuer}${jwksPath}`}
+
+  /* eslint-disable-next-line @typescript-eslint/no-explicit-any */
+  let key: any
+
+  beforeEach(async () => {
+    process.env = {
+      ...originalEnv,
+      ACTIONS_ID_TOKEN_REQUEST_URL: `${issuer}${tokenPath}?`,
+      ACTIONS_ID_TOKEN_REQUEST_TOKEN: requestToken
+    }
+
+    // Generate JWT signing key
+    key = await jose.generateKeyPair('PS256')
+
+    // Create JWK and JWKS
+    const jwk = await jose.exportJWK(key.publicKey)
+    const jwks = {keys: [jwk]}
+
+    nock(issuer).get(openidConfigPath).reply(200, openIDConfig)
+    nock(issuer).get(jwksPath).reply(200, jwks)
+  })
+
+  afterEach(() => {
+    process.env = originalEnv
+  })
+
+  describe('when ID token is valid', () => {
+    const claims = {
+      iss: issuer,
+      aud: audience,
+      ref: 'ref',
+      sha: 'sha',
+      repository: 'repo',
+      event_name: 'push',
+      job_workflow_ref: 'job_workflow_ref',
+      workflow_ref: 'workflow',
+      repository_id: '1',
+      repository_owner_id: '1',
+      runner_environment: 'github-hosted',
+      run_id: '1',
+      run_attempt: '1'
+    }
+
+    beforeEach(async () => {
+      const jwt = await new jose.SignJWT(claims)
+        .setProtectedHeader({alg: 'PS256'})
+        .sign(key.privateKey)
+
+      nock(issuer).get(tokenPath).query({audience}).reply(200, {value: jwt})
+    })
+
+    it('returns the ID token claims', async () => {
+      const result = await getIDTokenClaims(issuer)
+      expect(result).toEqual(claims)
+    })
+  })
+
+  describe('when ID token is valid (w/ enterprise slug)', () => {
+    const claims = {
+      iss: `${issuer}/foo-bar`,
+      aud: audience,
+      ref: 'ref',
+      sha: 'sha',
+      repository: 'repo',
+      event_name: 'push',
+      job_workflow_ref: 'job_workflow_ref',
+      workflow_ref: 'workflow',
+      repository_id: '1',
+      repository_owner_id: '1',
+      runner_environment: 'github-hosted',
+      run_id: '1',
+      run_attempt: '1'
+    }
+
+    beforeEach(async () => {
+      const jwt = await new jose.SignJWT(claims)
+        .setProtectedHeader({alg: 'PS256'})
+        .sign(key.privateKey)
+
+      nock(issuer).get(tokenPath).query({audience}).reply(200, {value: jwt})
+    })
+
+    it('returns the ID token claims', async () => {
+      const result = await getIDTokenClaims(issuer)
+      expect(result).toEqual(claims)
+    })
+  })
+
+  describe('when ID token is missing the "iss" claim', () => {
+    const claims = {
+      aud: audience
+    }
+
+    beforeEach(async () => {
+      const jwt = await new jose.SignJWT(claims)
+        .setProtectedHeader({alg: 'PS256'})
+        .sign(key.privateKey)
+
+      nock(issuer).get(tokenPath).query({audience}).reply(200, {value: jwt})
+    })
+
+    it('throws an error', async () => {
+      await expect(getIDTokenClaims(issuer)).rejects.toThrow(/missing "iss"/i)
+    })
+  })
+
+  describe('when ID token is missing required claims', () => {
+    const claims = {
+      iss: issuer,
+      aud: audience
+    }
+
+    beforeEach(async () => {
+      const jwt = await new jose.SignJWT(claims)
+        .setProtectedHeader({alg: 'PS256'})
+        .sign(key.privateKey)
+
+      nock(issuer).get(tokenPath).query({audience}).reply(200, {value: jwt})
+    })
+
+    it('throws an error', async () => {
+      await expect(getIDTokenClaims(issuer)).rejects.toThrow(/missing claims/i)
+    })
+  })
+
+  describe('when ID has the wrong issuer', () => {
+    const claims = {foo: 'bar', iss: 'foo', aud: 'nobody'}
+
+    beforeEach(async () => {
+      const jwt = await new jose.SignJWT(claims)
+        .setProtectedHeader({alg: 'PS256'})
+        .sign(key.privateKey)
+
+      nock(issuer).get(tokenPath).query({audience}).reply(200, {value: jwt})
+    })
+
+    it('throws an error', async () => {
+      await expect(getIDTokenClaims(issuer)).rejects.toThrow(
+        /unexpected "iss"/i
+      )
+    })
+  })
+
+  describe('when ID has the wrong audience', () => {
+    const claims = {foo: 'bar', iss: issuer, aud: 'bar'}
+
+    beforeEach(async () => {
+      const jwt = await new jose.SignJWT(claims)
+        .setProtectedHeader({alg: 'PS256'})
+        .sign(key.privateKey)
+
+      nock(issuer).get(tokenPath).query({audience}).reply(200, {value: jwt})
+    })
+
+    it('throw an error', async () => {
+      await expect(getIDTokenClaims(issuer)).rejects.toThrow(/unexpected "aud"/)
+    })
+  })
+
+  describe('when openid config cannot be retrieved', () => {
+    const claims = {foo: 'bar', iss: issuer, aud: 'nobody'}
+
+    beforeEach(async () => {
+      const jwt = await new jose.SignJWT(claims)
+        .setProtectedHeader({alg: 'PS256'})
+        .sign(key.privateKey)
+
+      nock(issuer).get(tokenPath).query({audience}).reply(200, {value: jwt})
+
+      // Disable the openid config endpoint
+      nock.removeInterceptor({
+        proto: 'https',
+        hostname: 'example.com',
+        port: '443',
+        method: 'GET',
+        path: openidConfigPath
+      })
+    })
+
+    it('throws an error', async () => {
+      await expect(getIDTokenClaims(issuer)).rejects.toThrow(
+        /failed to get id/i
+      )
+    })
+  })
+})

packages/attest/__tests__/provenance.test.ts

@@ -0,0 +1,248 @@
+import * as github from '@actions/github'
+import {mockFulcio, mockRekor, mockTSA} from '@sigstore/mock'
+import * as jose from 'jose'
+import nock from 'nock'
+import {MockAgent, setGlobalDispatcher} from 'undici'
+import {SIGSTORE_PUBLIC_GOOD, signingEndpoints} from '../src/endpoints'
+import {attestProvenance, buildSLSAProvenancePredicate} from '../src/provenance'
+
+describe('provenance functions', () => {
+  const originalEnv = process.env
+  const issuer = 'https://token.actions.foo.ghe.com'
+  const audience = 'nobody'
+  const jwksPath = '/.well-known/jwks.json'
+  const tokenPath = '/token'
+
+  // MockAgent for mocking @actions/github
+  const mockAgent = new MockAgent()
+  setGlobalDispatcher(mockAgent)
+
+  const claims = {
+    iss: issuer,
+    aud: 'nobody',
+    repository: 'owner/repo',
+    ref: 'refs/heads/main',
+    sha: 'babca52ab0c93ae16539e5923cb0d7403b9a093b',
+    job_workflow_ref: 'owner/workflows/.github/workflows/publish.yml@main',
+    workflow_ref: 'owner/repo/.github/workflows/main.yml@main',
+    event_name: 'push',
+    repository_id: 'repo-id',
+    repository_owner_id: 'owner-id',
+    run_id: 'run-id',
+    run_attempt: 'run-attempt',
+    runner_environment: 'github-hosted'
+  }
+
+  beforeEach(async () => {
+    process.env = {
+      ...originalEnv,
+      ACTIONS_ID_TOKEN_REQUEST_URL: `${issuer}${tokenPath}?`,
+      ACTIONS_ID_TOKEN_REQUEST_TOKEN: 'token',
+      GITHUB_SERVER_URL: 'https://foo.ghe.com',
+      GITHUB_REPOSITORY: claims.repository
+    }
+
+    // Generate JWT signing key
+    const key = await jose.generateKeyPair('PS256')
+
+    // Create JWK, JWKS, and JWT
+    const jwk = await jose.exportJWK(key.publicKey)
+    const jwks = {keys: [jwk]}
+    const jwt = await new jose.SignJWT(claims)
+      .setProtectedHeader({alg: 'PS256'})
+      .sign(key.privateKey)
+
+    // Mock OpenID configuration and JWKS endpoints
+    nock(issuer)
+      .get('/.well-known/openid-configuration')
+      .reply(200, {jwks_uri: `${issuer}${jwksPath}`})
+    nock(issuer).get(jwksPath).reply(200, jwks)
+
+    // Mock OIDC token endpoint for populating the provenance
+    nock(issuer).get(tokenPath).query({audience}).reply(200, {value: jwt})
+  })
+
+  afterEach(() => {
+    process.env = originalEnv
+  })
+
+  describe('buildSLSAProvenancePredicate', () => {
+    it('returns a provenance hydrated from an OIDC token', async () => {
+      const predicate = await buildSLSAProvenancePredicate()
+      expect(predicate).toMatchSnapshot()
+    })
+  })
+
+  describe('attestProvenance', () => {
+    // Subject to attest
+    const subjectName = 'subjective'
+    const subjectDigest = {
+      sha256: '7d070f6b64d9bcc530fe99cc21eaaa4b3c364e0b2d367d7735671fa202a03b32'
+    }
+
+    // Fake an OIDC token
+    const oidcPayload = {sub: 'foo@bar.com', iss: ''}
+    const oidcToken = `.${Buffer.from(JSON.stringify(oidcPayload)).toString(
+      'base64'
+    )}.}`
+
+    const attestationID = '1234567890'
+
+    beforeEach(async () => {
+      nock(issuer)
+        .get(tokenPath)
+        .query({audience: 'sigstore'})
+        .reply(200, {value: oidcToken})
+    })
+
+    describe('when using the github Sigstore instance', () => {
+      beforeEach(async () => {
+        const {fulcioURL, tsaServerURL} = signingEndpoints('github')
+
+        // Mock Sigstore
+        await mockFulcio({baseURL: fulcioURL, strict: false})
+        await mockTSA({baseURL: tsaServerURL})
+
+        mockAgent
+          .get('https://api.github.com')
+          .intercept({
+            path: /^\/repos\/.*\/.*\/attestations$/,
+            method: 'post'
+          })
+          .reply(201, {id: attestationID})
+      })
+
+      describe('when the sigstore instance is explicitly set', () => {
+        it('attests provenance', async () => {
+          const attestation = await attestProvenance({
+            subjectName,
+            subjectDigest,
+            token: 'token',
+            sigstore: 'github'
+          })
+
+          expect(attestation).toBeDefined()
+          expect(attestation.bundle).toBeDefined()
+          expect(attestation.certificate).toMatch(/-----BEGIN CERTIFICATE-----/)
+          expect(attestation.tlogID).toBeUndefined()
+          expect(attestation.attestationID).toBe(attestationID)
+        })
+      })
+
+      describe('when the sigstore instance is inferred from the repo visibility', () => {
+        const savedRepository = github.context.payload.repository
+
+        beforeEach(() => {
+          /* eslint-disable-next-line @typescript-eslint/no-explicit-any */
+          github.context.payload.repository = {visibility: 'private'} as any
+        })
+
+        afterEach(() => {
+          github.context.payload.repository = savedRepository
+        })
+
+        it('attests provenance', async () => {
+          const attestation = await attestProvenance({
+            subjectName,
+            subjectDigest,
+            token: 'token'
+          })
+
+          expect(attestation).toBeDefined()
+          expect(attestation.bundle).toBeDefined()
+          expect(attestation.certificate).toMatch(/-----BEGIN CERTIFICATE-----/)
+          expect(attestation.tlogID).toBeUndefined()
+          expect(attestation.attestationID).toBe(attestationID)
+        })
+      })
+    })
+
+    describe('when using the public-good Sigstore instance', () => {
+      const {fulcioURL, rekorURL} = SIGSTORE_PUBLIC_GOOD
+
+      beforeEach(async () => {
+        // Mock Sigstore
+        await mockFulcio({baseURL: fulcioURL, strict: false})
+        await mockRekor({baseURL: rekorURL})
+
+        // Mock GH attestations API
+        mockAgent
+          .get('https://api.github.com')
+          .intercept({
+            path: /^\/repos\/.*\/.*\/attestations$/,
+            method: 'post'
+          })
+          .reply(201, {id: attestationID})
+      })
+
+      describe('when the sigstore instance is explicitly set', () => {
+        it('attests provenance', async () => {
+          const attestation = await attestProvenance({
+            subjectName,
+            subjectDigest,
+            token: 'token',
+            sigstore: 'public-good'
+          })
+
+          expect(attestation).toBeDefined()
+          expect(attestation.bundle).toBeDefined()
+          expect(attestation.certificate).toMatch(/-----BEGIN CERTIFICATE-----/)
+          expect(attestation.tlogID).toBeDefined()
+          expect(attestation.attestationID).toBe(attestationID)
+        })
+      })
+
+      describe('when the sigstore instance is inferred from the repo visibility', () => {
+        const savedRepository = github.context.payload.repository
+
+        beforeEach(() => {
+          /* eslint-disable-next-line @typescript-eslint/no-explicit-any */
+          github.context.payload.repository = {visibility: 'public'} as any
+        })
+
+        afterEach(() => {
+          github.context.payload.repository = savedRepository
+        })
+
+        it('attests provenance', async () => {
+          const attestation = await attestProvenance({
+            subjectName,
+            subjectDigest,
+            token: 'token'
+          })
+
+          expect(attestation).toBeDefined()
+          expect(attestation.bundle).toBeDefined()
+          expect(attestation.certificate).toMatch(/-----BEGIN CERTIFICATE-----/)
+          expect(attestation.tlogID).toBeDefined()
+          expect(attestation.attestationID).toBe(attestationID)
+        })
+      })
+    })
+
+    describe('when skipWrite is set to true', () => {
+      const {fulcioURL, rekorURL} = SIGSTORE_PUBLIC_GOOD
+      beforeEach(async () => {
+        // Mock Sigstore
+        await mockFulcio({baseURL: fulcioURL, strict: false})
+        await mockRekor({baseURL: rekorURL})
+      })
+
+      it('attests provenance', async () => {
+        const attestation = await attestProvenance({
+          subjectName,
+          subjectDigest,
+          token: 'token',
+          sigstore: 'public-good',
+          skipWrite: true
+        })
+
+        expect(attestation).toBeDefined()
+        expect(attestation.bundle).toBeDefined()
+        expect(attestation.certificate).toMatch(/-----BEGIN CERTIFICATE-----/)
+        expect(attestation.tlogID).toBeDefined()
+        expect(attestation.attestationID).toBeUndefined()
+      })
+    })
+  })
+})

packages/attest/__tests__/sign.test.ts

@@ -0,0 +1,101 @@
+import {mockFulcio, mockRekor, mockTSA} from '@sigstore/mock'
+import nock from 'nock'
+import {Payload, signPayload} from '../src/sign'
+
+describe('signProvenance', () => {
+  const originalEnv = process.env
+
+  // Fake an OIDC token
+  const subject = 'foo@bar.com'
+  const oidcPayload = {sub: subject, iss: ''}
+  const oidcToken = `.${Buffer.from(JSON.stringify(oidcPayload)).toString(
+    'base64'
+  )}.}`
+
+  // Dummy provenance to be signed
+  const provenance = {
+    _type: 'https://in-toto.io/Statement/v1',
+    subject: {
+      name: 'subjective',
+      digest: {
+        sha256:
+          '7d070f6b64d9bcc530fe99cc21eaaa4b3c364e0b2d367d7735671fa202a03b32'
+      }
+    }
+  }
+
+  const payload: Payload = {
+    body: Buffer.from(JSON.stringify(provenance)),
+    type: 'application/vnd.in-toto+json'
+  }
+
+  const fulcioURL = 'https://fulcio.url'
+  const rekorURL = 'https://rekor.url'
+  const tsaServerURL = 'https://tsa.url'
+
+  beforeEach(() => {
+    // Mock OIDC token endpoint
+    const tokenURL = 'https://token.url'
+
+    process.env = {
+      ...originalEnv,
+      ACTIONS_ID_TOKEN_REQUEST_URL: tokenURL,
+      ACTIONS_ID_TOKEN_REQUEST_TOKEN: 'token'
+    }
+
+    nock(tokenURL)
+      .get('/')
+      .query({audience: 'sigstore'})
+      .reply(200, {value: oidcToken})
+  })
+
+  afterEach(() => {
+    process.env = originalEnv
+  })
+
+  describe('when visibility is public', () => {
+    beforeEach(async () => {
+      await mockFulcio({baseURL: fulcioURL, strict: false})
+      await mockRekor({baseURL: rekorURL})
+    })
+
+    it('returns a bundle', async () => {
+      const att = await signPayload(payload, {fulcioURL, rekorURL})
+
+      expect(att).toBeDefined()
+      expect(att.mediaType).toEqual(
+        'application/vnd.dev.sigstore.bundle.v0.3+json'
+      )
+
+      expect(att.content.$case).toEqual('dsseEnvelope')
+      expect(att.verificationMaterial.content.$case).toEqual('certificate')
+      expect(att.verificationMaterial.tlogEntries).toHaveLength(1)
+      expect(
+        att.verificationMaterial.timestampVerificationData?.rfc3161Timestamps
+      ).toHaveLength(0)
+    })
+  })
+
+  describe('when visibility is private', () => {
+    beforeEach(async () => {
+      await mockFulcio({baseURL: fulcioURL, strict: false})
+      await mockTSA({baseURL: tsaServerURL})
+    })
+
+    it('returns a bundle', async () => {
+      const att = await signPayload(payload, {fulcioURL, tsaServerURL})
+
+      expect(att).toBeDefined()
+      expect(att.mediaType).toEqual(
+        'application/vnd.dev.sigstore.bundle.v0.3+json'
+      )
+
+      expect(att.content.$case).toEqual('dsseEnvelope')
+      expect(att.verificationMaterial.content.$case).toEqual('certificate')
+      expect(att.verificationMaterial.tlogEntries).toHaveLength(0)
+      expect(
+        att.verificationMaterial.timestampVerificationData?.rfc3161Timestamps
+      ).toHaveLength(1)
+    })
+  })
+})

packages/attest/__tests__/store.test.ts

@@ -0,0 +1,93 @@
+import {MockAgent, setGlobalDispatcher} from 'undici'
+import {writeAttestation} from '../src/store'
+
+describe('writeAttestation', () => {
+  const originalEnv = process.env
+  const attestation = {foo: 'bar '}
+  const token = 'token'
+  const headers = {'X-GitHub-Foo': 'true'}
+
+  const mockAgent = new MockAgent()
+  setGlobalDispatcher(mockAgent)
+
+  beforeEach(() => {
+    process.env = {
+      ...originalEnv,
+      GITHUB_REPOSITORY: 'foo/bar'
+    }
+  })
+
+  afterEach(() => {
+    process.env = originalEnv
+  })
+
+  describe('when the api call is successful', () => {
+    beforeEach(() => {
+      mockAgent
+        .get('https://api.github.com')
+        .intercept({
+          path: '/repos/foo/bar/attestations',
+          method: 'POST',
+          headers: {authorization: `token ${token}`, ...headers},
+          body: JSON.stringify({bundle: attestation})
+        })
+        .reply(201, {id: '123'})
+    })
+
+    it('persists the attestation', async () => {
+      await expect(
+        writeAttestation(attestation, token, {headers})
+      ).resolves.toEqual('123')
+    })
+  })
+
+  describe('when the api call fails', () => {
+    beforeEach(() => {
+      mockAgent
+        .get('https://api.github.com')
+        .intercept({
+          path: '/repos/foo/bar/attestations',
+          method: 'POST',
+          headers: {authorization: `token ${token}`},
+          body: JSON.stringify({bundle: attestation})
+        })
+        .reply(500, 'oops')
+    })
+
+    it('throws an error', async () => {
+      await expect(
+        writeAttestation(attestation, token, {retry: 0})
+      ).rejects.toThrow(/oops/)
+    })
+  })
+
+  describe('when the api call fails but succeeds on retry', () => {
+    beforeEach(() => {
+      const pool = mockAgent.get('https://api.github.com')
+
+      pool
+        .intercept({
+          path: '/repos/foo/bar/attestations',
+          method: 'POST',
+          headers: {authorization: `token ${token}`},
+          body: JSON.stringify({bundle: attestation})
+        })
+        .reply(500, 'oops')
+        .times(1)
+
+      pool
+        .intercept({
+          path: '/repos/foo/bar/attestations',
+          method: 'POST',
+          headers: {authorization: `token ${token}`},
+          body: JSON.stringify({bundle: attestation})
+        })
+        .reply(201, {id: '123'})
+        .times(1)
+    })
+
+    it('persists the attestation', async () => {
+      await expect(writeAttestation(attestation, token)).resolves.toEqual('123')
+    })
+  })
+})

packages/attest/package.json

@@ -0,0 +1,58 @@
+{
+  "name": "@actions/attest",
+  "version": "1.4.2",
+  "description": "Actions attestation lib",
+  "keywords": [
+    "github",
+    "actions",
+    "attestation"
+  ],
+  "homepage": "https://github.com/actions/toolkit/tree/main/packages/attest",
+  "license": "MIT",
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "directories": {
+    "lib": "lib",
+    "test": "__tests__"
+  },
+  "files": [
+    "lib"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/actions/toolkit.git",
+    "directory": "packages/attest"
+  },
+  "scripts": {
+    "test": "echo \"Error: run tests from root\" && exit 1",
+    "tsc": "tsc"
+  },
+  "bugs": {
+    "url": "https://github.com/actions/toolkit/issues"
+  },
+  "devDependencies": {
+    "@sigstore/mock": "^0.7.4",
+    "@sigstore/rekor-types": "^2.0.0",
+    "@types/jsonwebtoken": "^9.0.6",
+    "nock": "^13.5.1",
+    "undici": "^5.28.4"
+  },
+  "dependencies": {
+    "@actions/core": "^1.10.1",
+    "@actions/github": "^6.0.0",
+    "@actions/http-client": "^2.2.3",
+    "@octokit/plugin-retry": "^6.0.1",
+    "@sigstore/bundle": "^2.3.2",
+    "@sigstore/sign": "^2.3.2",
+    "jose": "^5.2.3"
+  },
+  "overrides": {
+    "@octokit/plugin-retry": {
+      "@octokit/core": "^5.2.0"
+    }
+  }
+}

packages/attest/src/attest.ts

@@ -0,0 +1,103 @@
+import {bundleToJSON} from '@sigstore/bundle'
+import {X509Certificate} from 'crypto'
+import {SigstoreInstance, signingEndpoints} from './endpoints'
+import {buildIntotoStatement} from './intoto'
+import {Payload, signPayload} from './sign'
+import {writeAttestation} from './store'
+
+import type {Bundle} from '@sigstore/sign'
+import type {Attestation, Predicate, Subject} from './shared.types'
+
+const INTOTO_PAYLOAD_TYPE = 'application/vnd.in-toto+json'
+
+/**
+ * Options for attesting a subject / predicate.
+ */
+export type AttestOptions = {
+  // The name of the subject to be attested.
+  subjectName: string
+  // The digest of the subject to be attested. Should be a map of digest
+  // algorithms to their hex-encoded values.
+  subjectDigest: Record<string, string>
+  // Content type of the predicate being attested.
+  predicateType: string
+  // Predicate to be attested.
+  predicate: object
+  // GitHub token for writing attestations.
+  token: string
+  // Sigstore instance to use for signing. Must be one of "public-good" or
+  // "github".
+  sigstore?: SigstoreInstance
+  // HTTP headers to include in request to attestations API.
+  headers?: {[header: string]: string | number | undefined}
+  // Whether to skip writing the attestation to the GH attestations API.
+  skipWrite?: boolean
+}
+
+/**
+ * Generates an attestation for the given subject and predicate. The subject and
+ * predicate are combined into an in-toto statement, which is then signed using
+ * the identified Sigstore instance and stored as an attestation.
+ * @param options - The options for attestation.
+ * @returns A promise that resolves to the attestation.
+ */
+export async function attest(options: AttestOptions): Promise<Attestation> {
+  const subject: Subject = {
+    name: options.subjectName,
+    digest: options.subjectDigest
+  }
+  const predicate: Predicate = {
+    type: options.predicateType,
+    params: options.predicate
+  }
+  const statement = buildIntotoStatement(subject, predicate)
+
+  // Sign the provenance statement
+  const payload: Payload = {
+    body: Buffer.from(JSON.stringify(statement)),
+    type: INTOTO_PAYLOAD_TYPE
+  }
+  const endpoints = signingEndpoints(options.sigstore)
+  const bundle = await signPayload(payload, endpoints)
+
+  // Store the attestation
+  let attestationID: string | undefined
+  if (options.skipWrite !== true) {
+    attestationID = await writeAttestation(
+      bundleToJSON(bundle),
+      options.token,
+      {headers: options.headers}
+    )
+  }
+
+  return toAttestation(bundle, attestationID)
+}
+
+function toAttestation(bundle: Bundle, attestationID?: string): Attestation {
+  let certBytes: Buffer
+  switch (bundle.verificationMaterial.content.$case) {
+    case 'x509CertificateChain':
+      certBytes =
+        bundle.verificationMaterial.content.x509CertificateChain.certificates[0]
+          .rawBytes
+      break
+    case 'certificate':
+      certBytes = bundle.verificationMaterial.content.certificate.rawBytes
+      break
+    default:
+      throw new Error('Bundle must contain an x509 certificate')
+  }
+
+  const signingCert = new X509Certificate(certBytes)
+
+  // Collect transparency log ID if available
+  const tlogEntries = bundle.verificationMaterial.tlogEntries
+  const tlogID = tlogEntries.length > 0 ? tlogEntries[0].logIndex : undefined
+
+  return {
+    bundle: bundleToJSON(bundle),
+    certificate: signingCert.toString(),
+    tlogID,
+    attestationID
+  }
+}

packages/attest/src/endpoints.ts

@@ -0,0 +1,55 @@
+import * as github from '@actions/github'
+
+const PUBLIC_GOOD_ID = 'public-good'
+const GITHUB_ID = 'github'
+
+const FULCIO_PUBLIC_GOOD_URL = 'https://fulcio.sigstore.dev'
+const REKOR_PUBLIC_GOOD_URL = 'https://rekor.sigstore.dev'
+
+export type SigstoreInstance = typeof PUBLIC_GOOD_ID | typeof GITHUB_ID
+
+export type Endpoints = {
+  fulcioURL: string
+  rekorURL?: string
+  tsaServerURL?: string
+}
+
+export const SIGSTORE_PUBLIC_GOOD: Endpoints = {
+  fulcioURL: FULCIO_PUBLIC_GOOD_URL,
+  rekorURL: REKOR_PUBLIC_GOOD_URL
+}
+
+export const signingEndpoints = (sigstore?: SigstoreInstance): Endpoints => {
+  let instance: SigstoreInstance
+
+  // An explicitly set instance type takes precedence, but if not set, use the
+  // repository's visibility to determine the instance type.
+  if (sigstore && [PUBLIC_GOOD_ID, GITHUB_ID].includes(sigstore)) {
+    instance = sigstore
+  } else {
+    instance =
+      github.context.payload.repository?.visibility === 'public'
+        ? PUBLIC_GOOD_ID
+        : GITHUB_ID
+  }
+
+  switch (instance) {
+    case PUBLIC_GOOD_ID:
+      return SIGSTORE_PUBLIC_GOOD
+    case GITHUB_ID:
+      return buildGitHubEndpoints()
+  }
+}
+
+function buildGitHubEndpoints(): Endpoints {
+  const serverURL = process.env.GITHUB_SERVER_URL || 'https://github.com'
+  let host = new URL(serverURL).hostname
+
+  if (host === 'github.com') {
+    host = 'githubapp.com'
+  }
+  return {
+    fulcioURL: `https://fulcio.${host}`,
+    tsaServerURL: `https://timestamp.${host}`
+  }
+}

packages/attest/src/index.ts

@@ -0,0 +1,9 @@
+export {AttestOptions, attest} from './attest'
+export {
+  AttestProvenanceOptions,
+  attestProvenance,
+  buildSLSAProvenancePredicate
+} from './provenance'
+
+export type {SerializedBundle} from '@sigstore/bundle'
+export type {Attestation, Predicate, Subject} from './shared.types'

packages/attest/src/intoto.ts

@@ -0,0 +1,32 @@
+import {Predicate, Subject} from './shared.types'
+
+const INTOTO_STATEMENT_V1_TYPE = 'https://in-toto.io/Statement/v1'
+
+/**
+ * An in-toto statement.
+ * https://github.com/in-toto/attestation/blob/main/spec/v1/statement.md
+ */
+export type InTotoStatement = {
+  _type: string
+  subject: Subject[]
+  predicateType: string
+  predicate: object
+}
+
+/**
+ * Assembles the given subject and predicate into an in-toto statement.
+ * @param subject - The subject of the statement.
+ * @param predicate - The predicate of the statement.
+ * @returns The constructed in-toto statement.
+ */
+export const buildIntotoStatement = (
+  subject: Subject,
+  predicate: Predicate
+): InTotoStatement => {
+  return {
+    _type: INTOTO_STATEMENT_V1_TYPE,
+    subject: [subject],
+    predicateType: predicate.type,
+    predicate: predicate.params
+  }
+}

packages/attest/src/oidc.ts

@@ -0,0 +1,117 @@
+import {getIDToken} from '@actions/core'
+import {HttpClient} from '@actions/http-client'
+import * as jose from 'jose'
+
+const OIDC_AUDIENCE = 'nobody'
+
+const VALID_SERVER_URLS = [
+  'https://github.com',
+  new RegExp('^https://[a-z0-9-]+\\.ghe\\.com$')
+] as const
+
+const REQUIRED_CLAIMS = [
+  'iss',
+  'ref',
+  'sha',
+  'repository',
+  'event_name',
+  'job_workflow_ref',
+  'workflow_ref',
+  'repository_id',
+  'repository_owner_id',
+  'runner_environment',
+  'run_id',
+  'run_attempt'
+] as const
+
+export type ClaimSet = {[K in (typeof REQUIRED_CLAIMS)[number]]: string}
+
+type OIDCConfig = {
+  jwks_uri: string
+}
+
+export const getIDTokenClaims = async (issuer?: string): Promise<ClaimSet> => {
+  issuer = issuer || getIssuer()
+  try {
+    const token = await getIDToken(OIDC_AUDIENCE)
+    const claims = await decodeOIDCToken(token, issuer)
+    assertClaimSet(claims)
+    return claims
+  } catch (error) {
+    throw new Error(`Failed to get ID token: ${error.message}`)
+  }
+}
+
+const decodeOIDCToken = async (
+  token: string,
+  issuer: string
+): Promise<jose.JWTPayload> => {
+  // Verify and decode token
+  const jwks = jose.createLocalJWKSet(await getJWKS(issuer))
+  const {payload} = await jose.jwtVerify(token, jwks, {
+    audience: OIDC_AUDIENCE
+  })
+
+  if (!payload.iss) {
+    throw new Error('Missing "iss" claim')
+  }
+
+  // Check that the issuer STARTS WITH the expected issuer URL to account for
+  // the fact that the value may include an enterprise-specific slug
+  if (!payload.iss.startsWith(issuer)) {
+    throw new Error(`Unexpected "iss" claim: ${payload.iss}`)
+  }
+
+  return payload
+}
+
+const getJWKS = async (issuer: string): Promise<jose.JSONWebKeySet> => {
+  const client = new HttpClient('@actions/attest')
+  const config = await client.getJson<OIDCConfig>(
+    `${issuer}/.well-known/openid-configuration`
+  )
+
+  if (!config.result) {
+    throw new Error('No OpenID configuration found')
+  }
+
+  const jwks = await client.getJson<jose.JSONWebKeySet>(config.result.jwks_uri)
+
+  if (!jwks.result) {
+    throw new Error('No JWKS found for issuer')
+  }
+
+  return jwks.result
+}
+
+function assertClaimSet(claims: jose.JWTPayload): asserts claims is ClaimSet {
+  const missingClaims: string[] = []
+
+  for (const claim of REQUIRED_CLAIMS) {
+    if (!(claim in claims)) {
+      missingClaims.push(claim)
+    }
+  }
+
+  if (missingClaims.length > 0) {
+    throw new Error(`Missing claims: ${missingClaims.join(', ')}`)
+  }
+}
+
+// Derive the current OIDC issuer based on the server URL
+function getIssuer(): string {
+  const serverURL = process.env.GITHUB_SERVER_URL || 'https://github.com'
+
+  // Ensure the server URL is a valid GitHub server URL
+  if (!VALID_SERVER_URLS.some(valid_url => serverURL.match(valid_url))) {
+    throw new Error(`Invalid server URL: ${serverURL}`)
+  }
+
+  let host = new URL(serverURL).hostname
+
+  if (host === 'github.com') {
+    host = 'githubusercontent.com'
+  }
+
+  return `https://token.actions.${host}`
+}

packages/attest/src/provenance.ts

@@ -0,0 +1,95 @@
+import {attest, AttestOptions} from './attest'
+import {getIDTokenClaims} from './oidc'
+import type {Attestation, Predicate} from './shared.types'
+
+const SLSA_PREDICATE_V1_TYPE = 'https://slsa.dev/provenance/v1'
+const GITHUB_BUILD_TYPE = 'https://actions.github.io/buildtypes/workflow/v1'
+
+export type AttestProvenanceOptions = Omit<
+  AttestOptions,
+  'predicate' | 'predicateType'
+> & {
+  issuer?: string
+}
+
+/**
+ * Builds an SLSA (Supply Chain Levels for Software Artifacts) provenance
+ * predicate using the GitHub Actions Workflow build type.
+ * https://slsa.dev/spec/v1.0/provenance
+ * https://github.com/slsa-framework/github-actions-buildtypes/tree/main/workflow/v1
+ * @param issuer - URL for the OIDC issuer. Defaults to the GitHub Actions token
+ * issuer.
+ * @returns The SLSA provenance predicate.
+ */
+export const buildSLSAProvenancePredicate = async (
+  issuer?: string
+): Promise<Predicate> => {
+  const serverURL = process.env.GITHUB_SERVER_URL
+  const claims = await getIDTokenClaims(issuer)
+
+  // Split just the path and ref from the workflow string.
+  // owner/repo/.github/workflows/main.yml@main =>
+  //   .github/workflows/main.yml, main
+  const [workflowPath, workflowRef] = claims.workflow_ref
+    .replace(`${claims.repository}/`, '')
+    .split('@')
+
+  return {
+    type: SLSA_PREDICATE_V1_TYPE,
+    params: {
+      buildDefinition: {
+        buildType: GITHUB_BUILD_TYPE,
+        externalParameters: {
+          workflow: {
+            ref: workflowRef,
+            repository: `${serverURL}/${claims.repository}`,
+            path: workflowPath
+          }
+        },
+        internalParameters: {
+          github: {
+            event_name: claims.event_name,
+            repository_id: claims.repository_id,
+            repository_owner_id: claims.repository_owner_id,
+            runner_environment: claims.runner_environment
+          }
+        },
+        resolvedDependencies: [
+          {
+            uri: `git+${serverURL}/${claims.repository}@${claims.ref}`,
+            digest: {
+              gitCommit: claims.sha
+            }
+          }
+        ]
+      },
+      runDetails: {
+        builder: {
+          id: `${serverURL}/${claims.job_workflow_ref}`
+        },
+        metadata: {
+          invocationId: `${serverURL}/${claims.repository}/actions/runs/${claims.run_id}/attempts/${claims.run_attempt}`
+        }
+      }
+    }
+  }
+}
+
+/**
+ * Attests the build provenance of the provided subject. Generates the SLSA
+ * build provenance predicate, assembles it into an in-toto statement, and
+ * attests it.
+ *
+ * @param options - The options for attesting the provenance.
+ * @returns A promise that resolves to the attestation.
+ */
+export async function attestProvenance(
+  options: AttestProvenanceOptions
+): Promise<Attestation> {
+  const predicate = await buildSLSAProvenancePredicate(options.issuer)
+  return attest({
+    ...options,
+    predicateType: predicate.type,
+    predicate: predicate.params
+  })
+}

packages/attest/src/shared.types.ts

@@ -0,0 +1,52 @@
+import type {SerializedBundle} from '@sigstore/bundle'
+
+/*
+ * The subject of an attestation.
+ */
+export type Subject = {
+  /*
+   * Name of the subject.
+   */
+  name: string
+  /*
+   * Digests of the subject. Should be a map of digest algorithms to their hex-encoded values.
+   */
+  digest: Record<string, string>
+}
+
+/*
+ * The predicate of an attestation.
+ */
+export type Predicate = {
+  /*
+   * URI identifying the content type of the predicate.
+   */
+  type: string
+  /*
+   * Predicate parameters.
+   */
+  params: object
+}
+
+/*
+ * Artifact attestation.
+ */
+export type Attestation = {
+  /*
+   * Serialized Sigstore bundle containing the provenance attestation,
+   * signature, signing certificate and witnessed timestamp.
+   */
+  bundle: SerializedBundle
+  /*
+   * PEM-encoded signing certificate used to sign the attestation.
+   */
+  certificate: string
+  /*
+   * ID of Rekor transparency log entry created for the attestation.
+   */
+  tlogID?: string
+  /*
+   * ID of the persisted attestation (accessible via the GH API).
+   */
+  attestationID?: string
+}

packages/attest/src/sign.ts

@@ -0,0 +1,110 @@
+import {
+  Bundle,
+  BundleBuilder,
+  CIContextProvider,
+  DSSEBundleBuilder,
+  FulcioSigner,
+  RekorWitness,
+  TSAWitness,
+  Witness
+} from '@sigstore/sign'
+
+const OIDC_AUDIENCE = 'sigstore'
+const DEFAULT_TIMEOUT = 10000
+const DEFAULT_RETRIES = 3
+
+/**
+ * The payload to be signed (body) and its media type (type).
+ */
+export type Payload = {
+  body: Buffer
+  type: string
+}
+
+/**
+ * Options for signing a document.
+ */
+export type SignOptions = {
+  /**
+   * The URL of the Fulcio service.
+   */
+  fulcioURL: string
+  /**
+   * The URL of the Rekor service.
+   */
+  rekorURL?: string
+  /**
+   * The URL of the TSA (Time Stamping Authority) server.
+   */
+  tsaServerURL?: string
+  /**
+   * The timeout duration in milliseconds when communicating with Sigstore
+   * services.
+   */
+  timeout?: number
+  /**
+   * The number of retry attempts.
+   */
+  retry?: number
+}
+
+/**
+ * Signs the provided payload with a Sigstore-issued certificate and returns the
+ * signature bundle.
+ * @param payload Payload to be signed.
+ * @param options Signing options.
+ * @returns A promise that resolves to the Sigstore signature bundle.
+ */
+export const signPayload = async (
+  payload: Payload,
+  options: SignOptions
+): Promise<Bundle> => {
+  const artifact = {
+    data: payload.body,
+    type: payload.type
+  }
+
+  // Sign the artifact and build the bundle
+  return initBundleBuilder(options).create(artifact)
+}
+
+// Assembles the Sigstore bundle builder with the appropriate options
+const initBundleBuilder = (opts: SignOptions): BundleBuilder => {
+  const identityProvider = new CIContextProvider(OIDC_AUDIENCE)
+  const timeout = opts.timeout || DEFAULT_TIMEOUT
+  const retry = opts.retry || DEFAULT_RETRIES
+  const witnesses: Witness[] = []
+
+  const signer = new FulcioSigner({
+    identityProvider,
+    fulcioBaseURL: opts.fulcioURL,
+    timeout,
+    retry
+  })
+
+  if (opts.rekorURL) {
+    witnesses.push(
+      new RekorWitness({
+        rekorBaseURL: opts.rekorURL,
+        entryType: 'dsse',
+        fetchOnConflict: true,
+        timeout,
+        retry
+      })
+    )
+  }
+
+  if (opts.tsaServerURL) {
+    witnesses.push(
+      new TSAWitness({
+        tsaBaseURL: opts.tsaServerURL,
+        timeout,
+        retry
+      })
+    )
+  }
+
+  // Build the bundle with the singleCertificate option which will
+  // trigger the creation of v0.3 DSSE bundles
+  return new DSSEBundleBuilder({signer, witnesses, singleCertificate: true})
+}

packages/attest/src/store.ts

@@ -0,0 +1,44 @@
+import * as github from '@actions/github'
+import {retry} from '@octokit/plugin-retry'
+import {RequestHeaders} from '@octokit/types'
+
+const CREATE_ATTESTATION_REQUEST = 'POST /repos/{owner}/{repo}/attestations'
+const DEFAULT_RETRY_COUNT = 5
+
+export type WriteOptions = {
+  retry?: number
+  headers?: RequestHeaders
+}
+/**
+ * Writes an attestation to the repository's attestations endpoint.
+ * @param attestation - The attestation to write.
+ * @param token - The GitHub token for authentication.
+ * @returns The ID of the attestation.
+ * @throws Error if the attestation fails to persist.
+ */
+export const writeAttestation = async (
+  attestation: unknown,
+  token: string,
+  options: WriteOptions = {}
+): Promise<string> => {
+  const retries = options.retry ?? DEFAULT_RETRY_COUNT
+  const octokit = github.getOctokit(token, {retry: {retries}}, retry)
+
+  try {
+    const response = await octokit.request(CREATE_ATTESTATION_REQUEST, {
+      owner: github.context.repo.owner,
+      repo: github.context.repo.repo,
+      headers: options.headers,
+      data: {bundle: attestation}
+    })
+
+    const data =
+      typeof response.data == 'string'
+        ? JSON.parse(response.data)
+        : response.data
+    return data?.id
+  } catch (err) {
+    const message = err instanceof Error ? err.message : err
+    throw new Error(`Failed to persist attestation: ${message}`)
+  }
+}

packages/attest/tsconfig.json

@@ -0,0 +1,12 @@
+{
+  "extends": "../../tsconfig.json",
+  "compilerOptions": {
+    "baseUrl": "./",
+    "outDir": "./lib",
+    "declaration": true,
+    "rootDir": "./src"
+  },
+  "include": [
+    "./src"
+  ]
+}

packages/cache/RELEASES.md

@@ -1,16 +1,154 @@
 # @actions/cache Releases
 
-### 0.1.0
+### 3.2.4
 
-- Initial release
+- Updated `isGhes` check to include `.ghe.com` and `.ghe.localhost` as accepted hosts
+  
+### 3.2.3
 
-### 0.2.0
+- Fixed a bug that mutated path arguments to `getCacheVersion` [#1378](https://github.com/actions/toolkit/pull/1378)
 
-- Fixes issues with the zstd compression algorithm on Windows and Ubuntu 16.04 [#469](https://github.com/actions/toolkit/pull/469)
+### 3.2.2
 
-### 0.2.1
+- Add new default cache download method to improve performance and reduce hangs [#1484](https://github.com/actions/toolkit/pull/1484)
 
-- Fix to await async function getCompressionMethod
+### 3.2.1
+
+- Updated @azure/storage-blob to `v12.13.0`
+
+### 3.2.0
+
+- Add `lookupOnly` to cache restore `DownloadOptions`.
+
+### 3.1.4
+
+- Fix zstd not being used due to `zstd --version` output change in zstd 1.5.4 release. See [#1353](https://github.com/actions/toolkit/pull/1353).
+
+### 3.1.3
+
+- Fix to prevent from setting MYSYS environement variable globally [#1329](https://github.com/actions/toolkit/pull/1329).
+
+### 3.1.2
+
+- Fix issue with symlink restoration on windows.
+
+### 3.1.1
+
+- Reverted changes in 3.1.0 to fix issue with symlink restoration on windows.
+- Added support for verbose logging about cache version during cache miss.
+
+### 3.1.0
+
+- Update actions/cache on windows to use gnu tar and zstd by default
+- Update actions/cache on windows to fallback to bsdtar and zstd if gnu tar is not available.
+- Added support for fallback to gzip to restore old caches on windows.
+
+### 3.1.0-beta.3
+
+- Bug Fixes for fallback to gzip to restore old caches on windows and bsdtar if gnutar is not available.
+
+### 3.1.0-beta.2
+
+- Added support for fallback to gzip to restore old caches on windows.
+
+### 3.0.6
+
+- Added `@azure/abort-controller` to dependencies to fix compatibility issue with ESM [#1208](https://github.com/actions/toolkit/issues/1208)
+
+### 3.0.5
+
+- Update `@actions/cache` to use `@actions/core@^1.10.0`
+
+### 3.0.4
+
+- Fix zstd not working for windows on gnu tar in issues [#888](https://github.com/actions/cache/issues/888) and [#891](https://github.com/actions/cache/issues/891).
+- Allowing users to provide a custom timeout as input for aborting download of a cache segment using an environment variable `SEGMENT_DOWNLOAD_TIMEOUT_MINS`. Default is 60 minutes.
+
+### 3.0.3
+
+- Bug fixes for download stuck issue [#810](https://github.com/actions/cache/issues/810).
+
+### 3.0.2
+
+- Added 1 hour timeout for the download stuck issue [#810](https://github.com/actions/cache/issues/810).
+
+### 3.0.1
+
+- Fix [#833](https://github.com/actions/cache/issues/833) - cache doesn't work with github workspace directory.
+- Fix [#809](https://github.com/actions/cache/issues/809) `zstd -d: no such file or directory` error on AWS self-hosted runners.
+
+### 3.0.0
+
+- Updated actions/cache to suppress Actions cache server error and log warning for those error  [#1122](https://github.com/actions/toolkit/pull/1122)
+
+### 2.0.6
+
+- Fix `Tar failed with error: The process '/usr/bin/tar' failed with exit code 1` issue when temp directory where tar is getting created is actually the subdirectory of the path mentioned by the user for caching. ([issue](https://github.com/actions/cache/issues/689))
+
+### 2.0.5
+
+- Fix to avoid saving empty cache when no files are available for caching. ([issue](https://github.com/actions/cache/issues/624))
+
+### 2.0.4
+
+- Update to v2.0.1 of `@actions/http-client` [#1087](https://github.com/actions/toolkit/pull/1087)
+
+### 2.0.3
+
+- Update to v2.0.0 of `@actions/http-client`
+
+### 2.0.0
+
+- Added support to check if Actions cache service feature is available or not [#1028](https://github.com/actions/toolkit/pull/1028)
+
+### 1.0.11
+
+- Fix file downloads > 2GB([issue](https://github.com/actions/cache/issues/773))
+
+### 1.0.10
+
+- Update `lockfileVersion` to `v2` in `package-lock.json [#1022](https://github.com/actions/toolkit/pull/1022)
+
+### 1.0.9
+
+- Use @azure/ms-rest-js v2.6.0
+- Use @azure/storage-blob v12.8.0
+
+### 1.0.8
+
+- Increase the allowed artifact cache size from 5GB to 10GB ([issue](https://github.com/actions/cache/discussions/497))
+
+### 1.0.7
+
+- Fixes permissions issue extracting archives with GNU tar on macOS ([issue](https://github.com/actions/cache/issues/527))
+
+### 1.0.6
+
+- Make caching more verbose [#650](https://github.com/actions/toolkit/pull/650)
+- Use GNU tar on macOS if available [#701](https://github.com/actions/toolkit/pull/701)
+
+### 1.0.5
+
+- Fix to ensure Windows cache paths get resolved correctly
+
+### 1.0.4
+
+- Use @actions/core v1.2.6
+- Fixes uploadChunk to throw an error if any unsuccessful response code is received
+
+### 1.0.3
+
+- Use http-client v1.0.9
+- Fixes error handling so retries are not attempted on non-retryable errors (409 Conflict, for example)
+- Adds 5 second delay between retry attempts
+
+### 1.0.2
+
+- Use posix archive format to add support for some tools
+
+### 1.0.1
+
+- Fix bug in downloading large files (> 2 GBs) with the Azure SDK
 
 ### 1.0.0
 
@@ -19,148 +157,14 @@
 - Includes changes that break compatibility with earlier versions, including:
   - `retry`, `retryTypedResponse`, and `retryHttpClientResponse` moved from `cacheHttpClient` to `requestUtils`
 
-### 1.0.1
+### 0.2.1
 
-- Fix bug in downloading large files (> 2 GBs) with the Azure SDK
+- Fix to await async function getCompressionMethod
+  
+### 0.2.0
 
-### 1.0.2
+- Fixes issues with the zstd compression algorithm on Windows and Ubuntu 16.04 [#469](https://github.com/actions/toolkit/pull/469)
+  
+### 0.1.0
 
-- Use posix archive format to add support for some tools
-
-### 1.0.3
-
-- Use http-client v1.0.9
-- Fixes error handling so retries are not attempted on non-retryable errors (409 Conflict, for example)
-- Adds 5 second delay between retry attempts
-
-### 1.0.4
-
-- Use @actions/core v1.2.6
-- Fixes uploadChunk to throw an error if any unsuccessful response code is received
-
-### 1.0.5
-
-- Fix to ensure Windows cache paths get resolved correctly
-
-### 1.0.6
-
-- Make caching more verbose [#650](https://github.com/actions/toolkit/pull/650)
-- Use GNU tar on macOS if available [#701](https://github.com/actions/toolkit/pull/701)
-
-### 1.0.7
-
-- Fixes permissions issue extracting archives with GNU tar on macOS ([issue](https://github.com/actions/cache/issues/527))
-
-### 1.0.8
-
-- Increase the allowed artifact cache size from 5GB to 10GB ([issue](https://github.com/actions/cache/discussions/497))
-
-### 1.0.9
-
-- Use @azure/ms-rest-js v2.6.0
-- Use @azure/storage-blob v12.8.0
-
-### 1.0.10
-
-- Update `lockfileVersion` to `v2` in `package-lock.json [#1022](https://github.com/actions/toolkit/pull/1022)
-
-### 1.0.11
-
-- Fix file downloads > 2GB([issue](https://github.com/actions/cache/issues/773))
-
-### 2.0.0
-
-- Added support to check if Actions cache service feature is available or not [#1028](https://github.com/actions/toolkit/pull/1028)
-
-### 2.0.3
-
-- Update to v2.0.0 of `@actions/http-client`
-
-### 2.0.4
-
-- Update to v2.0.1 of `@actions/http-client` [#1087](https://github.com/actions/toolkit/pull/1087)
-
-### 2.0.5
-
-- Fix to avoid saving empty cache when no files are available for caching. ([issue](https://github.com/actions/cache/issues/624))
-
-### 2.0.6
-
-- Fix `Tar failed with error: The process '/usr/bin/tar' failed with exit code 1` issue when temp directory where tar is getting created is actually the subdirectory of the path mentioned by the user for caching. ([issue](https://github.com/actions/cache/issues/689))
-
-### 3.0.0
-
-- Updated actions/cache to suppress Actions cache server error and log warning for those error  [#1122](https://github.com/actions/toolkit/pull/1122)
-
-### 3.0.1
-
-- Fix [#833](https://github.com/actions/cache/issues/833) - cache doesn't work with github workspace directory.
-- Fix [#809](https://github.com/actions/cache/issues/809) `zstd -d: no such file or directory` error on AWS self-hosted runners.
-
-### 3.0.2
-
-- Added 1 hour timeout for the download stuck issue [#810](https://github.com/actions/cache/issues/810).
-
-### 3.0.3
-
-- Bug fixes for download stuck issue [#810](https://github.com/actions/cache/issues/810).
-
-### 3.0.4
-
-- Fix zstd not working for windows on gnu tar in issues [#888](https://github.com/actions/cache/issues/888) and [#891](https://github.com/actions/cache/issues/891).
-- Allowing users to provide a custom timeout as input for aborting download of a cache segment using an environment variable `SEGMENT_DOWNLOAD_TIMEOUT_MINS`. Default is 60 minutes.
-
-### 3.0.5
-
-- Update `@actions/cache` to use `@actions/core@^1.10.0`
-
-### 3.0.6
-
-- Added `@azure/abort-controller` to dependencies to fix compatibility issue with ESM [#1208](https://github.com/actions/toolkit/issues/1208)
-
-### 3.1.0-beta.1
-
-- Update actions/cache on windows to use gnu tar and zstd by default and fallback to bsdtar and zstd if gnu tar is not available. ([issue](https://github.com/actions/cache/issues/984))
-
-### 3.1.0-beta.2
-
-- Added support for fallback to gzip to restore old caches on windows.
-
-### 3.1.0-beta.3
-
-- Bug Fixes for fallback to gzip to restore old caches on windows and bsdtar if gnutar is not available.
-
-### 3.1.0
-
-- Update actions/cache on windows to use gnu tar and zstd by default
-- Update actions/cache on windows to fallback to bsdtar and zstd if gnu tar is not available.
-- Added support for fallback to gzip to restore old caches on windows.
-
-### 3.1.1
-
-- Reverted changes in 3.1.0 to fix issue with symlink restoration on windows.
-- Added support for verbose logging about cache version during cache miss.
-
-### 3.1.2
-
-- Fix issue with symlink restoration on windows.
-
-### 3.1.3
-
-- Fix to prevent from setting MYSYS environement variable globally [#1329](https://github.com/actions/toolkit/pull/1329).
-
-### 3.1.4
-
-- Fix zstd not being used due to `zstd --version` output change in zstd 1.5.4 release. See [#1353](https://github.com/actions/toolkit/pull/1353).
-
-### 3.2.0
-
-- Add `lookupOnly` to cache restore `DownloadOptions`.
-
-### 3.2.1
-
-- Updated @azure/storage-blob to `v12.13.0`
-
-### 3.2.2
-
-- Add new default cache download method to improve performance and reduce hangs [#1484](https://github.com/actions/toolkit/pull/1484)
+- Initial release

packages/cache/__tests__/cacheHttpClient.test.ts

@@ -5,6 +5,12 @@ import {DownloadOptions, getDownloadOptions} from '../src/options'
 
 jest.mock('../src/internal/downloadUtils')
 
+test('getCacheVersion does not mutate arguments', async () => {
+  const paths = ['node_modules']
+  getCacheVersion(paths, undefined, true)
+  expect(paths).toEqual(['node_modules'])
+})
+
 test('getCacheVersion with one path returns version', async () => {
   const paths = ['node_modules']
   const result = getCacheVersion(paths, undefined, true)

packages/cache/__tests__/cacheUtils.test.ts

@@ -2,6 +2,10 @@ import {promises as fs} from 'fs'
 import * as path from 'path'
 import * as cacheUtils from '../src/internal/cacheUtils'
 
+beforeEach(() => {
+  jest.resetModules()
+})
+
 test('getArchiveFileSizeInBytes returns file size', () => {
   const filePath = path.join(__dirname, '__fixtures__', 'helloWorld.txt')
 
@@ -38,3 +42,23 @@ test('resolvePaths works on github workspace directory', async () => {
   const paths = await cacheUtils.resolvePaths([workspace])
   expect(paths.length).toBeGreaterThan(0)
 })
+
+test('isGhes returns false for github.com', async () => {
+  process.env.GITHUB_SERVER_URL = 'https://github.com'
+  expect(cacheUtils.isGhes()).toBe(false)
+})
+
+test('isGhes returns false for ghe.com', async () => {
+  process.env.GITHUB_SERVER_URL = 'https://somedomain.ghe.com'
+  expect(cacheUtils.isGhes()).toBe(false)
+})
+
+test('isGhes returns true for enterprise URL', async () => {
+  process.env.GITHUB_SERVER_URL = 'https://my-enterprise.github.com'
+  expect(cacheUtils.isGhes()).toBe(true)
+})
+
+test('isGhes returns false for ghe.localhost', () => {
+  process.env.GITHUB_SERVER_URL = 'https://my.domain.ghe.localhost'
+  expect(cacheUtils.isGhes()).toBe(false)
+})

packages/cache/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@actions/cache",
-  "version": "3.2.2",
+  "version": "3.2.4",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {
     "": {
       "name": "@actions/cache",
-      "version": "3.2.2",
+      "version": "3.2.4",
       "license": "MIT",
       "dependencies": {
         "@actions/core": "^1.10.0",
@@ -17,12 +17,10 @@
         "@azure/abort-controller": "^1.1.0",
         "@azure/ms-rest-js": "^2.6.0",
         "@azure/storage-blob": "^12.13.0",
-        "semver": "^6.3.1",
-        "uuid": "^3.3.3"
+        "semver": "^6.3.1"
       },
       "devDependencies": {
         "@types/semver": "^6.0.0",
-        "@types/uuid": "^3.4.5",
         "typescript": "^5.2.2"
       }
     },
@@ -296,12 +294,6 @@
         "@types/node": "*"
       }
     },
-    "node_modules/@types/uuid": {
-      "version": "3.4.10",
-      "resolved": "https://registry.npmjs.org/@types/uuid/-/uuid-3.4.10.tgz",
-      "integrity": "sha512-BgeaZuElf7DEYZhWYDTc/XcLZXdVgFkVSTa13BqKvbnmUrxr3TJFKofUxCtDO9UQOdhnV+HPOESdHiHKZOJV1A==",
-      "dev": true
-    },
     "node_modules/abort-controller": {
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/abort-controller/-/abort-controller-3.0.0.tgz",
@@ -486,15 +478,6 @@
         "node": ">=14.17"
       }
     },
-    "node_modules/uuid": {
-      "version": "3.4.0",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-3.4.0.tgz",
-      "integrity": "sha512-HjSDRw6gZE5JMggctHBcjVak08+KEVhSIiDzFnT9S9aegmp85S/bReBVTb4QTFaRNptJ9kuYaNhnbNEOkbKb/A==",
-      "deprecated": "Please upgrade  to version 7 or higher.  Older versions may use Math.random() in certain circumstances, which is known to be problematic.  See https://v8.dev/blog/math-random for details.",
-      "bin": {
-        "uuid": "bin/uuid"
-      }
-    },
     "node_modules/webidl-conversions": {
       "version": "3.0.1",
       "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-3.0.1.tgz",
@@ -764,12 +747,6 @@
         "@types/node": "*"
       }
     },
-    "@types/uuid": {
-      "version": "3.4.10",
-      "resolved": "https://registry.npmjs.org/@types/uuid/-/uuid-3.4.10.tgz",
-      "integrity": "sha512-BgeaZuElf7DEYZhWYDTc/XcLZXdVgFkVSTa13BqKvbnmUrxr3TJFKofUxCtDO9UQOdhnV+HPOESdHiHKZOJV1A==",
-      "dev": true
-    },
     "abort-controller": {
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/abort-controller/-/abort-controller-3.0.0.tgz",
@@ -900,11 +877,6 @@
       "integrity": "sha512-mI4WrpHsbCIcwT9cF4FZvr80QUeKvsUsUvKDoR+X/7XHQH98xYD8YHZg7ANtz2GtZt/CBq2QJ0thkGJMHfqc1w==",
       "dev": true
     },
-    "uuid": {
-      "version": "3.4.0",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-3.4.0.tgz",
-      "integrity": "sha512-HjSDRw6gZE5JMggctHBcjVak08+KEVhSIiDzFnT9S9aegmp85S/bReBVTb4QTFaRNptJ9kuYaNhnbNEOkbKb/A=="
-    },
     "webidl-conversions": {
       "version": "3.0.1",
       "resolved": "https://registry.npmjs.org/webidl-conversions/-/webidl-conversions-3.0.1.tgz",

packages/cache/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actions/cache",
-  "version": "3.2.2",
+  "version": "3.2.4",
   "preview": true,
   "description": "Actions cache lib",
   "keywords": [
@@ -45,12 +45,10 @@
     "@azure/abort-controller": "^1.1.0",
     "@azure/ms-rest-js": "^2.6.0",
     "@azure/storage-blob": "^12.13.0",
-    "semver": "^6.3.1",
-    "uuid": "^3.3.3"
+    "semver": "^6.3.1"
   },
   "devDependencies": {
     "@types/semver": "^6.0.0",
-    "@types/uuid": "^3.4.5",
     "typescript": "^5.2.2"
   }
 }

packages/cache/src/internal/cacheHttpClient.ts

@@ -80,7 +80,8 @@ export function getCacheVersion(
   compressionMethod?: CompressionMethod,
   enableCrossOsArchive = false
 ): string {
-  const components = paths
+  // don't pass changes upstream
+  const components = paths.slice()
 
   // Add compression method to cache version to restore
   // compressed cache as per compression method

packages/cache/src/internal/cacheUtils.ts

@@ -2,11 +2,11 @@ import * as core from '@actions/core'
 import * as exec from '@actions/exec'
 import * as glob from '@actions/glob'
 import * as io from '@actions/io'
+import * as crypto from 'crypto'
 import * as fs from 'fs'
 import * as path from 'path'
 import * as semver from 'semver'
 import * as util from 'util'
-import {v4 as uuidV4} from 'uuid'
 import {
   CacheFilename,
   CompressionMethod,
@@ -34,7 +34,7 @@ export async function createTempDirectory(): Promise<string> {
     tempDirectory = path.join(baseLocation, 'actions', 'temp')
   }
 
-  const dest = path.join(tempDirectory, uuidV4())
+  const dest = path.join(tempDirectory, crypto.randomUUID())
   await io.mkdirP(dest)
   return dest
 }
@@ -135,5 +135,11 @@ export function isGhes(): boolean {
   const ghUrl = new URL(
     process.env['GITHUB_SERVER_URL'] || 'https://github.com'
   )
-  return ghUrl.hostname.toUpperCase() !== 'GITHUB.COM'
+
+  const hostname = ghUrl.hostname.trimEnd().toUpperCase()
+  const isGitHubHost = hostname === 'GITHUB.COM'
+  const isGheHost =
+    hostname.endsWith('.GHE.COM') || hostname.endsWith('.GHE.LOCALHOST')
+
+  return !isGitHubHost && !isGheHost
 }

packages/core/RELEASES.md

@@ -1,5 +1,12 @@
 # @actions/core Releases
 
+### 1.11.1
+- Fix uses of `crypto.randomUUID` on Node 18 and earlier [#1842](https://github.com/actions/toolkit/pull/1842)
+
+### 1.11.0
+- Add platform info utilities [#1551](https://github.com/actions/toolkit/pull/1551)
+- Remove dependency on `uuid` package [#1824](https://github.com/actions/toolkit/pull/1824)
+
 ### 1.10.1
 - Fix error message reference in oidc utils [#1511](https://github.com/actions/toolkit/pull/1511)
 

packages/core/__tests__/core.test.ts

@@ -4,9 +4,6 @@ import * as path from 'path'
 import * as core from '../src/core'
 import {HttpClient} from '@actions/http-client'
 import {toCommandProperties} from '../src/utils'
-import * as uuid from 'uuid'
-
-jest.mock('uuid')
 
 /* eslint-disable @typescript-eslint/unbound-method */
 
@@ -49,11 +46,23 @@ const testEnvVars = {
 const UUID = '9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d'
 const DELIMITER = `ghadelimiter_${UUID}`
 
+jest.mock('crypto', () => ({
+  ...jest.requireActual('crypto'),
+  randomUUID: jest.fn(() => UUID)
+}))
+
+const TEMP_DIR = path.join(__dirname, '_temp')
+
 describe('@actions/core', () => {
   beforeAll(() => {
-    const filePath = path.join(__dirname, `test`)
+    const filePath = TEMP_DIR
     if (!fs.existsSync(filePath)) {
       fs.mkdirSync(filePath)
+    } else {
+      // Clear out the temp directory
+      for (const file of fs.readdirSync(filePath)) {
+        fs.unlinkSync(path.join(filePath, file))
+      }
     }
   })
 
@@ -62,10 +71,6 @@ describe('@actions/core', () => {
       process.env[key] = testEnvVars[key as keyof typeof testEnvVars]
     }
     process.stdout.write = jest.fn()
-
-    jest.spyOn(uuid, 'v4').mockImplementation(() => {
-      return UUID
-    })
   })
 
   afterEach(() => {
@@ -141,7 +146,7 @@ describe('@actions/core', () => {
       `Unexpected input: value should not contain the delimiter "${DELIMITER}"`
     )
 
-    const filePath = path.join(__dirname, `test/${command}`)
+    const filePath = path.join(TEMP_DIR, command)
     fs.unlinkSync(filePath)
   })
 
@@ -155,7 +160,7 @@ describe('@actions/core', () => {
       `Unexpected input: name should not contain the delimiter "${DELIMITER}"`
     )
 
-    const filePath = path.join(__dirname, `test/${command}`)
+    const filePath = path.join(TEMP_DIR, command)
     fs.unlinkSync(filePath)
   })
 
@@ -347,7 +352,7 @@ describe('@actions/core', () => {
       `Unexpected input: value should not contain the delimiter "${DELIMITER}"`
     )
 
-    const filePath = path.join(__dirname, `test/${command}`)
+    const filePath = path.join(TEMP_DIR, command)
     fs.unlinkSync(filePath)
   })
 
@@ -361,7 +366,7 @@ describe('@actions/core', () => {
       `Unexpected input: name should not contain the delimiter "${DELIMITER}"`
     )
 
-    const filePath = path.join(__dirname, `test/${command}`)
+    const filePath = path.join(TEMP_DIR, command)
     fs.unlinkSync(filePath)
   })
 
@@ -585,7 +590,7 @@ describe('@actions/core', () => {
       `Unexpected input: value should not contain the delimiter "${DELIMITER}"`
     )
 
-    const filePath = path.join(__dirname, `test/${command}`)
+    const filePath = path.join(TEMP_DIR, command)
     fs.unlinkSync(filePath)
   })
 
@@ -599,7 +604,7 @@ describe('@actions/core', () => {
       `Unexpected input: name should not contain the delimiter "${DELIMITER}"`
     )
 
-    const filePath = path.join(__dirname, `test/${command}`)
+    const filePath = path.join(TEMP_DIR, command)
     fs.unlinkSync(filePath)
   })
 
@@ -641,7 +646,7 @@ function assertWriteCalls(calls: string[]): void {
 }
 
 function createFileCommandFile(command: string): void {
-  const filePath = path.join(__dirname, `test/${command}`)
+  const filePath = path.join(__dirname, `_temp/${command}`)
   process.env[`GITHUB_${command}`] = filePath
   fs.appendFileSync(filePath, '', {
     encoding: 'utf8'
@@ -649,7 +654,7 @@ function createFileCommandFile(command: string): void {
 }
 
 function verifyFileCommand(command: string, expectedContents: string): void {
-  const filePath = path.join(__dirname, `test/${command}`)
+  const filePath = path.join(__dirname, `_temp/${command}`)
   const contents = fs.readFileSync(filePath, 'utf8')
   try {
     expect(contents).toEqual(expectedContents)

packages/core/package-lock.json

@@ -1,21 +1,19 @@
 {
   "name": "@actions/core",
-  "version": "1.10.1",
+  "version": "1.11.1",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {
     "": {
       "name": "@actions/core",
-      "version": "1.10.1",
+      "version": "1.11.1",
       "license": "MIT",
       "dependencies": {
         "@actions/exec": "^1.1.1",
-        "@actions/http-client": "^2.0.1",
-        "uuid": "^8.3.2"
+        "@actions/http-client": "^2.0.1"
       },
       "devDependencies": {
-        "@types/node": "^12.0.2",
-        "@types/uuid": "^8.3.4"
+        "@types/node": "^16.18.112"
       }
     },
     "node_modules/@actions/exec": {
@@ -40,15 +38,9 @@
       "integrity": "sha512-wi9JjgKLYS7U/z8PPbco+PvTb/nRWjeoFlJ1Qer83k/3C5PHQi28hiVdeE2kHXmIL99mQFawx8qt/JPjZilJ8Q=="
     },
     "node_modules/@types/node": {
-      "version": "12.0.2",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-12.0.2.tgz",
-      "integrity": "sha512-5tabW/i+9mhrfEOUcLDu2xBPsHJ+X5Orqy9FKpale3SjDA17j5AEpYq5vfy3oAeAHGcvANRCO3NV3d2D6q3NiA==",
-      "dev": true
-    },
-    "node_modules/@types/uuid": {
-      "version": "8.3.4",
-      "resolved": "https://registry.npmjs.org/@types/uuid/-/uuid-8.3.4.tgz",
-      "integrity": "sha512-c/I8ZRb51j+pYGAu5CrFMRxqZ2ke4y2grEBO5AUjgSkSk+qT2Ea+OdWElz/OiMf5MNpn2b17kuVBwZLQJXzihw==",
+      "version": "16.18.112",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-16.18.112.tgz",
+      "integrity": "sha512-EKrbKUGJROm17+dY/gMi31aJlGLJ75e1IkTojt9n6u+hnaTBDs+M1bIdOawpk2m6YUAXq/R2W0SxCng1tndHCg==",
       "dev": true
     },
     "node_modules/tunnel": {
@@ -58,14 +50,6 @@
       "engines": {
         "node": ">=0.6.11 <=0.7.0 || >=0.7.3"
       }
-    },
-    "node_modules/uuid": {
-      "version": "8.3.2",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-8.3.2.tgz",
-      "integrity": "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==",
-      "bin": {
-        "uuid": "dist/bin/uuid"
-      }
     }
   },
   "dependencies": {
@@ -91,26 +75,15 @@
       "integrity": "sha512-wi9JjgKLYS7U/z8PPbco+PvTb/nRWjeoFlJ1Qer83k/3C5PHQi28hiVdeE2kHXmIL99mQFawx8qt/JPjZilJ8Q=="
     },
     "@types/node": {
-      "version": "12.0.2",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-12.0.2.tgz",
-      "integrity": "sha512-5tabW/i+9mhrfEOUcLDu2xBPsHJ+X5Orqy9FKpale3SjDA17j5AEpYq5vfy3oAeAHGcvANRCO3NV3d2D6q3NiA==",
-      "dev": true
-    },
-    "@types/uuid": {
-      "version": "8.3.4",
-      "resolved": "https://registry.npmjs.org/@types/uuid/-/uuid-8.3.4.tgz",
-      "integrity": "sha512-c/I8ZRb51j+pYGAu5CrFMRxqZ2ke4y2grEBO5AUjgSkSk+qT2Ea+OdWElz/OiMf5MNpn2b17kuVBwZLQJXzihw==",
+      "version": "16.18.112",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-16.18.112.tgz",
+      "integrity": "sha512-EKrbKUGJROm17+dY/gMi31aJlGLJ75e1IkTojt9n6u+hnaTBDs+M1bIdOawpk2m6YUAXq/R2W0SxCng1tndHCg==",
       "dev": true
     },
     "tunnel": {
       "version": "0.0.6",
       "resolved": "https://registry.npmjs.org/tunnel/-/tunnel-0.0.6.tgz",
       "integrity": "sha512-1h/Lnq9yajKY2PEbBadPXj3VxsDDu844OnaAo52UVmIzIvwwtBPIuNvkjuzBlTWpfJyUbG3ez0KSBibQkj4ojg=="
-    },
-    "uuid": {
-      "version": "8.3.2",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-8.3.2.tgz",
-      "integrity": "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg=="
     }
   }
 }

packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actions/core",
-  "version": "1.10.1",
+  "version": "1.11.1",
   "description": "Actions core lib",
   "keywords": [
     "github",
@@ -37,11 +37,9 @@
   },
   "dependencies": {
     "@actions/exec": "^1.1.1",
-    "@actions/http-client": "^2.0.1",
-    "uuid": "^8.3.2"
+    "@actions/http-client": "^2.0.1"
   },
   "devDependencies": {
-    "@types/node": "^12.0.2",
-    "@types/uuid": "^8.3.4"
+    "@types/node": "^16.18.112"
   }
 }

packages/core/src/file-command.ts

@@ -3,9 +3,9 @@
 // We use any as a valid input type
 /* eslint-disable @typescript-eslint/no-explicit-any */
 
+import * as crypto from 'crypto'
 import * as fs from 'fs'
 import * as os from 'os'
-import {v4 as uuidv4} from 'uuid'
 import {toCommandValue} from './utils'
 
 export function issueFileCommand(command: string, message: any): void {
@@ -25,7 +25,7 @@ export function issueFileCommand(command: string, message: any): void {
 }
 
 export function prepareKeyValueMessage(key: string, value: any): string {
-  const delimiter = `ghadelimiter_${uuidv4()}`
+  const delimiter = `ghadelimiter_${crypto.randomUUID()}`
   const convertedValue = toCommandValue(value)
 
   // These should realistically never happen, but just in case someone finds a

packages/glob/RELEASES.md

@@ -1,5 +1,8 @@
 # @actions/glob Releases
 
+### 0.5.0
+- Added `excludeHiddenFiles` option, which is disabled by default to preserve existing behavior [#1791: Add glob option to ignore hidden files](https://github.com/actions/toolkit/pull/1791)
+
 ### 0.4.0
 - Pass in the current workspace as a parameter to HashFiles [#1318](https://github.com/actions/toolkit/pull/1318)
 

packages/glob/__tests__/internal-globber.test.ts

@@ -708,7 +708,7 @@ describe('globber', () => {
     expect(itemPaths).toEqual([])
   })
 
-  it('returns hidden files', async () => {
+  it('returns hidden files by default', async () => {
     // Create the following layout:
     //   <root>
     //   <root>/.emptyFolder
@@ -734,6 +734,26 @@ describe('globber', () => {
     ])
   })
 
+  it('ignores hidden files when excludeHiddenFiles is set', async () => {
+    // Create the following layout:
+    //   <root>
+    //   <root>/.emptyFolder
+    //   <root>/.file
+    //   <root>/.folder
+    //   <root>/.folder/file
+    const root = path.join(getTestTemp(), 'ignores-hidden-files')
+    await createHiddenDirectory(path.join(root, '.emptyFolder'))
+    await createHiddenDirectory(path.join(root, '.folder'))
+    await createHiddenFile(path.join(root, '.file'), 'test .file content')
+    await fs.writeFile(
+      path.join(root, '.folder', 'file'),
+      'test .folder/file content'
+    )
+
+    const itemPaths = await glob(root, {excludeHiddenFiles: true})
+    expect(itemPaths).toEqual([root])
+  })
+
   it('returns normalized paths', async () => {
     // Create the following layout:
     //   <root>/hello/world.txt

packages/glob/package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "@actions/glob",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "lockfileVersion": 3,
   "requires": true,
   "description": "Actions glob lib",

packages/glob/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actions/glob",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "preview": true,
   "description": "Actions glob lib",
   "keywords": [

packages/glob/src/internal-glob-options-helper.ts

@@ -9,7 +9,8 @@ export function getOptions(copy?: GlobOptions): GlobOptions {
     followSymbolicLinks: true,
     implicitDescendants: true,
     matchDirectories: true,
-    omitBrokenSymbolicLinks: true
+    omitBrokenSymbolicLinks: true,
+    excludeHiddenFiles: false
   }
 
   if (copy) {
@@ -32,6 +33,11 @@ export function getOptions(copy?: GlobOptions): GlobOptions {
       result.omitBrokenSymbolicLinks = copy.omitBrokenSymbolicLinks
       core.debug(`omitBrokenSymbolicLinks '${result.omitBrokenSymbolicLinks}'`)
     }
+
+    if (typeof copy.excludeHiddenFiles === 'boolean') {
+      result.excludeHiddenFiles = copy.excludeHiddenFiles
+      core.debug(`excludeHiddenFiles '${result.excludeHiddenFiles}'`)
+    }
   }
 
   return result

packages/glob/src/internal-glob-options.ts

@@ -36,4 +36,13 @@ export interface GlobOptions {
    * @default true
    */
   omitBrokenSymbolicLinks?: boolean
+
+  /**
+   * Indicates whether to exclude hidden files (files and directories starting with a `.`).
+   * This does not apply to Windows files and directories with the hidden attribute unless
+   * they are also prefixed with a `.`.
+   *
+   * @default false
+   */
+  excludeHiddenFiles?: boolean
 }

packages/glob/src/internal-globber.ts

@@ -128,6 +128,11 @@ export class DefaultGlobber implements Globber {
         continue
       }
 
+      // Hidden file or directory?
+      if (options.excludeHiddenFiles && path.basename(item.path).match(/^\./)) {
+        continue
+      }
+
       // Directory
       if (stats.isDirectory()) {
         // Matched

packages/http-client/RELEASES.md

@@ -1,5 +1,14 @@
 ## Releases
 
+## 2.2.3
+- Fixed an issue where proxy username and password were not handled correctly [#1799](https://github.com/actions/toolkit/pull/1799)
+
+## 2.2.2
+- Better handling of url encoded usernames and passwords in proxy config [#1782](https://github.com/actions/toolkit/pull/1782)
+
+## 2.2.1
+- Make sure RequestOptions.keepAlive is applied properly on node20 runtime [#1572](https://github.com/actions/toolkit/pull/1572)
+
 ## 2.2.0
 - Add function to return proxy agent dispatcher for compatibility with latest octokit packages [#1547](https://github.com/actions/toolkit/pull/1547)