Merge pull request #1886 from actions/Link-/cache-4.0.0

Prepare `@actions/cache` `4.0.0` release

.github/workflows/audit.yml

@@ -32,7 +32,7 @@ jobs:
       run: npm run bootstrap
 
     - name: audit tools (without allow-list)
-      run: npm audit --audit-level=moderate
+      run: npm audit --audit-level=moderate --omit dev
 
     - name: audit packages
       run: npm run audit-all

.github/workflows/releases.yml

@@ -1,5 +1,7 @@
 name: Publish NPM
 
+run-name: Publish NPM - ${{ github.event.inputs.package }}
+
 on:
   workflow_dispatch:
     inputs:
@@ -9,7 +11,7 @@ on:
 
 jobs:
   test:
-    runs-on: macos-latest
+    runs-on: macos-latest-large
 
     steps:
       - name: setup repo
@@ -46,7 +48,7 @@ jobs:
           path: packages/${{ github.event.inputs.package }}/*.tgz
 
   publish:
-    runs-on: macos-latest
+    runs-on: macos-latest-large
     needs: test
     environment: npm-publish
     permissions:

.github/workflows/unit-tests.yml

@@ -16,7 +16,11 @@ jobs:
 
     strategy:
       matrix:
-        runs-on: [ubuntu-latest, macos-latest, windows-latest]
+        runs-on: [ubuntu-latest, macos-latest-large, windows-latest]
+
+        # Node 18 is the current default Node version in hosted runners, so users may still use the toolkit with it when running tests (see https://github.com/actions/toolkit/issues/1841)
+        # Node 20 is the currently support Node version for actions - https://docs.github.com/actions/sharing-automations/creating-actions/metadata-syntax-for-github-actions#runsusing-for-javascript-actions
+        node-version: [18.x, 20.x]
       fail-fast: false
 
     runs-on: ${{ matrix.runs-on }}
@@ -25,10 +29,10 @@ jobs:
     - name: Checkout
       uses: actions/checkout@v4
 
-    - name: Set Node.js 20.x
+    - name: Set up Node ${{ matrix.node-version }}
       uses: actions/setup-node@v4
       with:
-        node-version: 20.x
+        node-version: ${{ matrix.node-version }}
 
     - name: npm install
       run: npm install

package.json

@@ -32,19 +32,5 @@
     "prettier": "^3.0.0",
     "ts-jest": "^29.1.1",
     "typescript": "^5.2.2"
-  },
-  "dependencies": {
-    "@actions/artifact": "^2.1.7",
-    "@actions/attest": "^1.2.1",
-    "@actions/cache": "^3.2.4",
-    "@actions/core": "^1.10.1",
-    "@actions/exec": "^1.1.1",
-    "@actions/github": "^6.0.0",
-    "@actions/glob": "^0.4.0",
-    "@actions/http-client": "^2.2.1",
-    "@actions/io": "^1.1.3",
-    "@actions/tool-cache": "^2.0.1",
-    "tunnel": "^0.0.6",
-    "undici": "^6.18.1"
   }
-}
+}

packages/artifact/RELEASES.md

@@ -1,5 +1,24 @@
 # @actions/artifact Releases
 
+### 2.1.11
+
+- Fixed a bug with relative symlinks resolution [#1844](https://github.com/actions/toolkit/pull/1844)
+- Use native `crypto` [#1815](https://github.com/actions/toolkit/pull/1815)
+
+### 2.1.10
+
+- Fixed a regression with symlinks not being automatically resolved [#1830](https://github.com/actions/toolkit/pull/1830)
+- Fixed a regression with chunk timeout [#1786](https://github.com/actions/toolkit/pull/1786)
+
+### 2.1.9
+
+- Fixed artifact upload chunk timeout logic [#1774](https://github.com/actions/toolkit/pull/1774)
+- Use lazy stream to prevent issues with open file limits [#1771](https://github.com/actions/toolkit/pull/1771)
+
+### 2.1.8
+
+- Allows `*.localhost` domains for hostname checks for local development.
+
 ### 2.1.7
 
 - Update unzip-stream dependency and reverted to using `unzip.Extract()`

packages/artifact/__tests__/config.test.ts

@@ -20,6 +20,11 @@ describe('isGhes', () => {
     expect(config.isGhes()).toBe(false)
   })
 
+  it('should return false when the request domain ends with .localhost', () => {
+    process.env.GITHUB_SERVER_URL = 'https://github.localhost'
+    expect(config.isGhes()).toBe(false)
+  })
+
   it('should return false when the request domain is specific to an enterprise', () => {
     process.env.GITHUB_SERVER_URL = 'https://my-enterprise.github.com'
     expect(config.isGhes()).toBe(true)

packages/artifact/__tests__/upload-artifact.test.ts

@@ -1,260 +1,173 @@
 import * as uploadZipSpecification from '../src/internal/upload/upload-zip-specification'
 import * as zip from '../src/internal/upload/zip'
 import * as util from '../src/internal/shared/util'
-import * as retention from '../src/internal/upload/retention'
 import * as config from '../src/internal/shared/config'
-import {Timestamp, ArtifactServiceClientJSON} from '../src/generated'
+import {ArtifactServiceClientJSON} from '../src/generated'
 import * as blobUpload from '../src/internal/upload/blob-upload'
 import {uploadArtifact} from '../src/internal/upload/upload-artifact'
 import {noopLogs} from './common'
 import {FilesNotFoundError} from '../src/internal/shared/errors'
-import {BlockBlobClient} from '@azure/storage-blob'
+import {BlockBlobUploadStreamOptions} from '@azure/storage-blob'
 import * as fs from 'fs'
 import * as path from 'path'
+import unzip from 'unzip-stream'
+
+const uploadStreamMock = jest.fn()
+const blockBlobClientMock = jest.fn().mockImplementation(() => ({
+  uploadStream: uploadStreamMock
+}))
+
+jest.mock('@azure/storage-blob', () => ({
+  BlobClient: jest.fn().mockImplementation(() => {
+    return {
+      getBlockBlobClient: blockBlobClientMock
+    }
+  })
+}))
+
+const fixtures = {
+  uploadDirectory: path.join(__dirname, '_temp', 'plz-upload'),
+  files: [
+    {name: 'file1.txt', content: 'test 1 file content'},
+    {name: 'file2.txt', content: 'test 2 file content'},
+    {name: 'file3.txt', content: 'test 3 file content'},
+    {
+      name: 'real.txt',
+      content: 'from a symlink'
+    },
+    {
+      name: 'relative.txt',
+      content: 'from a symlink',
+      symlink: 'real.txt',
+      relative: true
+    },
+    {
+      name: 'absolute.txt',
+      content: 'from a symlink',
+      symlink: 'real.txt',
+      relative: false
+    }
+  ],
+  backendIDs: {
+    workflowRunBackendId: '67dbcc20-e851-4452-a7c3-2cc0d2e0ec67',
+    workflowJobRunBackendId: '5f49179d-3386-4c38-85f7-00f8138facd0'
+  },
+  runtimeToken: 'test-token',
+  resultsServiceURL: 'http://results.local',
+  inputs: {
+    artifactName: 'test-artifact',
+    files: [
+      '/home/user/files/plz-upload/file1.txt',
+      '/home/user/files/plz-upload/file2.txt',
+      '/home/user/files/plz-upload/dir/file3.txt'
+    ],
+    rootDirectory: '/home/user/files/plz-upload'
+  }
+}
 
 describe('upload-artifact', () => {
+  beforeAll(() => {
+    fs.mkdirSync(fixtures.uploadDirectory, {
+      recursive: true
+    })
+
+    for (const file of fixtures.files) {
+      if (file.symlink) {
+        let symlinkPath = file.symlink
+        if (!file.relative) {
+          symlinkPath = path.join(fixtures.uploadDirectory, file.symlink)
+        }
+
+        if (!fs.existsSync(path.join(fixtures.uploadDirectory, file.name))) {
+          fs.symlinkSync(
+            symlinkPath,
+            path.join(fixtures.uploadDirectory, file.name),
+            'file'
+          )
+        }
+      } else {
+        fs.writeFileSync(
+          path.join(fixtures.uploadDirectory, file.name),
+          file.content
+        )
+      }
+    }
+  })
+
   beforeEach(() => {
     noopLogs()
+    jest
+      .spyOn(uploadZipSpecification, 'validateRootDirectory')
+      .mockReturnValue()
+    jest
+      .spyOn(util, 'getBackendIdsFromToken')
+      .mockReturnValue(fixtures.backendIDs)
+    jest
+      .spyOn(uploadZipSpecification, 'getUploadZipSpecification')
+      .mockReturnValue(
+        fixtures.files.map(file => ({
+          sourcePath: path.join(fixtures.uploadDirectory, file.name),
+          destinationPath: file.name,
+          stats: new fs.Stats()
+        }))
+      )
+    jest.spyOn(config, 'getRuntimeToken').mockReturnValue(fixtures.runtimeToken)
+    jest
+      .spyOn(config, 'getResultsServiceUrl')
+      .mockReturnValue(fixtures.resultsServiceURL)
   })
 
   afterEach(() => {
     jest.restoreAllMocks()
   })
 
-  it('should successfully upload an artifact', () => {
-    const mockDate = new Date('2020-01-01')
-    jest
-      .spyOn(uploadZipSpecification, 'validateRootDirectory')
-      .mockReturnValue()
-    jest
-      .spyOn(uploadZipSpecification, 'getUploadZipSpecification')
-      .mockReturnValue([
-        {
-          sourcePath: '/home/user/files/plz-upload/file1.txt',
-          destinationPath: 'file1.txt'
-        },
-        {
-          sourcePath: '/home/user/files/plz-upload/file2.txt',
-          destinationPath: 'file2.txt'
-        },
-        {
-          sourcePath: '/home/user/files/plz-upload/dir/file3.txt',
-          destinationPath: 'dir/file3.txt'
-        }
-      ])
-
-    jest
-      .spyOn(zip, 'createZipUploadStream')
-      .mockReturnValue(Promise.resolve(new zip.ZipUploadStream(1)))
-    jest.spyOn(util, 'getBackendIdsFromToken').mockReturnValue({
-      workflowRunBackendId: '1234',
-      workflowJobRunBackendId: '5678'
-    })
-    jest
-      .spyOn(retention, 'getExpiration')
-      .mockReturnValue(Timestamp.fromDate(mockDate))
-    jest
-      .spyOn(ArtifactServiceClientJSON.prototype, 'CreateArtifact')
-      .mockReturnValue(
-        Promise.resolve({
-          ok: true,
-          signedUploadUrl: 'https://signed-upload-url.com'
-        })
-      )
-    jest.spyOn(blobUpload, 'uploadZipToBlobStorage').mockReturnValue(
-      Promise.resolve({
-        uploadSize: 1234,
-        sha256Hash: 'test-sha256-hash'
-      })
-    )
-    jest
-      .spyOn(ArtifactServiceClientJSON.prototype, 'FinalizeArtifact')
-      .mockReturnValue(Promise.resolve({ok: true, artifactId: '1'}))
-
-    // ArtifactHttpClient mocks
-    jest.spyOn(config, 'getRuntimeToken').mockReturnValue('test-token')
-    jest
-      .spyOn(config, 'getResultsServiceUrl')
-      .mockReturnValue('https://test-url.com')
-
-    const uploadResp = uploadArtifact(
-      'test-artifact',
-      [
-        '/home/user/files/plz-upload/file1.txt',
-        '/home/user/files/plz-upload/file2.txt',
-        '/home/user/files/plz-upload/dir/file3.txt'
-      ],
-      '/home/user/files/plz-upload'
-    )
-
-    expect(uploadResp).resolves.toEqual({size: 1234, id: 1})
-  })
-
-  it('should throw an error if the root directory is invalid', () => {
-    jest
-      .spyOn(uploadZipSpecification, 'validateRootDirectory')
-      .mockImplementation(() => {
-        throw new Error('Invalid root directory')
-      })
-
-    const uploadResp = uploadArtifact(
-      'test-artifact',
-      [
-        '/home/user/files/plz-upload/file1.txt',
-        '/home/user/files/plz-upload/file2.txt',
-        '/home/user/files/plz-upload/dir/file3.txt'
-      ],
-      '/home/user/files/plz-upload'
-    )
-
-    expect(uploadResp).rejects.toThrow('Invalid root directory')
-  })
-
-  it('should reject if there are no files to upload', () => {
-    jest
-      .spyOn(uploadZipSpecification, 'validateRootDirectory')
-      .mockReturnValue()
+  it('should reject if there are no files to upload', async () => {
     jest
       .spyOn(uploadZipSpecification, 'getUploadZipSpecification')
+      .mockClear()
       .mockReturnValue([])
 
     const uploadResp = uploadArtifact(
-      'test-artifact',
-      [
-        '/home/user/files/plz-upload/file1.txt',
-        '/home/user/files/plz-upload/file2.txt',
-        '/home/user/files/plz-upload/dir/file3.txt'
-      ],
-      '/home/user/files/plz-upload'
+      fixtures.inputs.artifactName,
+      fixtures.inputs.files,
+      fixtures.inputs.rootDirectory
     )
-    expect(uploadResp).rejects.toThrowError(FilesNotFoundError)
+    await expect(uploadResp).rejects.toThrowError(FilesNotFoundError)
   })
 
-  it('should reject if no backend IDs are found', () => {
-    jest
-      .spyOn(uploadZipSpecification, 'validateRootDirectory')
-      .mockReturnValue()
-    jest
-      .spyOn(uploadZipSpecification, 'getUploadZipSpecification')
-      .mockReturnValue([
-        {
-          sourcePath: '/home/user/files/plz-upload/file1.txt',
-          destinationPath: 'file1.txt'
-        },
-        {
-          sourcePath: '/home/user/files/plz-upload/file2.txt',
-          destinationPath: 'file2.txt'
-        },
-        {
-          sourcePath: '/home/user/files/plz-upload/dir/file3.txt',
-          destinationPath: 'dir/file3.txt'
-        }
-      ])
-
-    jest
-      .spyOn(zip, 'createZipUploadStream')
-      .mockReturnValue(Promise.resolve(new zip.ZipUploadStream(1)))
+  it('should reject if no backend IDs are found', async () => {
+    jest.spyOn(util, 'getBackendIdsFromToken').mockRestore()
 
     const uploadResp = uploadArtifact(
-      'test-artifact',
-      [
-        '/home/user/files/plz-upload/file1.txt',
-        '/home/user/files/plz-upload/file2.txt',
-        '/home/user/files/plz-upload/dir/file3.txt'
-      ],
-      '/home/user/files/plz-upload'
+      fixtures.inputs.artifactName,
+      fixtures.inputs.files,
+      fixtures.inputs.rootDirectory
     )
 
-    expect(uploadResp).rejects.toThrow()
+    await expect(uploadResp).rejects.toThrow()
   })
 
-  it('should return false if the creation request fails', () => {
-    const mockDate = new Date('2020-01-01')
-    jest
-      .spyOn(uploadZipSpecification, 'validateRootDirectory')
-      .mockReturnValue()
-    jest
-      .spyOn(uploadZipSpecification, 'getUploadZipSpecification')
-      .mockReturnValue([
-        {
-          sourcePath: '/home/user/files/plz-upload/file1.txt',
-          destinationPath: 'file1.txt'
-        },
-        {
-          sourcePath: '/home/user/files/plz-upload/file2.txt',
-          destinationPath: 'file2.txt'
-        },
-        {
-          sourcePath: '/home/user/files/plz-upload/dir/file3.txt',
-          destinationPath: 'dir/file3.txt'
-        }
-      ])
-
+  it('should return false if the creation request fails', async () => {
     jest
       .spyOn(zip, 'createZipUploadStream')
       .mockReturnValue(Promise.resolve(new zip.ZipUploadStream(1)))
-    jest.spyOn(util, 'getBackendIdsFromToken').mockReturnValue({
-      workflowRunBackendId: '1234',
-      workflowJobRunBackendId: '5678'
-    })
-    jest
-      .spyOn(retention, 'getExpiration')
-      .mockReturnValue(Timestamp.fromDate(mockDate))
     jest
       .spyOn(ArtifactServiceClientJSON.prototype, 'CreateArtifact')
       .mockReturnValue(Promise.resolve({ok: false, signedUploadUrl: ''}))
 
-    // ArtifactHttpClient mocks
-    jest.spyOn(config, 'getRuntimeToken').mockReturnValue('test-token')
-    jest
-      .spyOn(config, 'getResultsServiceUrl')
-      .mockReturnValue('https://test-url.com')
-
     const uploadResp = uploadArtifact(
-      'test-artifact',
-      [
-        '/home/user/files/plz-upload/file1.txt',
-        '/home/user/files/plz-upload/file2.txt',
-        '/home/user/files/plz-upload/dir/file3.txt'
-      ],
-      '/home/user/files/plz-upload'
+      fixtures.inputs.artifactName,
+      fixtures.inputs.files,
+      fixtures.inputs.rootDirectory
     )
 
-    expect(uploadResp).rejects.toThrow()
+    await expect(uploadResp).rejects.toThrow()
   })
 
-  it('should return false if blob storage upload is unsuccessful', () => {
-    const mockDate = new Date('2020-01-01')
-    jest
-      .spyOn(uploadZipSpecification, 'validateRootDirectory')
-      .mockReturnValue()
-    jest
-      .spyOn(uploadZipSpecification, 'getUploadZipSpecification')
-      .mockReturnValue([
-        {
-          sourcePath: '/home/user/files/plz-upload/file1.txt',
-          destinationPath: 'file1.txt'
-        },
-        {
-          sourcePath: '/home/user/files/plz-upload/file2.txt',
-          destinationPath: 'file2.txt'
-        },
-        {
-          sourcePath: '/home/user/files/plz-upload/dir/file3.txt',
-          destinationPath: 'dir/file3.txt'
-        }
-      ])
-
+  it('should return false if blob storage upload is unsuccessful', async () => {
     jest
       .spyOn(zip, 'createZipUploadStream')
       .mockReturnValue(Promise.resolve(new zip.ZipUploadStream(1)))
-    jest.spyOn(util, 'getBackendIdsFromToken').mockReturnValue({
-      workflowRunBackendId: '1234',
-      workflowJobRunBackendId: '5678'
-    })
-    jest
-      .spyOn(retention, 'getExpiration')
-      .mockReturnValue(Timestamp.fromDate(mockDate))
     jest
       .spyOn(ArtifactServiceClientJSON.prototype, 'CreateArtifact')
       .mockReturnValue(
@@ -267,57 +180,19 @@ describe('upload-artifact', () => {
       .spyOn(blobUpload, 'uploadZipToBlobStorage')
       .mockReturnValue(Promise.reject(new Error('boom')))
 
-    // ArtifactHttpClient mocks
-    jest.spyOn(config, 'getRuntimeToken').mockReturnValue('test-token')
-    jest
-      .spyOn(config, 'getResultsServiceUrl')
-      .mockReturnValue('https://test-url.com')
-
     const uploadResp = uploadArtifact(
-      'test-artifact',
-      [
-        '/home/user/files/plz-upload/file1.txt',
-        '/home/user/files/plz-upload/file2.txt',
-        '/home/user/files/plz-upload/dir/file3.txt'
-      ],
-      '/home/user/files/plz-upload'
+      fixtures.inputs.artifactName,
+      fixtures.inputs.files,
+      fixtures.inputs.rootDirectory
     )
 
-    expect(uploadResp).rejects.toThrow()
+    await expect(uploadResp).rejects.toThrow()
   })
 
-  it('should reject if finalize artifact fails', () => {
-    const mockDate = new Date('2020-01-01')
-    jest
-      .spyOn(uploadZipSpecification, 'validateRootDirectory')
-      .mockReturnValue()
-    jest
-      .spyOn(uploadZipSpecification, 'getUploadZipSpecification')
-      .mockReturnValue([
-        {
-          sourcePath: '/home/user/files/plz-upload/file1.txt',
-          destinationPath: 'file1.txt'
-        },
-        {
-          sourcePath: '/home/user/files/plz-upload/file2.txt',
-          destinationPath: 'file2.txt'
-        },
-        {
-          sourcePath: '/home/user/files/plz-upload/dir/file3.txt',
-          destinationPath: 'dir/file3.txt'
-        }
-      ])
-
+  it('should reject if finalize artifact fails', async () => {
     jest
       .spyOn(zip, 'createZipUploadStream')
       .mockReturnValue(Promise.resolve(new zip.ZipUploadStream(1)))
-    jest.spyOn(util, 'getBackendIdsFromToken').mockReturnValue({
-      workflowRunBackendId: '1234',
-      workflowJobRunBackendId: '5678'
-    })
-    jest
-      .spyOn(retention, 'getExpiration')
-      .mockReturnValue(Timestamp.fromDate(mockDate))
     jest
       .spyOn(ArtifactServiceClientJSON.prototype, 'CreateArtifact')
       .mockReturnValue(
@@ -336,112 +211,161 @@ describe('upload-artifact', () => {
       .spyOn(ArtifactServiceClientJSON.prototype, 'FinalizeArtifact')
       .mockReturnValue(Promise.resolve({ok: false, artifactId: ''}))
 
-    // ArtifactHttpClient mocks
-    jest.spyOn(config, 'getRuntimeToken').mockReturnValue('test-token')
-    jest
-      .spyOn(config, 'getResultsServiceUrl')
-      .mockReturnValue('https://test-url.com')
-
     const uploadResp = uploadArtifact(
-      'test-artifact',
-      [
-        '/home/user/files/plz-upload/file1.txt',
-        '/home/user/files/plz-upload/file2.txt',
-        '/home/user/files/plz-upload/dir/file3.txt'
-      ],
-      '/home/user/files/plz-upload'
+      fixtures.inputs.artifactName,
+      fixtures.inputs.files,
+      fixtures.inputs.rootDirectory
     )
 
-    expect(uploadResp).rejects.toThrow()
+    await expect(uploadResp).rejects.toThrow()
   })
 
-  it('should throw an error uploading blob chunks get delayed', async () => {
-    const mockDate = new Date('2020-01-01')
-    const dirPath = path.join(__dirname, `plz-upload`)
-    if (!fs.existsSync(dirPath)) {
-      fs.mkdirSync(dirPath, {recursive: true})
-    }
-
-    fs.writeFileSync(path.join(dirPath, 'file1.txt'), 'test file content')
-    fs.writeFileSync(path.join(dirPath, 'file2.txt'), 'test file content')
-
-    fs.writeFileSync(path.join(dirPath, 'file3.txt'), 'test file content')
-
-    jest
-      .spyOn(uploadZipSpecification, 'validateRootDirectory')
-      .mockReturnValue()
+  it('should successfully upload an artifact', async () => {
     jest
       .spyOn(uploadZipSpecification, 'getUploadZipSpecification')
-      .mockReturnValue([
-        {
-          sourcePath: path.join(dirPath, 'file1.txt'),
-          destinationPath: 'file1.txt'
-        },
-        {
-          sourcePath: path.join(dirPath, 'file2.txt'),
-          destinationPath: 'file2.txt'
-        },
-        {
-          sourcePath: path.join(dirPath, 'file3.txt'),
-          destinationPath: 'dir/file3.txt'
-        }
-      ])
+      .mockRestore()
 
-    jest.spyOn(util, 'getBackendIdsFromToken').mockReturnValue({
-      workflowRunBackendId: '1234',
-      workflowJobRunBackendId: '5678'
-    })
-    jest
-      .spyOn(retention, 'getExpiration')
-      .mockReturnValue(Timestamp.fromDate(mockDate))
     jest
       .spyOn(ArtifactServiceClientJSON.prototype, 'CreateArtifact')
       .mockReturnValue(
         Promise.resolve({
           ok: true,
-          signedUploadUrl: 'https://signed-upload-url.com'
+          signedUploadUrl: 'https://signed-upload-url.local'
         })
       )
     jest
-      .spyOn(blobUpload, 'uploadZipToBlobStorage')
-      .mockReturnValue(Promise.reject(new Error('Upload progress stalled.')))
-
-    // ArtifactHttpClient mocks
-    jest.spyOn(config, 'getRuntimeToken').mockReturnValue('test-token')
-    jest
-      .spyOn(config, 'getResultsServiceUrl')
-      .mockReturnValue('https://test-url.com')
-
-    BlockBlobClient.prototype.uploadStream = jest
-      .fn()
-      .mockImplementation(
-        async (stream, bufferSize, maxConcurrency, options) => {
-          return new Promise<void>(resolve => {
-            // Call the onProgress callback with a progress event
-            options.onProgress({loadedBytes: 0})
-
-            // Wait for 31 seconds before resolving the promise
-            setTimeout(() => {
-              // Call the onProgress callback again to simulate progress
-              options.onProgress({loadedBytes: 100})
-
-              resolve()
-            }, 31000) // Delay longer than your timeout
-          })
-        }
+      .spyOn(ArtifactServiceClientJSON.prototype, 'FinalizeArtifact')
+      .mockReturnValue(
+        Promise.resolve({
+          ok: true,
+          artifactId: '1'
+        })
       )
 
-    jest.mock('fs')
-    const uploadResp = uploadArtifact(
-      'test-artifact',
-      [
-        '/home/user/files/plz-upload/file1.txt',
-        '/home/user/files/plz-upload/file2.txt',
-        '/home/user/files/plz-upload/dir/file3.txt'
-      ],
-      '/home/user/files/plz-upload'
+    let loadedBytes = 0
+    const uploadedZip = path.join(
+      fixtures.uploadDirectory,
+      '..',
+      'uploaded.zip'
+    )
+    uploadStreamMock.mockImplementation(
+      async (
+        stream: NodeJS.ReadableStream,
+        bufferSize?: number,
+        maxConcurrency?: number,
+        options?: BlockBlobUploadStreamOptions
+      ) => {
+        const {onProgress} = options || {}
+
+        if (fs.existsSync(uploadedZip)) {
+          fs.unlinkSync(uploadedZip)
+        }
+        const uploadedZipStream = fs.createWriteStream(uploadedZip)
+
+        onProgress?.({loadedBytes: 0})
+        return new Promise((resolve, reject) => {
+          stream.on('data', chunk => {
+            loadedBytes += chunk.length
+            uploadedZipStream.write(chunk)
+            onProgress?.({loadedBytes})
+          })
+          stream.on('end', () => {
+            onProgress?.({loadedBytes})
+            uploadedZipStream.end()
+            resolve({})
+          })
+          stream.on('error', err => {
+            reject(err)
+          })
+        })
+      }
     )
 
-    expect(uploadResp).rejects.toThrow('Upload progress stalled.')
+    const {id, size} = await uploadArtifact(
+      fixtures.inputs.artifactName,
+      fixtures.files.map(file =>
+        path.join(fixtures.uploadDirectory, file.name)
+      ),
+      fixtures.uploadDirectory
+    )
+
+    expect(id).toBe(1)
+    expect(size).toBe(loadedBytes)
+
+    const extractedDirectory = path.join(
+      fixtures.uploadDirectory,
+      '..',
+      'extracted'
+    )
+    if (fs.existsSync(extractedDirectory)) {
+      fs.rmdirSync(extractedDirectory, {recursive: true})
+    }
+
+    const extract = new Promise((resolve, reject) => {
+      fs.createReadStream(uploadedZip)
+        .pipe(unzip.Extract({path: extractedDirectory}))
+        .on('close', () => {
+          resolve(true)
+        })
+        .on('error', err => {
+          reject(err)
+        })
+    })
+
+    await expect(extract).resolves.toBe(true)
+    for (const file of fixtures.files) {
+      const filePath = path.join(extractedDirectory, file.name)
+      expect(fs.existsSync(filePath)).toBe(true)
+      expect(fs.readFileSync(filePath, 'utf8')).toBe(file.content)
+    }
+  })
+
+  it('should throw an error uploading blob chunks get delayed', async () => {
+    jest
+      .spyOn(ArtifactServiceClientJSON.prototype, 'CreateArtifact')
+      .mockReturnValue(
+        Promise.resolve({
+          ok: true,
+          signedUploadUrl: 'https://signed-upload-url.local'
+        })
+      )
+    jest
+      .spyOn(ArtifactServiceClientJSON.prototype, 'FinalizeArtifact')
+      .mockReturnValue(
+        Promise.resolve({
+          ok: true,
+          artifactId: '1'
+        })
+      )
+    jest
+      .spyOn(config, 'getResultsServiceUrl')
+      .mockReturnValue('https://results.local')
+
+    jest.spyOn(config, 'getUploadChunkTimeout').mockReturnValue(2_000)
+
+    uploadStreamMock.mockImplementation(
+      async (
+        stream: NodeJS.ReadableStream,
+        bufferSize?: number,
+        maxConcurrency?: number,
+        options?: BlockBlobUploadStreamOptions
+      ) => {
+        const {onProgress, abortSignal} = options || {}
+        onProgress?.({loadedBytes: 0})
+        return new Promise(resolve => {
+          abortSignal?.addEventListener('abort', () => {
+            resolve({})
+          })
+        })
+      }
+    )
+
+    const uploadResp = uploadArtifact(
+      fixtures.inputs.artifactName,
+      fixtures.inputs.files,
+      fixtures.inputs.rootDirectory
+    )
+
+    await expect(uploadResp).rejects.toThrow('Upload progress stalled.')
   })
 })

packages/artifact/__tests__/upload-zip-specification.test.ts

@@ -305,4 +305,22 @@ describe('Search', () => {
       }
     }
   })
+
+  it('Upload Specification - Includes symlinks', async () => {
+    const targetPath = path.join(root, 'link-dir', 'symlink-me.txt')
+    await fs.mkdir(path.dirname(targetPath), {recursive: true})
+    await fs.writeFile(targetPath, 'symlink file content')
+
+    const uploadPath = path.join(root, 'upload-dir', 'symlink.txt')
+    await fs.mkdir(path.dirname(uploadPath), {recursive: true})
+    await fs.symlink(targetPath, uploadPath, 'file')
+
+    const specifications = getUploadZipSpecification([uploadPath], root)
+    expect(specifications.length).toEqual(1)
+    expect(specifications[0].sourcePath).toEqual(uploadPath)
+    expect(specifications[0].destinationPath).toEqual(
+      path.join('/upload-dir', 'symlink.txt')
+    )
+    expect(specifications[0].stats.isSymbolicLink()).toBe(true)
+  })
 })

packages/artifact/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@actions/artifact",
-  "version": "2.1.7",
+  "version": "2.1.11",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@actions/artifact",
-      "version": "2.1.7",
+      "version": "2.1.11",
       "license": "MIT",
       "dependencies": {
         "@actions/core": "^1.10.0",
@@ -19,7 +19,6 @@
         "@octokit/request-error": "^5.0.0",
         "@protobuf-ts/plugin": "^2.2.3-alpha.1",
         "archiver": "^7.0.1",
-        "crypto": "^1.0.1",
         "jwt-decode": "^3.1.2",
         "twirp-ts": "^2.5.0",
         "unzip-stream": "^0.3.1"
@@ -840,9 +839,10 @@
       }
     },
     "node_modules/cross-spawn": {
-      "version": "7.0.3",
-      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.3.tgz",
-      "integrity": "sha512-iRDPJKUPVEND7dHPO8rkbOnPpyDygcDFtWjpeWNCgy8WP2rXcxXL8TskReQl6OrB2G7+UJrags1q15Fudc7G6w==",
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
+      "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
+      "license": "MIT",
       "dependencies": {
         "path-key": "^3.1.0",
         "shebang-command": "^2.0.0",
@@ -852,12 +852,6 @@
         "node": ">= 8"
       }
     },
-    "node_modules/crypto": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/crypto/-/crypto-1.0.1.tgz",
-      "integrity": "sha512-VxBKmeNcqQdiUQUW2Tzq0t377b54N2bMtXO/qiLa+6eRRmmC4qT3D4OnTGoT/U6O9aklQ/jTwbOtRMTTY8G0Ig==",
-      "deprecated": "This package is no longer supported. It's now a built-in Node module. If you've depended on crypto, you should switch to the one that's built-in."
-    },
     "node_modules/delayed-stream": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/delayed-stream/-/delayed-stream-1.0.0.tgz",
@@ -1315,9 +1309,9 @@
       }
     },
     "node_modules/path-to-regexp": {
-      "version": "6.2.1",
-      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-6.2.1.tgz",
-      "integrity": "sha512-JLyh7xT1kizaEvcaXOQwOc2/Yhw6KZOvPf1S8401UyLk86CU79LN3vl7ztXGm/pZ+YjoyAJ4rxmHwbkBXJX+yw=="
+      "version": "6.3.0",
+      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-6.3.0.tgz",
+      "integrity": "sha512-Yhpw4T9C6hPpgPeA28us07OJeqZ5EzQTkbfwuhsUg0c237RomFoETJgmp2sa3F/41gfLE6G5cqcYwznmeEeOlQ=="
     },
     "node_modules/prettier": {
       "version": "2.8.8",

packages/artifact/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actions/artifact",
-  "version": "2.1.7",
+  "version": "2.1.11",
   "preview": true,
   "description": "Actions artifact lib",
   "keywords": [
@@ -50,7 +50,6 @@
     "@octokit/request-error": "^5.0.0",
     "@protobuf-ts/plugin": "^2.2.3-alpha.1",
     "archiver": "^7.0.1",
-    "crypto": "^1.0.1",
     "jwt-decode": "^3.1.2",
     "twirp-ts": "^2.5.0",
     "unzip-stream": "^0.3.1"

packages/artifact/src/internal/shared/config.ts

@@ -30,10 +30,10 @@ export function isGhes(): boolean {
 
   const hostname = ghUrl.hostname.trimEnd().toUpperCase()
   const isGitHubHost = hostname === 'GITHUB.COM'
-  const isGheHost =
-    hostname.endsWith('.GHE.COM') || hostname.endsWith('.GHE.LOCALHOST')
+  const isGheHost = hostname.endsWith('.GHE.COM')
+  const isLocalHost = hostname.endsWith('.LOCALHOST')
 
-  return !isGitHubHost && !isGheHost
+  return !isGitHubHost && !isGheHost && !isLocalHost
 }
 
 export function getGitHubWorkspaceDir(): string {
@@ -57,3 +57,7 @@ export function getConcurrency(): number {
   const concurrency = 16 * numCPUs
   return concurrency > 300 ? 300 : concurrency
 }
+
+export function getUploadChunkTimeout(): number {
+  return 300_000 // 5 minutes
+}

packages/artifact/src/internal/upload/blob-upload.ts

@@ -1,7 +1,11 @@
 import {BlobClient, BlockBlobUploadStreamOptions} from '@azure/storage-blob'
 import {TransferProgressEvent} from '@azure/core-http'
 import {ZipUploadStream} from './zip'
-import {getUploadChunkSize, getConcurrency} from '../shared/config'
+import {
+  getUploadChunkSize,
+  getConcurrency,
+  getUploadChunkTimeout
+} from '../shared/config'
 import * as core from '@actions/core'
 import * as crypto from 'crypto'
 import * as stream from 'stream'
@@ -25,29 +29,26 @@ export async function uploadZipToBlobStorage(
 ): Promise<BlobUploadResponse> {
   let uploadByteCount = 0
   let lastProgressTime = Date.now()
-  let timeoutId: NodeJS.Timeout | undefined
+  const abortController = new AbortController()
 
-  const chunkTimer = (timeout: number): NodeJS.Timeout => {
-    // clear the previous timeout
-    if (timeoutId) {
-      clearTimeout(timeoutId)
-    }
+  const chunkTimer = async (interval: number): Promise<void> =>
+    new Promise((resolve, reject) => {
+      const timer = setInterval(() => {
+        if (Date.now() - lastProgressTime > interval) {
+          reject(new Error('Upload progress stalled.'))
+        }
+      }, interval)
+
+      abortController.signal.addEventListener('abort', () => {
+        clearInterval(timer)
+        resolve()
+      })
+    })
 
-    timeoutId = setTimeout(() => {
-      const now = Date.now()
-      // if there's been more than 30 seconds since the
-      // last progress event, then we'll consider the upload stalled
-      if (now - lastProgressTime > timeout) {
-        throw new Error('Upload progress stalled.')
-      }
-    }, timeout)
-    return timeoutId
-  }
   const maxConcurrency = getConcurrency()
   const bufferSize = getUploadChunkSize()
   const blobClient = new BlobClient(authenticatedUploadURL)
   const blockBlobClient = blobClient.getBlockBlobClient()
-  const timeoutDuration = 300000 // 30 seconds
 
   core.debug(
     `Uploading artifact zip to blob storage with maxConcurrency: ${maxConcurrency}, bufferSize: ${bufferSize}`
@@ -56,13 +57,13 @@ export async function uploadZipToBlobStorage(
   const uploadCallback = (progress: TransferProgressEvent): void => {
     core.info(`Uploaded bytes ${progress.loadedBytes}`)
     uploadByteCount = progress.loadedBytes
-    chunkTimer(timeoutDuration)
     lastProgressTime = Date.now()
   }
 
   const options: BlockBlobUploadStreamOptions = {
     blobHTTPHeaders: {blobContentType: 'zip'},
-    onProgress: uploadCallback
+    onProgress: uploadCallback,
+    abortSignal: abortController.signal
   }
 
   let sha256Hash: string | undefined = undefined
@@ -75,24 +76,22 @@ export async function uploadZipToBlobStorage(
   core.info('Beginning upload of artifact content to blob storage')
 
   try {
-    // Start the chunk timer
-    timeoutId = chunkTimer(timeoutDuration)
-    await blockBlobClient.uploadStream(
-      uploadStream,
-      bufferSize,
-      maxConcurrency,
-      options
-    )
+    await Promise.race([
+      blockBlobClient.uploadStream(
+        uploadStream,
+        bufferSize,
+        maxConcurrency,
+        options
+      ),
+      chunkTimer(getUploadChunkTimeout())
+    ])
   } catch (error) {
     if (NetworkError.isNetworkErrorCode(error?.code)) {
       throw new NetworkError(error?.code)
     }
     throw error
   } finally {
-    // clear the timeout whether or not the upload completes
-    if (timeoutId) {
-      clearTimeout(timeoutId)
-    }
+    abortController.abort()
   }
 
   core.info('Finished uploading artifact content to blob storage!')

packages/artifact/src/internal/upload/upload-zip-specification.ts

@@ -13,6 +13,12 @@ export interface UploadZipSpecification {
    * The destination path in a zip for a file
    */
   destinationPath: string
+
+  /**
+   * Information about the file
+   * https://nodejs.org/api/fs.html#class-fsstats
+   */
+  stats: fs.Stats
 }
 
 /**
@@ -75,10 +81,11 @@ export function getUploadZipSpecification(
           - file3.txt
   */
   for (let file of filesToZip) {
-    if (!fs.existsSync(file)) {
+    const stats = fs.lstatSync(file, {throwIfNoEntry: false})
+    if (!stats) {
       throw new Error(`File ${file} does not exist`)
     }
-    if (!fs.statSync(file).isDirectory()) {
+    if (!stats.isDirectory()) {
       // Normalize and resolve, this allows for either absolute or relative paths to be used
       file = normalize(file)
       file = resolve(file)
@@ -94,7 +101,8 @@ export function getUploadZipSpecification(
 
       specification.push({
         sourcePath: file,
-        destinationPath: uploadPath
+        destinationPath: uploadPath,
+        stats
       })
     } else {
       // Empty directory
@@ -103,7 +111,8 @@ export function getUploadZipSpecification(
 
       specification.push({
         sourcePath: null,
-        destinationPath: directoryPath
+        destinationPath: directoryPath,
+        stats
       })
     }
   }

packages/artifact/src/internal/upload/zip.ts

@@ -1,7 +1,7 @@
 import * as stream from 'stream'
+import {realpath} from 'fs/promises'
 import * as archiver from 'archiver'
 import * as core from '@actions/core'
-import {createReadStream} from 'fs'
 import {UploadZipSpecification} from './upload-zip-specification'
 import {getUploadChunkSize} from '../shared/config'
 
@@ -43,8 +43,14 @@ export async function createZipUploadStream(
 
   for (const file of uploadSpecification) {
     if (file.sourcePath !== null) {
-      // Add a normal file to the zip
-      zip.append(createReadStream(file.sourcePath), {
+      // Check if symlink and resolve the source path
+      let sourcePath = file.sourcePath
+      if (file.stats.isSymbolicLink()) {
+        sourcePath = await realpath(file.sourcePath)
+      }
+
+      // Add the file to the zip
+      zip.file(sourcePath, {
         name: file.destinationPath
       })
     } else {

packages/attest/README.md

@@ -32,8 +32,7 @@ async function run() {
     const ghToken = core.getInput('gh-token');
 
     const attestation = await attest({
-        subjectName: 'my-artifact-name',
-        subjectDigest: { 'sha256': '36ab4667...'},
+        subjects: [{name: 'my-artifact-name', digest: { 'sha256': '36ab4667...'}}],
         predicateType: 'https://in-toto.io/attestation/release',
         predicate: { . . . },
         token: ghToken
@@ -49,11 +48,12 @@ The `attest` function supports the following options:
 
 ```typescript
 export type AttestOptions = {
-  // The name of the subject to be attested.
-  subjectName: string
-  // The digest of the subject to be attested. Should be a map of digest
-  // algorithms to their hex-encoded values.
-  subjectDigest: Record<string, string>
+  // Deprecated. Use 'subjects' instead.
+  subjectName?: string
+  // Deprecated. Use 'subjects' instead.
+  subjectDigest?: Record<string, string>
+  // Collection of subjects to be attested
+  subjects?: Subject[]
   // URI identifying the content type of the predicate being attested.
   predicateType: string
   // Predicate to be attested.
@@ -63,9 +63,18 @@ export type AttestOptions = {
   // Sigstore instance to use for signing. Must be one of "public-good" or
   // "github".
   sigstore?: 'public-good' | 'github'
+  // HTTP headers to include in request to attestations API.
+  headers?: {[header: string]: string | number | undefined}
   // Whether to skip writing the attestation to the GH attestations API.
   skipWrite?: boolean
 }
+
+export type Subject = {
+   // Name of the subject.
+  name: string
+   // Digests of the subject. Should be a map of digest algorithms to their hex-encoded values.
+  digest: Record<string, string>
+}
 ```
 
 ### `attestProvenance`
@@ -103,16 +112,19 @@ The `attestProvenance` function supports the following options:
 
 ```typescript
 export type AttestProvenanceOptions = {
-  // The name of the subject to be attested.
-  subjectName: string
-  // The digest of the subject to be attested. Should be a map of digest
-  // algorithms to their hex-encoded values.
-  subjectDigest: Record<string, string>
-  // GitHub token for writing attestations.
+  // Deprecated. Use 'subjects' instead.
+  subjectName?: string
+  // Deprecated. Use 'subjects' instead.
+  subjectDigest?: Record<string, string>
+  // Collection of subjects to be attested
+  subjects?: Subject[]
+  // URI identifying the content type of the predicate being attested.
   token: string
   // Sigstore instance to use for signing. Must be one of "public-good" or
   // "github".
   sigstore?: 'public-good' | 'github'
+  // HTTP headers to include in request to attestations API.
+  headers?: {[header: string]: string | number | undefined}
   // Whether to skip writing the attestation to the GH attestations API.
   skipWrite?: boolean
   // Issuer URL responsible for minting the OIDC token from which the

packages/attest/RELEASES.md

@@ -1,19 +1,51 @@
 # @actions/attest Releases
 
+### 1.5.0
+
+- Bump @actions/core from 1.10.1 to 1.11.1 [#1847](https://github.com/actions/toolkit/pull/1847)
+- Bump @sigstore/bundle from 2.3.2 to 3.0.0 [#1846](https://github.com/actions/toolkit/pull/1846)
+- Bump @sigstore/sign from 2.3.2 to 3.0.0 [#1846](https://github.com/actions/toolkit/pull/1846)
+- Support for generating multi-subject attestations [#1864](https://github.com/actions/toolkit/pull/1865)
+- Fix bug in `buildSLSAProvenancePredicate` related to `workflow_ref` OIDC token claims containing the "@" symbol in the tag name [#1863](https://github.com/actions/toolkit/pull/1863)
+
+### 1.4.2
+
+- Fix bug in `buildSLSAProvenancePredicate`/`attestProvenance` when generating provenance statement for enterprise account using customized OIDC issuer value [#1823](https://github.com/actions/toolkit/pull/1823)
+
+### 1.4.1
+
+- Bump @actions/http-client from 2.2.1 to 2.2.3 [#1805](https://github.com/actions/toolkit/pull/1805)
+
+### 1.4.0
+
+- Add new `headers` parameter to the `attest` and `attestProvenance` functions [#1790](https://github.com/actions/toolkit/pull/1790)
+- Update `buildSLSAProvenancePredicate`/`attestProvenance` to automatically derive default OIDC issuer URL from current execution context [#1796](https://github.com/actions/toolkit/pull/1796)
+### 1.3.1
+
+- Fix bug with proxy support when retrieving JWKS for OIDC issuer [#1776](https://github.com/actions/toolkit/pull/1776)
+
+### 1.3.0
+
+- Dynamic construction of Sigstore API URLs [#1735](https://github.com/actions/toolkit/pull/1735)
+- Switch to new GH provenance build type [#1745](https://github.com/actions/toolkit/pull/1745)
+- Fetch existing Rekor entry on 409 conflict error [#1759](https://github.com/actions/toolkit/pull/1759)
+- Bump @sigstore/bundle from 2.3.0 to 2.3.2 [#1738](https://github.com/actions/toolkit/pull/1738)
+- Bump @sigstore/sign from 2.3.0 to 2.3.2 [#1738](https://github.com/actions/toolkit/pull/1738)
+
 ### 1.2.1
 
-- Retry request on attestation persistence failure
+- Retry request on attestation persistence failure [#1725](https://github.com/actions/toolkit/pull/1725)
 
 ### 1.2.0
 
-- Generate attestations using the v0.3 Sigstore bundle format.
-- Bump @sigstore/bundle from 2.2.0 to 2.3.0.
-- Bump @sigstore/sign from 2.2.3 to 2.3.0.
-- Remove dependency on make-fetch-happen
+- Generate attestations using the v0.3 Sigstore bundle format [#1701](https://github.com/actions/toolkit/pull/1701)
+- Bump @sigstore/bundle from 2.2.0 to 2.3.0 [#1701](https://github.com/actions/toolkit/pull/1701)
+- Bump @sigstore/sign from 2.2.3 to 2.3.0 [#1701](https://github.com/actions/toolkit/pull/1701)
+- Remove dependency on make-fetch-happen [#1714](https://github.com/actions/toolkit/pull/1714)
 
 ### 1.1.0
 
-- Updates the `attestProvenance` function to retrieve a token from the GitHub OIDC provider and use the token claims to populate the provenance statement.
+- Updates the `attestProvenance` function to retrieve a token from the GitHub OIDC provider and use the token claims to populate the provenance statement [#1693](https://github.com/actions/toolkit/pull/1693)
 
 ### 1.0.0
 

packages/attest/__tests__/__snapshots__/provenance.test.ts.snap

@@ -1,15 +1,15 @@
 // Jest Snapshot v1, https://goo.gl/fbAQLP
 
-exports[`provenance functions buildSLSAProvenancePredicate returns a provenance hydrated from an OIDC token 1`] = `
+exports[`provenance functions buildSLSAProvenancePredicate handle tags including "@" character 1`] = `
 {
   "params": {
     "buildDefinition": {
-      "buildType": "https://slsa-framework.github.io/github-actions-buildtypes/workflow/v1",
+      "buildType": "https://actions.github.io/buildtypes/workflow/v1",
       "externalParameters": {
         "workflow": {
           "path": ".github/workflows/main.yml",
-          "ref": "main",
-          "repository": "https://github.com/owner/repo",
+          "ref": "foo@1.0.0",
+          "repository": "https://foo.ghe.com/owner/repo",
         },
       },
       "internalParameters": {
@@ -17,6 +17,7 @@ exports[`provenance functions buildSLSAProvenancePredicate returns a provenance
           "event_name": "push",
           "repository_id": "repo-id",
           "repository_owner_id": "owner-id",
+          "runner_environment": "github-hosted",
         },
       },
       "resolvedDependencies": [
@@ -24,16 +25,58 @@ exports[`provenance functions buildSLSAProvenancePredicate returns a provenance
           "digest": {
             "gitCommit": "babca52ab0c93ae16539e5923cb0d7403b9a093b",
           },
-          "uri": "git+https://github.com/owner/repo@refs/heads/main",
+          "uri": "git+https://foo.ghe.com/owner/repo@refs/heads/main",
         },
       ],
     },
     "runDetails": {
       "builder": {
-        "id": "https://github.com/actions/runner/github-hosted",
+        "id": "https://foo.ghe.com/owner/workflows/.github/workflows/publish.yml@main",
       },
       "metadata": {
-        "invocationId": "https://github.com/owner/repo/actions/runs/run-id/attempts/run-attempt",
+        "invocationId": "https://foo.ghe.com/owner/repo/actions/runs/run-id/attempts/run-attempt",
+      },
+    },
+  },
+  "type": "https://slsa.dev/provenance/v1",
+}
+`;
+
+exports[`provenance functions buildSLSAProvenancePredicate returns a provenance hydrated from an OIDC token 1`] = `
+{
+  "params": {
+    "buildDefinition": {
+      "buildType": "https://actions.github.io/buildtypes/workflow/v1",
+      "externalParameters": {
+        "workflow": {
+          "path": ".github/workflows/main.yml",
+          "ref": "main",
+          "repository": "https://foo.ghe.com/owner/repo",
+        },
+      },
+      "internalParameters": {
+        "github": {
+          "event_name": "push",
+          "repository_id": "repo-id",
+          "repository_owner_id": "owner-id",
+          "runner_environment": "github-hosted",
+        },
+      },
+      "resolvedDependencies": [
+        {
+          "digest": {
+            "gitCommit": "babca52ab0c93ae16539e5923cb0d7403b9a093b",
+          },
+          "uri": "git+https://foo.ghe.com/owner/repo@refs/heads/main",
+        },
+      ],
+    },
+    "runDetails": {
+      "builder": {
+        "id": "https://foo.ghe.com/owner/workflows/.github/workflows/publish.yml@main",
+      },
+      "metadata": {
+        "invocationId": "https://foo.ghe.com/owner/repo/actions/runs/run-id/attempts/run-attempt",
       },
     },
   },

packages/attest/__tests__/attest.test.ts

@@ -0,0 +1,16 @@
+import {attest} from '../src/attest'
+
+describe('attest', () => {
+  describe('when no subject information is provided', () => {
+    it('throws an error', async () => {
+      const options = {
+        predicateType: 'foo',
+        predicate: {bar: 'baz'},
+        token: 'token'
+      }
+      expect(attest(options)).rejects.toThrowError(
+        'Must provide either subjectName and subjectDigest or subjects'
+      )
+    })
+  })
+})

packages/attest/__tests__/intoto.test.ts

@@ -17,7 +17,7 @@ describe('buildIntotoStatement', () => {
   }
 
   it('returns an intoto statement', () => {
-    const statement = buildIntotoStatement(subject, predicate)
+    const statement = buildIntotoStatement([subject], predicate)
     expect(statement).toMatchSnapshot()
   })
 })

packages/attest/__tests__/oidc.test.ts

@@ -45,7 +45,8 @@ describe('getIDTokenClaims', () => {
       sha: 'sha',
       repository: 'repo',
       event_name: 'push',
-      workflow_ref: 'main',
+      job_workflow_ref: 'job_workflow_ref',
+      workflow_ref: 'workflow',
       repository_id: '1',
       repository_owner_id: '1',
       runner_environment: 'github-hosted',
@@ -67,6 +68,55 @@ describe('getIDTokenClaims', () => {
     })
   })
 
+  describe('when ID token is valid (w/ enterprise slug)', () => {
+    const claims = {
+      iss: `${issuer}/foo-bar`,
+      aud: audience,
+      ref: 'ref',
+      sha: 'sha',
+      repository: 'repo',
+      event_name: 'push',
+      job_workflow_ref: 'job_workflow_ref',
+      workflow_ref: 'workflow',
+      repository_id: '1',
+      repository_owner_id: '1',
+      runner_environment: 'github-hosted',
+      run_id: '1',
+      run_attempt: '1'
+    }
+
+    beforeEach(async () => {
+      const jwt = await new jose.SignJWT(claims)
+        .setProtectedHeader({alg: 'PS256'})
+        .sign(key.privateKey)
+
+      nock(issuer).get(tokenPath).query({audience}).reply(200, {value: jwt})
+    })
+
+    it('returns the ID token claims', async () => {
+      const result = await getIDTokenClaims(issuer)
+      expect(result).toEqual(claims)
+    })
+  })
+
+  describe('when ID token is missing the "iss" claim', () => {
+    const claims = {
+      aud: audience
+    }
+
+    beforeEach(async () => {
+      const jwt = await new jose.SignJWT(claims)
+        .setProtectedHeader({alg: 'PS256'})
+        .sign(key.privateKey)
+
+      nock(issuer).get(tokenPath).query({audience}).reply(200, {value: jwt})
+    })
+
+    it('throws an error', async () => {
+      await expect(getIDTokenClaims(issuer)).rejects.toThrow(/missing "iss"/i)
+    })
+  })
+
   describe('when ID token is missing required claims', () => {
     const claims = {
       iss: issuer,
@@ -98,7 +148,9 @@ describe('getIDTokenClaims', () => {
     })
 
     it('throws an error', async () => {
-      await expect(getIDTokenClaims(issuer)).rejects.toThrow(/issuer invalid/)
+      await expect(getIDTokenClaims(issuer)).rejects.toThrow(
+        /unexpected "iss"/i
+      )
     })
   })
 
@@ -114,7 +166,7 @@ describe('getIDTokenClaims', () => {
     })
 
     it('throw an error', async () => {
-      await expect(getIDTokenClaims(issuer)).rejects.toThrow(/audience invalid/)
+      await expect(getIDTokenClaims(issuer)).rejects.toThrow(/unexpected "aud"/)
     })
   })
 

packages/attest/__tests__/provenance.test.ts

@@ -8,7 +8,7 @@ import {attestProvenance, buildSLSAProvenancePredicate} from '../src/provenance'
 
 describe('provenance functions', () => {
   const originalEnv = process.env
-  const issuer = 'https://example.com'
+  const issuer = 'https://token.actions.foo.ghe.com'
   const audience = 'nobody'
   const jwksPath = '/.well-known/jwks.json'
   const tokenPath = '/token'
@@ -23,6 +23,7 @@ describe('provenance functions', () => {
     repository: 'owner/repo',
     ref: 'refs/heads/main',
     sha: 'babca52ab0c93ae16539e5923cb0d7403b9a093b',
+    job_workflow_ref: 'owner/workflows/.github/workflows/publish.yml@main',
     workflow_ref: 'owner/repo/.github/workflows/main.yml@main',
     event_name: 'push',
     repository_id: 'repo-id',
@@ -32,15 +33,7 @@ describe('provenance functions', () => {
     runner_environment: 'github-hosted'
   }
 
-  beforeEach(async () => {
-    process.env = {
-      ...originalEnv,
-      ACTIONS_ID_TOKEN_REQUEST_URL: `${issuer}${tokenPath}?`,
-      ACTIONS_ID_TOKEN_REQUEST_TOKEN: 'token',
-      GITHUB_SERVER_URL: 'https://github.com',
-      GITHUB_REPOSITORY: claims.repository
-    }
-
+  const mockIssuer = async (claims: jose.JWTPayload): Promise<void> => {
     // Generate JWT signing key
     const key = await jose.generateKeyPair('PS256')
 
@@ -59,6 +52,18 @@ describe('provenance functions', () => {
 
     // Mock OIDC token endpoint for populating the provenance
     nock(issuer).get(tokenPath).query({audience}).reply(200, {value: jwt})
+  }
+
+  beforeEach(async () => {
+    process.env = {
+      ...originalEnv,
+      ACTIONS_ID_TOKEN_REQUEST_URL: `${issuer}${tokenPath}?`,
+      ACTIONS_ID_TOKEN_REQUEST_TOKEN: 'token',
+      GITHUB_SERVER_URL: 'https://foo.ghe.com',
+      GITHUB_REPOSITORY: claims.repository
+    }
+
+    await mockIssuer(claims)
   })
 
   afterEach(() => {
@@ -67,7 +72,17 @@ describe('provenance functions', () => {
 
   describe('buildSLSAProvenancePredicate', () => {
     it('returns a provenance hydrated from an OIDC token', async () => {
-      const predicate = await buildSLSAProvenancePredicate(issuer)
+      const predicate = await buildSLSAProvenancePredicate()
+      expect(predicate).toMatchSnapshot()
+    })
+
+    it('handle tags including "@" character', async () => {
+      nock.cleanAll()
+      await mockIssuer({
+        ...claims,
+        workflow_ref: 'owner/repo/.github/workflows/main.yml@foo@1.0.0'
+      })
+      const predicate = await buildSLSAProvenancePredicate()
       expect(predicate).toMatchSnapshot()
     })
   })
@@ -95,9 +110,9 @@ describe('provenance functions', () => {
     })
 
     describe('when using the github Sigstore instance', () => {
-      const {fulcioURL, tsaServerURL} = signingEndpoints('github')
-
       beforeEach(async () => {
+        const {fulcioURL, tsaServerURL} = signingEndpoints('github')
+
         // Mock Sigstore
         await mockFulcio({baseURL: fulcioURL, strict: false})
         await mockTSA({baseURL: tsaServerURL})
@@ -114,11 +129,9 @@ describe('provenance functions', () => {
       describe('when the sigstore instance is explicitly set', () => {
         it('attests provenance', async () => {
           const attestation = await attestProvenance({
-            subjectName,
-            subjectDigest,
+            subjects: [{name: subjectName, digest: subjectDigest}],
             token: 'token',
-            sigstore: 'github',
-            issuer
+            sigstore: 'github'
           })
 
           expect(attestation).toBeDefined()
@@ -143,10 +156,8 @@ describe('provenance functions', () => {
 
         it('attests provenance', async () => {
           const attestation = await attestProvenance({
-            subjectName,
-            subjectDigest,
-            token: 'token',
-            issuer
+            subjects: [{name: subjectName, digest: subjectDigest}],
+            token: 'token'
           })
 
           expect(attestation).toBeDefined()
@@ -179,11 +190,9 @@ describe('provenance functions', () => {
       describe('when the sigstore instance is explicitly set', () => {
         it('attests provenance', async () => {
           const attestation = await attestProvenance({
-            subjectName,
-            subjectDigest,
+            subjects: [{name: subjectName, digest: subjectDigest}],
             token: 'token',
-            sigstore: 'public-good',
-            issuer
+            sigstore: 'public-good'
           })
 
           expect(attestation).toBeDefined()
@@ -208,10 +217,8 @@ describe('provenance functions', () => {
 
         it('attests provenance', async () => {
           const attestation = await attestProvenance({
-            subjectName,
-            subjectDigest,
-            token: 'token',
-            issuer
+            subjects: [{name: subjectName, digest: subjectDigest}],
+            token: 'token'
           })
 
           expect(attestation).toBeDefined()
@@ -237,8 +244,7 @@ describe('provenance functions', () => {
           subjectDigest,
           token: 'token',
           sigstore: 'public-good',
-          skipWrite: true,
-          issuer
+          skipWrite: true
         })
 
         expect(attestation).toBeDefined()

packages/attest/__tests__/store.test.ts

@@ -5,6 +5,7 @@ describe('writeAttestation', () => {
   const originalEnv = process.env
   const attestation = {foo: 'bar '}
   const token = 'token'
+  const headers = {'X-GitHub-Foo': 'true'}
 
   const mockAgent = new MockAgent()
   setGlobalDispatcher(mockAgent)
@@ -27,14 +28,16 @@ describe('writeAttestation', () => {
         .intercept({
           path: '/repos/foo/bar/attestations',
           method: 'POST',
-          headers: {authorization: `token ${token}`},
+          headers: {authorization: `token ${token}`, ...headers},
           body: JSON.stringify({bundle: attestation})
         })
         .reply(201, {id: '123'})
     })
 
     it('persists the attestation', async () => {
-      await expect(writeAttestation(attestation, token)).resolves.toEqual('123')
+      await expect(
+        writeAttestation(attestation, token, {headers})
+      ).resolves.toEqual('123')
     })
   })
 

packages/attest/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actions/attest",
-  "version": "1.2.1",
+  "version": "1.5.0",
   "description": "Actions attestation lib",
   "keywords": [
     "github",
@@ -35,22 +35,20 @@
     "url": "https://github.com/actions/toolkit/issues"
   },
   "devDependencies": {
-    "@sigstore/mock": "^0.6.5",
-    "@sigstore/rekor-types": "^2.0.0",
+    "@sigstore/mock": "^0.8.0",
+    "@sigstore/rekor-types": "^3.0.0",
     "@types/jsonwebtoken": "^9.0.6",
-    "jose": "^5.2.3",
     "nock": "^13.5.1",
     "undici": "^5.28.4"
   },
   "dependencies": {
-    "@actions/core": "^1.10.1",
+    "@actions/core": "^1.11.1",
     "@actions/github": "^6.0.0",
-    "@actions/http-client": "^2.2.1",
+    "@actions/http-client": "^2.2.3",
     "@octokit/plugin-retry": "^6.0.1",
-    "@sigstore/bundle": "^2.3.0",
-    "@sigstore/sign": "^2.3.0",
-    "jsonwebtoken": "^9.0.2",
-    "jwks-rsa": "^3.1.0"
+    "@sigstore/bundle": "^3.0.0",
+    "@sigstore/sign": "^3.0.0",
+    "jose": "^5.2.3"
   },
   "overrides": {
     "@octokit/plugin-retry": {

packages/attest/src/attest.ts

@@ -14,11 +14,16 @@ const INTOTO_PAYLOAD_TYPE = 'application/vnd.in-toto+json'
  * Options for attesting a subject / predicate.
  */
 export type AttestOptions = {
-  // The name of the subject to be attested.
-  subjectName: string
-  // The digest of the subject to be attested. Should be a map of digest
-  // algorithms to their hex-encoded values.
-  subjectDigest: Record<string, string>
+  /**
+   * @deprecated Use `subjects` instead.
+   **/
+  subjectName?: string
+  /**
+   * @deprecated Use `subjects` instead.
+   **/
+  subjectDigest?: Record<string, string>
+  // Subjects to be attested.
+  subjects?: Subject[]
   // Content type of the predicate being attested.
   predicateType: string
   // Predicate to be attested.
@@ -28,6 +33,8 @@ export type AttestOptions = {
   // Sigstore instance to use for signing. Must be one of "public-good" or
   // "github".
   sigstore?: SigstoreInstance
+  // HTTP headers to include in request to attestations API.
+  headers?: {[header: string]: string | number | undefined}
   // Whether to skip writing the attestation to the GH attestations API.
   skipWrite?: boolean
 }
@@ -40,15 +47,24 @@ export type AttestOptions = {
  * @returns A promise that resolves to the attestation.
  */
 export async function attest(options: AttestOptions): Promise<Attestation> {
-  const subject: Subject = {
-    name: options.subjectName,
-    digest: options.subjectDigest
+  let subjects: Subject[]
+
+  if (options.subjects) {
+    subjects = options.subjects
+  } else if (options.subjectName && options.subjectDigest) {
+    subjects = [{name: options.subjectName, digest: options.subjectDigest}]
+  } else {
+    throw new Error(
+      'Must provide either subjectName and subjectDigest or subjects'
+    )
   }
+
   const predicate: Predicate = {
     type: options.predicateType,
     params: options.predicate
   }
-  const statement = buildIntotoStatement(subject, predicate)
+
+  const statement = buildIntotoStatement(subjects, predicate)
 
   // Sign the provenance statement
   const payload: Payload = {
@@ -61,7 +77,11 @@ export async function attest(options: AttestOptions): Promise<Attestation> {
   // Store the attestation
   let attestationID: string | undefined
   if (options.skipWrite !== true) {
-    attestationID = await writeAttestation(bundleToJSON(bundle), options.token)
+    attestationID = await writeAttestation(
+      bundleToJSON(bundle),
+      options.token,
+      {headers: options.headers}
+    )
   }
 
   return toAttestation(bundle, attestationID)

packages/attest/src/intoto.ts

@@ -20,12 +20,12 @@ export type InTotoStatement = {
  * @returns The constructed in-toto statement.
  */
 export const buildIntotoStatement = (
-  subject: Subject,
+  subjects: Subject[],
   predicate: Predicate
 ): InTotoStatement => {
   return {
     _type: INTOTO_STATEMENT_V1_TYPE,
-    subject: [subject],
+    subject: subjects,
     predicateType: predicate.type,
     predicate: predicate.params
   }

packages/attest/src/oidc.ts

@@ -1,16 +1,21 @@
 import {getIDToken} from '@actions/core'
 import {HttpClient} from '@actions/http-client'
-import * as jwt from 'jsonwebtoken'
-import jwks from 'jwks-rsa'
+import * as jose from 'jose'
 
 const OIDC_AUDIENCE = 'nobody'
 
+const VALID_SERVER_URLS = [
+  'https://github.com',
+  new RegExp('^https://[a-z0-9-]+\\.ghe\\.com$')
+] as const
+
 const REQUIRED_CLAIMS = [
   'iss',
   'ref',
   'sha',
   'repository',
   'event_name',
+  'job_workflow_ref',
   'workflow_ref',
   'repository_id',
   'repository_owner_id',
@@ -25,7 +30,8 @@ type OIDCConfig = {
   jwks_uri: string
 }
 
-export const getIDTokenClaims = async (issuer: string): Promise<ClaimSet> => {
+export const getIDTokenClaims = async (issuer?: string): Promise<ClaimSet> => {
+  issuer = issuer || getIssuer()
   try {
     const token = await getIDToken(OIDC_AUDIENCE)
     const claims = await decodeOIDCToken(token, issuer)
@@ -39,55 +45,46 @@ export const getIDTokenClaims = async (issuer: string): Promise<ClaimSet> => {
 const decodeOIDCToken = async (
   token: string,
   issuer: string
-): Promise<jwt.JwtPayload> => {
+): Promise<jose.JWTPayload> => {
   // Verify and decode token
-  return new Promise((resolve, reject) => {
-    jwt.verify(
-      token,
-      getPublicKey(issuer),
-      {audience: OIDC_AUDIENCE, issuer},
-      (err, decoded) => {
-        if (err) {
-          reject(err)
-        } else if (!decoded || typeof decoded === 'string') {
-          reject(new Error('No decoded token'))
-        } else {
-          resolve(decoded)
-        }
-      }
-    )
+  const jwks = jose.createLocalJWKSet(await getJWKS(issuer))
+  const {payload} = await jose.jwtVerify(token, jwks, {
+    audience: OIDC_AUDIENCE
   })
-}
 
-// Returns a callback to locate the public key for the given JWT header. This
-// involves two calls:
-// 1. Fetch the OpenID configuration to get the JWKS URI.
-// 2. Fetch the public key from the JWKS URI.
-const getPublicKey =
-  (issuer: string): jwt.GetPublicKeyOrSecret =>
-  (header: jwt.JwtHeader, callback: jwt.SigningKeyCallback) => {
-    // Look up the JWKS URI from the issuer's OpenID configuration
-    new HttpClient('actions/attest')
-      .getJson<OIDCConfig>(`${issuer}/.well-known/openid-configuration`)
-      .then(data => {
-        if (!data.result) {
-          callback(new Error('No OpenID configuration found'))
-        } else {
-          // Fetch the public key from the JWKS URI
-          jwks({jwksUri: data.result.jwks_uri}).getSigningKey(
-            header.kid,
-            (err, key) => {
-              callback(err, key?.getPublicKey())
-            }
-          )
-        }
-      })
-      .catch(err => {
-        callback(err)
-      })
+  if (!payload.iss) {
+    throw new Error('Missing "iss" claim')
   }
 
-function assertClaimSet(claims: jwt.JwtPayload): asserts claims is ClaimSet {
+  // Check that the issuer STARTS WITH the expected issuer URL to account for
+  // the fact that the value may include an enterprise-specific slug
+  if (!payload.iss.startsWith(issuer)) {
+    throw new Error(`Unexpected "iss" claim: ${payload.iss}`)
+  }
+
+  return payload
+}
+
+const getJWKS = async (issuer: string): Promise<jose.JSONWebKeySet> => {
+  const client = new HttpClient('@actions/attest')
+  const config = await client.getJson<OIDCConfig>(
+    `${issuer}/.well-known/openid-configuration`
+  )
+
+  if (!config.result) {
+    throw new Error('No OpenID configuration found')
+  }
+
+  const jwks = await client.getJson<jose.JSONWebKeySet>(config.result.jwks_uri)
+
+  if (!jwks.result) {
+    throw new Error('No JWKS found for issuer')
+  }
+
+  return jwks.result
+}
+
+function assertClaimSet(claims: jose.JWTPayload): asserts claims is ClaimSet {
   const missingClaims: string[] = []
 
   for (const claim of REQUIRED_CLAIMS) {
@@ -100,3 +97,21 @@ function assertClaimSet(claims: jwt.JwtPayload): asserts claims is ClaimSet {
     throw new Error(`Missing claims: ${missingClaims.join(', ')}`)
   }
 }
+
+// Derive the current OIDC issuer based on the server URL
+function getIssuer(): string {
+  const serverURL = process.env.GITHUB_SERVER_URL || 'https://github.com'
+
+  // Ensure the server URL is a valid GitHub server URL
+  if (!VALID_SERVER_URLS.some(valid_url => serverURL.match(valid_url))) {
+    throw new Error(`Invalid server URL: ${serverURL}`)
+  }
+
+  let host = new URL(serverURL).hostname
+
+  if (host === 'github.com') {
+    host = 'githubusercontent.com'
+  }
+
+  return `https://token.actions.${host}`
+}

packages/attest/src/provenance.ts

@@ -3,12 +3,7 @@ import {getIDTokenClaims} from './oidc'
 import type {Attestation, Predicate} from './shared.types'
 
 const SLSA_PREDICATE_V1_TYPE = 'https://slsa.dev/provenance/v1'
-
-const GITHUB_BUILDER_ID_PREFIX = 'https://github.com/actions/runner'
-const GITHUB_BUILD_TYPE =
-  'https://slsa-framework.github.io/github-actions-buildtypes/workflow/v1'
-
-const DEFAULT_ISSUER = 'https://token.actions.githubusercontent.com'
+const GITHUB_BUILD_TYPE = 'https://actions.github.io/buildtypes/workflow/v1'
 
 export type AttestProvenanceOptions = Omit<
   AttestOptions,
@@ -27,7 +22,7 @@ export type AttestProvenanceOptions = Omit<
  * @returns The SLSA provenance predicate.
  */
 export const buildSLSAProvenancePredicate = async (
-  issuer: string = DEFAULT_ISSUER
+  issuer?: string
 ): Promise<Predicate> => {
   const serverURL = process.env.GITHUB_SERVER_URL
   const claims = await getIDTokenClaims(issuer)
@@ -35,9 +30,11 @@ export const buildSLSAProvenancePredicate = async (
   // Split just the path and ref from the workflow string.
   // owner/repo/.github/workflows/main.yml@main =>
   //   .github/workflows/main.yml, main
-  const [workflowPath, workflowRef] = claims.workflow_ref
+  const [workflowPath, ...workflowRefChunks] = claims.workflow_ref
     .replace(`${claims.repository}/`, '')
     .split('@')
+  // Handle case where tag contains `@` (e.g: when using changesets in a monorepo context),
+  const workflowRef = workflowRefChunks.join('@')
 
   return {
     type: SLSA_PREDICATE_V1_TYPE,
@@ -55,7 +52,8 @@ export const buildSLSAProvenancePredicate = async (
           github: {
             event_name: claims.event_name,
             repository_id: claims.repository_id,
-            repository_owner_id: claims.repository_owner_id
+            repository_owner_id: claims.repository_owner_id,
+            runner_environment: claims.runner_environment
           }
         },
         resolvedDependencies: [
@@ -69,7 +67,7 @@ export const buildSLSAProvenancePredicate = async (
       },
       runDetails: {
         builder: {
-          id: `${GITHUB_BUILDER_ID_PREFIX}/${claims.runner_environment}`
+          id: `${serverURL}/${claims.job_workflow_ref}`
         },
         metadata: {
           invocationId: `${serverURL}/${claims.repository}/actions/runs/${claims.run_id}/attempts/${claims.run_attempt}`

packages/attest/src/sign.ts

@@ -86,7 +86,7 @@ const initBundleBuilder = (opts: SignOptions): BundleBuilder => {
     witnesses.push(
       new RekorWitness({
         rekorBaseURL: opts.rekorURL,
-        entryType: 'dsse',
+        fetchOnConflict: true,
         timeout,
         retry
       })
@@ -105,5 +105,5 @@ const initBundleBuilder = (opts: SignOptions): BundleBuilder => {
 
   // Build the bundle with the singleCertificate option which will
   // trigger the creation of v0.3 DSSE bundles
-  return new DSSEBundleBuilder({signer, witnesses, singleCertificate: true})
+  return new DSSEBundleBuilder({signer, witnesses})
 }

packages/attest/src/store.ts

@@ -1,11 +1,13 @@
 import * as github from '@actions/github'
 import {retry} from '@octokit/plugin-retry'
+import {RequestHeaders} from '@octokit/types'
 
 const CREATE_ATTESTATION_REQUEST = 'POST /repos/{owner}/{repo}/attestations'
 const DEFAULT_RETRY_COUNT = 5
 
 export type WriteOptions = {
   retry?: number
+  headers?: RequestHeaders
 }
 /**
  * Writes an attestation to the repository's attestations endpoint.
@@ -26,6 +28,7 @@ export const writeAttestation = async (
     const response = await octokit.request(CREATE_ATTESTATION_REQUEST, {
       owner: github.context.repo.owner,
       repo: github.context.repo.repo,
+      headers: options.headers,
       data: {bundle: attestation}
     })
 

packages/cache/README.md

@@ -6,6 +6,20 @@ See ["Caching dependencies to speed up workflows"](https://docs.github.com/en/ac
 
 Note that GitHub will remove any cache entries that have not been accessed in over 7 days. There is no limit on the number of caches you can store, but the total size of all caches in a repository is limited to 10 GB. If you exceed this limit, GitHub will save your cache but will begin evicting caches until the total size is less than 10 GB.
 
+## ⚠️ Important changes
+
+The cache backend service has been rewritten from the ground up for improved performance and reliability. The [@actions/cache](https://github.com/actions/toolkit/tree/main/packages/cache) package now integrates with the new cache service (v2) APIs.
+
+The new service will gradually roll out as of **February 1st, 2025**. The legacy service will also be sunset on the same date. Changes in this release are **fully backward compatible**.
+
+**All previous versions of this package will be deprecated**. We recommend upgrading to version `4.0.0` as soon as possible before **February 1st, 2025.**
+
+If you do not upgrade, all workflow runs using any of the deprecated [@actions/cache](https://github.com/actions/toolkit/tree/main/packages/cache) packages will fail.
+
+Upgrading to the recommended version should not break or require any changes to your workflows beyond updating your `package.json` to version `4.0.0`.
+
+Read more about the change & access the migration guide: [reference to the announcement](https://github.com/actions/toolkit/discussions/1890).
+
 ## Usage
 
 This package is used by the v2+ versions of our first party cache action. You can find an example implementation in the cache repo [here](https://github.com/actions/cache).
@@ -47,5 +61,3 @@ const cacheKey = await cache.restoreCache(paths, key, restoreKeys)
 A cache gets downloaded in multiple segments of fixed sizes (now `128MB` to fail-fast, previously `1GB` for a `32-bit` runner and `2GB` for a `64-bit` runner were used). Sometimes, a segment download gets stuck which causes the workflow job to be stuck forever and fail. Version `v3.0.4` of cache package introduces a segment download timeout. The segment download timeout will allow the segment download to get aborted and hence allow the job to proceed with a cache miss.
 
 Default value of this timeout is 10 minutes (starting `v3.2.1` and higher, previously 60 minutes in versions between `v.3.0.4` and `v3.2.0`, both included) and can be customized by specifying an [environment variable](https://docs.github.com/en/actions/learn-github-actions/environment-variables) named `SEGMENT_DOWNLOAD_TIMEOUT_MINS` with timeout value in minutes.
-
-

packages/cache/RELEASES.md

@@ -1,9 +1,36 @@
 # @actions/cache Releases
 
+### 4.0.0
+
+#### Important changes
+
+The cache backend service has been rewritten from the ground up for improved performance and reliability. The [@actions/cache](https://github.com/actions/toolkit/tree/main/packages/cache) package now integrates with the new cache service (v2) APIs.
+
+The new service will gradually roll out as of **February 1st, 2025**. The legacy service will also be sunset on the same date. Changes in this release are **fully backward compatible**.
+
+**All previous versions of this package will be deprecated**. We recommend upgrading to version `4.0.0` as soon as possible before **February 1st, 2025.**
+
+If you do not upgrade, all workflow runs using any of the deprecated [@actions/cache](https://github.com/actions/toolkit/tree/main/packages/cache) packages will fail.
+
+Upgrading to the recommended version should not break or require any changes to your workflows beyond updating your `package.json` to version `4.0.0`.
+
+Read more about the change & access the migration guide: [reference to the announcement](https://github.com/actions/toolkit/discussions/1890).
+
+#### Minor changes
+
+- Update `@actions/core` to `1.11.0`
+- Update `semver` `6.3.1`
+- Add `twirp-ts` `2.5.0` to dependencies
+
+### 3.3.0
+
+- Update `@actions/core` to `1.11.1`
+- Remove dependency on `uuid` package [#1824](https://github.com/actions/toolkit/pull/1824), [#1842](https://github.com/actions/toolkit/pull/1842)
+
 ### 3.2.4
 
 - Updated `isGhes` check to include `.ghe.com` and `.ghe.localhost` as accepted hosts
-  
+
 ### 3.2.3
 
 - Fixed a bug that mutated path arguments to `getCacheVersion` [#1378](https://github.com/actions/toolkit/pull/1378)

packages/cache/__tests__/cacheHttpClient.test.ts

@@ -1,4 +1,5 @@
-import {downloadCache, getCacheVersion} from '../src/internal/cacheHttpClient'
+import {downloadCache} from '../src/internal/cacheHttpClient'
+import {getCacheVersion} from '../src/internal/cacheUtils'
 import {CompressionMethod} from '../src/internal/constants'
 import * as downloadUtils from '../src/internal/downloadUtils'
 import {DownloadOptions, getDownloadOptions} from '../src/options'

packages/cache/__tests__/cacheUtils.test.ts

@@ -42,23 +42,3 @@ test('resolvePaths works on github workspace directory', async () => {
   const paths = await cacheUtils.resolvePaths([workspace])
   expect(paths.length).toBeGreaterThan(0)
 })
-
-test('isGhes returns false for github.com', async () => {
-  process.env.GITHUB_SERVER_URL = 'https://github.com'
-  expect(cacheUtils.isGhes()).toBe(false)
-})
-
-test('isGhes returns false for ghe.com', async () => {
-  process.env.GITHUB_SERVER_URL = 'https://somedomain.ghe.com'
-  expect(cacheUtils.isGhes()).toBe(false)
-})
-
-test('isGhes returns true for enterprise URL', async () => {
-  process.env.GITHUB_SERVER_URL = 'https://my-enterprise.github.com'
-  expect(cacheUtils.isGhes()).toBe(true)
-})
-
-test('isGhes returns false for ghe.localhost', () => {
-  process.env.GITHUB_SERVER_URL = 'https://my.domain.ghe.localhost'
-  expect(cacheUtils.isGhes()).toBe(false)
-})

packages/cache/__tests__/config.test.ts

@@ -0,0 +1,25 @@
+import * as config from '../src/internal/config'
+
+beforeEach(() => {
+  jest.resetModules()
+})
+
+test('isGhes returns false for github.com', async () => {
+  process.env.GITHUB_SERVER_URL = 'https://github.com'
+  expect(config.isGhes()).toBe(false)
+})
+
+test('isGhes returns false for ghe.com', async () => {
+  process.env.GITHUB_SERVER_URL = 'https://somedomain.ghe.com'
+  expect(config.isGhes()).toBe(false)
+})
+
+test('isGhes returns true for enterprise URL', async () => {
+  process.env.GITHUB_SERVER_URL = 'https://my-enterprise.github.com'
+  expect(config.isGhes()).toBe(true)
+})
+
+test('isGhes returns false for ghe.localhost', () => {
+  process.env.GITHUB_SERVER_URL = 'https://my.domain.ghe.localhost'
+  expect(config.isGhes()).toBe(false)
+})

packages/cache/__tests__/options.test.ts

@@ -11,8 +11,6 @@ const downloadConcurrency = 8
 const timeoutInMs = 30000
 const segmentTimeoutInMs = 600000
 const lookupOnly = false
-const uploadConcurrency = 4
-const uploadChunkSize = 32 * 1024 * 1024
 
 test('getDownloadOptions sets defaults', async () => {
   const actualOptions = getDownloadOptions()
@@ -43,18 +41,21 @@ test('getDownloadOptions overrides all settings', async () => {
 })
 
 test('getUploadOptions sets defaults', async () => {
+  const expectedOptions: UploadOptions = {
+    uploadConcurrency: 4,
+    uploadChunkSize: 32 * 1024 * 1024,
+    useAzureSdk: false
+  }
   const actualOptions = getUploadOptions()
 
-  expect(actualOptions).toEqual({
-    uploadConcurrency,
-    uploadChunkSize
-  })
+  expect(actualOptions).toEqual(expectedOptions)
 })
 
 test('getUploadOptions overrides all settings', async () => {
   const expectedOptions: UploadOptions = {
     uploadConcurrency: 2,
-    uploadChunkSize: 16 * 1024 * 1024
+    uploadChunkSize: 16 * 1024 * 1024,
+    useAzureSdk: true
   }
 
   const actualOptions = getUploadOptions(expectedOptions)
@@ -62,6 +63,34 @@ test('getUploadOptions overrides all settings', async () => {
   expect(actualOptions).toEqual(expectedOptions)
 })
 
+test('env variables override all getUploadOptions settings', async () => {
+  const expectedOptions: UploadOptions = {
+    uploadConcurrency: 16,
+    uploadChunkSize: 64 * 1024 * 1024,
+    useAzureSdk: true
+  }
+
+  process.env.CACHE_UPLOAD_CONCURRENCY = '16'
+  process.env.CACHE_UPLOAD_CHUNK_SIZE = '64'
+
+  const actualOptions = getUploadOptions(expectedOptions)
+  expect(actualOptions).toEqual(expectedOptions)
+})
+
+test('env variables override all getUploadOptions settings but do not exceed caps', async () => {
+  const expectedOptions: UploadOptions = {
+    uploadConcurrency: 32,
+    uploadChunkSize: 128 * 1024 * 1024,
+    useAzureSdk: true
+  }
+
+  process.env.CACHE_UPLOAD_CONCURRENCY = '64'
+  process.env.CACHE_UPLOAD_CHUNK_SIZE = '256'
+
+  const actualOptions = getUploadOptions(expectedOptions)
+  expect(actualOptions).toEqual(expectedOptions)
+})
+
 test('getDownloadOptions overrides download timeout minutes', async () => {
   const expectedOptions: DownloadOptions = {
     useAzureSdk: false,

packages/cache/__tests__/restoreCacheV2.test.ts

@@ -0,0 +1,415 @@
+import * as core from '@actions/core'
+import * as path from 'path'
+import * as tar from '../src/internal/tar'
+import * as config from '../src/internal/config'
+import * as cacheUtils from '../src/internal/cacheUtils'
+import * as cacheHttpClient from '../src/internal/cacheHttpClient'
+import {restoreCache} from '../src/cache'
+import {CacheFilename, CompressionMethod} from '../src/internal/constants'
+import {CacheServiceClientJSON} from '../src/generated/results/api/v1/cache.twirp'
+import {DownloadOptions} from '../src/options'
+
+jest.mock('../src/internal/cacheHttpClient')
+jest.mock('../src/internal/cacheUtils')
+jest.mock('../src/internal/config')
+jest.mock('../src/internal/tar')
+
+let logDebugMock: jest.SpyInstance
+let logInfoMock: jest.SpyInstance
+
+beforeAll(() => {
+  jest.spyOn(console, 'log').mockImplementation(() => {})
+  jest.spyOn(core, 'debug').mockImplementation(() => {})
+  jest.spyOn(core, 'info').mockImplementation(() => {})
+  jest.spyOn(core, 'warning').mockImplementation(() => {})
+  jest.spyOn(core, 'error').mockImplementation(() => {})
+
+  jest.spyOn(cacheUtils, 'getCacheFileName').mockImplementation(cm => {
+    const actualUtils = jest.requireActual('../src/internal/cacheUtils')
+    return actualUtils.getCacheFileName(cm)
+  })
+
+  // Ensure that we're using v2 for these tests
+  jest.spyOn(config, 'getCacheServiceVersion').mockReturnValue('v2')
+
+  logDebugMock = jest.spyOn(core, 'debug')
+  logInfoMock = jest.spyOn(core, 'info')
+})
+
+afterEach(() => {
+  expect(logDebugMock).toHaveBeenCalledWith('Cache service version: v2')
+})
+
+test('restore with no path should fail', async () => {
+  const paths: string[] = []
+  const key = 'node-test'
+  await expect(restoreCache(paths, key)).rejects.toThrowError(
+    `Path Validation Error: At least one directory or file path is required`
+  )
+})
+
+test('restore with too many keys should fail', async () => {
+  const paths = ['node_modules']
+  const key = 'node-test'
+  const restoreKeys = [...Array(20).keys()].map(x => x.toString())
+  await expect(restoreCache(paths, key, restoreKeys)).rejects.toThrowError(
+    `Key Validation Error: Keys are limited to a maximum of 10.`
+  )
+})
+
+test('restore with large key should fail', async () => {
+  const paths = ['node_modules']
+  const key = 'foo'.repeat(512) // Over the 512 character limit
+  await expect(restoreCache(paths, key)).rejects.toThrowError(
+    `Key Validation Error: ${key} cannot be larger than 512 characters.`
+  )
+})
+
+test('restore with invalid key should fail', async () => {
+  const paths = ['node_modules']
+  const key = 'comma,comma'
+  await expect(restoreCache(paths, key)).rejects.toThrowError(
+    `Key Validation Error: ${key} cannot contain commas.`
+  )
+})
+
+test('restore with no cache found', async () => {
+  const paths = ['node_modules']
+  const key = 'node-test'
+
+  jest
+    .spyOn(CacheServiceClientJSON.prototype, 'GetCacheEntryDownloadURL')
+    .mockReturnValue(
+      Promise.resolve({
+        ok: false,
+        signedDownloadUrl: '',
+        matchedKey: ''
+      })
+    )
+
+  const cacheKey = await restoreCache(paths, key)
+
+  expect(cacheKey).toBe(undefined)
+})
+
+test('restore with server error should fail', async () => {
+  const paths = ['node_modules']
+  const key = 'node-test'
+  const logWarningMock = jest.spyOn(core, 'warning')
+
+  jest
+    .spyOn(CacheServiceClientJSON.prototype, 'GetCacheEntryDownloadURL')
+    .mockImplementation(() => {
+      throw new Error('HTTP Error Occurred')
+    })
+
+  const cacheKey = await restoreCache(paths, key)
+  expect(cacheKey).toBe(undefined)
+  expect(logWarningMock).toHaveBeenCalledTimes(1)
+  expect(logWarningMock).toHaveBeenCalledWith(
+    'Failed to restore: HTTP Error Occurred'
+  )
+})
+
+test('restore with restore keys and no cache found', async () => {
+  const paths = ['node_modules']
+  const key = 'node-test'
+  const restoreKeys = ['node-']
+  const logWarningMock = jest.spyOn(core, 'warning')
+
+  jest
+    .spyOn(CacheServiceClientJSON.prototype, 'GetCacheEntryDownloadURL')
+    .mockReturnValue(
+      Promise.resolve({
+        ok: false,
+        signedDownloadUrl: '',
+        matchedKey: ''
+      })
+    )
+
+  const cacheKey = await restoreCache(paths, key, restoreKeys)
+
+  expect(cacheKey).toBe(undefined)
+  expect(logWarningMock).toHaveBeenCalledWith(
+    `Cache not found for keys: ${[key, ...restoreKeys].join(', ')}`
+  )
+})
+
+test('restore with gzip compressed cache found', async () => {
+  const paths = ['node_modules']
+  const key = 'node-test'
+  const compressionMethod = CompressionMethod.Gzip
+  const signedDownloadUrl = 'https://blob-storage.local?signed=true'
+  const cacheVersion =
+    'd90f107aaeb22920dba0c637a23c37b5bc497b4dfa3b07fe3f79bf88a273c11b'
+  const options = {useAzureSdk: true} as DownloadOptions
+
+  const getCacheVersionMock = jest.spyOn(cacheUtils, 'getCacheVersion')
+  getCacheVersionMock.mockReturnValue(cacheVersion)
+
+  const compressionMethodMock = jest.spyOn(cacheUtils, 'getCompressionMethod')
+  compressionMethodMock.mockReturnValue(Promise.resolve(compressionMethod))
+
+  const getCacheDownloadURLMock = jest.spyOn(
+    CacheServiceClientJSON.prototype,
+    'GetCacheEntryDownloadURL'
+  )
+  getCacheDownloadURLMock.mockReturnValue(
+    Promise.resolve({
+      ok: true,
+      signedDownloadUrl,
+      matchedKey: key
+    })
+  )
+
+  const tempPath = '/foo/bar'
+
+  const createTempDirectoryMock = jest.spyOn(cacheUtils, 'createTempDirectory')
+  createTempDirectoryMock.mockImplementation(async () => {
+    return Promise.resolve(tempPath)
+  })
+
+  const archivePath = path.join(tempPath, CacheFilename.Gzip)
+  const downloadCacheMock = jest.spyOn(cacheHttpClient, 'downloadCache')
+
+  const fileSize = 142
+  const getArchiveFileSizeInBytesMock = jest
+    .spyOn(cacheUtils, 'getArchiveFileSizeInBytes')
+    .mockReturnValue(fileSize)
+
+  const extractTarMock = jest.spyOn(tar, 'extractTar')
+  const unlinkFileMock = jest.spyOn(cacheUtils, 'unlinkFile')
+
+  const cacheKey = await restoreCache(paths, key, [], options)
+
+  expect(cacheKey).toBe(key)
+  expect(getCacheVersionMock).toHaveBeenCalledWith(
+    paths,
+    compressionMethod,
+    false
+  )
+  expect(getCacheDownloadURLMock).toHaveBeenCalledWith({
+    key,
+    restoreKeys: [],
+    version: cacheVersion
+  })
+  expect(createTempDirectoryMock).toHaveBeenCalledTimes(1)
+  expect(downloadCacheMock).toHaveBeenCalledWith(
+    signedDownloadUrl,
+    archivePath,
+    options
+  )
+  expect(getArchiveFileSizeInBytesMock).toHaveBeenCalledWith(archivePath)
+  expect(logInfoMock).toHaveBeenCalledWith(`Cache Size: ~0 MB (142 B)`)
+
+  expect(extractTarMock).toHaveBeenCalledTimes(1)
+  expect(extractTarMock).toHaveBeenCalledWith(archivePath, compressionMethod)
+
+  expect(unlinkFileMock).toHaveBeenCalledTimes(1)
+  expect(unlinkFileMock).toHaveBeenCalledWith(archivePath)
+
+  expect(compressionMethodMock).toHaveBeenCalledTimes(1)
+})
+
+test('restore with zstd compressed cache found', async () => {
+  const paths = ['node_modules']
+  const key = 'node-test'
+  const compressionMethod = CompressionMethod.Zstd
+  const signedDownloadUrl = 'https://blob-storage.local?signed=true'
+  const cacheVersion =
+    '8e2e96a184cb0cd6b48285b176c06a418f3d7fce14c29d9886fd1bb4f05c513d'
+  const options = {useAzureSdk: true} as DownloadOptions
+
+  const getCacheVersionMock = jest.spyOn(cacheUtils, 'getCacheVersion')
+  getCacheVersionMock.mockReturnValue(cacheVersion)
+
+  const compressionMethodMock = jest.spyOn(cacheUtils, 'getCompressionMethod')
+  compressionMethodMock.mockReturnValue(Promise.resolve(compressionMethod))
+
+  const getCacheDownloadURLMock = jest.spyOn(
+    CacheServiceClientJSON.prototype,
+    'GetCacheEntryDownloadURL'
+  )
+  getCacheDownloadURLMock.mockReturnValue(
+    Promise.resolve({
+      ok: true,
+      signedDownloadUrl,
+      matchedKey: key
+    })
+  )
+
+  const tempPath = '/foo/bar'
+
+  const createTempDirectoryMock = jest.spyOn(cacheUtils, 'createTempDirectory')
+  createTempDirectoryMock.mockImplementation(async () => {
+    return Promise.resolve(tempPath)
+  })
+
+  const archivePath = path.join(tempPath, CacheFilename.Zstd)
+  const downloadCacheMock = jest.spyOn(cacheHttpClient, 'downloadCache')
+
+  const fileSize = 62915000
+  const getArchiveFileSizeInBytesMock = jest
+    .spyOn(cacheUtils, 'getArchiveFileSizeInBytes')
+    .mockReturnValue(fileSize)
+
+  const extractTarMock = jest.spyOn(tar, 'extractTar')
+  const unlinkFileMock = jest.spyOn(cacheUtils, 'unlinkFile')
+
+  const cacheKey = await restoreCache(paths, key, [], options)
+
+  expect(cacheKey).toBe(key)
+  expect(getCacheVersionMock).toHaveBeenCalledWith(
+    paths,
+    compressionMethod,
+    false
+  )
+  expect(getCacheDownloadURLMock).toHaveBeenCalledWith({
+    key,
+    restoreKeys: [],
+    version: cacheVersion
+  })
+  expect(createTempDirectoryMock).toHaveBeenCalledTimes(1)
+  expect(downloadCacheMock).toHaveBeenCalledWith(
+    signedDownloadUrl,
+    archivePath,
+    options
+  )
+  expect(getArchiveFileSizeInBytesMock).toHaveBeenCalledWith(archivePath)
+  expect(logInfoMock).toHaveBeenCalledWith(`Cache Size: ~60 MB (62915000 B)`)
+
+  expect(extractTarMock).toHaveBeenCalledTimes(1)
+  expect(extractTarMock).toHaveBeenCalledWith(archivePath, compressionMethod)
+
+  expect(unlinkFileMock).toHaveBeenCalledTimes(1)
+  expect(unlinkFileMock).toHaveBeenCalledWith(archivePath)
+
+  expect(compressionMethodMock).toHaveBeenCalledTimes(1)
+})
+
+test('restore with cache found for restore key', async () => {
+  const paths = ['node_modules']
+  const key = 'node-test'
+  const restoreKeys = ['node-']
+  const compressionMethod = CompressionMethod.Gzip
+  const signedDownloadUrl = 'https://blob-storage.local?signed=true'
+  const cacheVersion =
+    'b8b58e9bd7b1e8f83d9f05c7e06ea865ba44a0330e07a14db74ac74386677bed'
+  const options = {useAzureSdk: true} as DownloadOptions
+
+  const getCacheVersionMock = jest.spyOn(cacheUtils, 'getCacheVersion')
+  getCacheVersionMock.mockReturnValue(cacheVersion)
+
+  const compressionMethodMock = jest.spyOn(cacheUtils, 'getCompressionMethod')
+  compressionMethodMock.mockReturnValue(Promise.resolve(compressionMethod))
+
+  const getCacheDownloadURLMock = jest.spyOn(
+    CacheServiceClientJSON.prototype,
+    'GetCacheEntryDownloadURL'
+  )
+  getCacheDownloadURLMock.mockReturnValue(
+    Promise.resolve({
+      ok: true,
+      signedDownloadUrl,
+      matchedKey: restoreKeys[0]
+    })
+  )
+
+  const tempPath = '/foo/bar'
+
+  const createTempDirectoryMock = jest.spyOn(cacheUtils, 'createTempDirectory')
+  createTempDirectoryMock.mockImplementation(async () => {
+    return Promise.resolve(tempPath)
+  })
+
+  const archivePath = path.join(tempPath, CacheFilename.Gzip)
+  const downloadCacheMock = jest.spyOn(cacheHttpClient, 'downloadCache')
+
+  const fileSize = 142
+  const getArchiveFileSizeInBytesMock = jest
+    .spyOn(cacheUtils, 'getArchiveFileSizeInBytes')
+    .mockReturnValue(fileSize)
+
+  const extractTarMock = jest.spyOn(tar, 'extractTar')
+  const unlinkFileMock = jest.spyOn(cacheUtils, 'unlinkFile')
+
+  const cacheKey = await restoreCache(paths, key, restoreKeys, options)
+
+  expect(cacheKey).toBe(restoreKeys[0])
+  expect(getCacheVersionMock).toHaveBeenCalledWith(
+    paths,
+    compressionMethod,
+    false
+  )
+  expect(getCacheDownloadURLMock).toHaveBeenCalledWith({
+    key,
+    restoreKeys,
+    version: cacheVersion
+  })
+  expect(createTempDirectoryMock).toHaveBeenCalledTimes(1)
+  expect(downloadCacheMock).toHaveBeenCalledWith(
+    signedDownloadUrl,
+    archivePath,
+    options
+  )
+  expect(getArchiveFileSizeInBytesMock).toHaveBeenCalledWith(archivePath)
+  expect(logInfoMock).toHaveBeenCalledWith(`Cache Size: ~0 MB (142 B)`)
+
+  expect(extractTarMock).toHaveBeenCalledTimes(1)
+  expect(extractTarMock).toHaveBeenCalledWith(archivePath, compressionMethod)
+
+  expect(unlinkFileMock).toHaveBeenCalledTimes(1)
+  expect(unlinkFileMock).toHaveBeenCalledWith(archivePath)
+
+  expect(compressionMethodMock).toHaveBeenCalledTimes(1)
+})
+
+test('restore with lookup only enabled', async () => {
+  const paths = ['node_modules']
+  const key = 'node-test'
+  const compressionMethod = CompressionMethod.Gzip
+  const signedDownloadUrl = 'https://blob-storage.local?signed=true'
+  const cacheVersion =
+    'd90f107aaeb22920dba0c637a23c37b5bc497b4dfa3b07fe3f79bf88a273c11b'
+  const options = {lookupOnly: true, useAzureSdk: true} as DownloadOptions
+
+  const getCacheVersionMock = jest.spyOn(cacheUtils, 'getCacheVersion')
+  getCacheVersionMock.mockReturnValue(cacheVersion)
+
+  const compressionMethodMock = jest.spyOn(cacheUtils, 'getCompressionMethod')
+  compressionMethodMock.mockReturnValue(Promise.resolve(compressionMethod))
+
+  const getCacheDownloadURLMock = jest.spyOn(
+    CacheServiceClientJSON.prototype,
+    'GetCacheEntryDownloadURL'
+  )
+  getCacheDownloadURLMock.mockReturnValue(
+    Promise.resolve({
+      ok: true,
+      signedDownloadUrl,
+      matchedKey: key
+    })
+  )
+
+  const createTempDirectoryMock = jest.spyOn(cacheUtils, 'createTempDirectory')
+  const downloadCacheMock = jest.spyOn(cacheHttpClient, 'downloadCache')
+
+  const cacheKey = await restoreCache(paths, key, undefined, options)
+
+  expect(cacheKey).toBe(key)
+  expect(getCacheVersionMock).toHaveBeenCalledWith(
+    paths,
+    compressionMethod,
+    false
+  )
+  expect(getCacheDownloadURLMock).toHaveBeenCalledWith({
+    key,
+    restoreKeys: [],
+    version: cacheVersion
+  })
+  expect(logInfoMock).toHaveBeenCalledWith('Lookup only - skipping download')
+
+  // creating a tempDir and downloading the cache are skipped
+  expect(createTempDirectoryMock).toHaveBeenCalledTimes(0)
+  expect(downloadCacheMock).toHaveBeenCalledTimes(0)
+})

packages/cache/__tests__/saveCache.test.ts

@@ -2,14 +2,11 @@ import * as core from '@actions/core'
 import * as path from 'path'
 import {saveCache} from '../src/cache'
 import * as cacheHttpClient from '../src/internal/cacheHttpClient'
-import * as cacheTwirpClient from '../src/internal/cacheTwirpClient'
-import {GetCacheBlobUploadURLResponse} from '../src/generated/results/api/v1/blobcache'
-import {BlobCacheServiceClientJSON} from '../src/generated/results/api/v1/blobcache.twirp'
 import * as cacheUtils from '../src/internal/cacheUtils'
+import * as config from '../src/internal/config'
 import {CacheFilename, CompressionMethod} from '../src/internal/constants'
 import * as tar from '../src/internal/tar'
 import {TypedResponse} from '@actions/http-client/lib/interfaces'
-import * as uploadCache from '../src/internal/v2/upload-cache'
 import {
   ReserveCacheResponse,
   ITypedResponseWithError
@@ -18,6 +15,7 @@ import {HttpClientError} from '@actions/http-client'
 
 jest.mock('../src/internal/cacheHttpClient')
 jest.mock('../src/internal/cacheUtils')
+jest.mock('../src/internal/config')
 jest.mock('../src/internal/tar')
 
 beforeAll(() => {
@@ -98,7 +96,7 @@ test('save with large cache outputs should fail in GHES with error message', asy
     .spyOn(cacheUtils, 'getCompressionMethod')
     .mockReturnValueOnce(Promise.resolve(compression))
 
-  jest.spyOn(cacheUtils, 'isGhes').mockReturnValueOnce(true)
+  jest.spyOn(config, 'isGhes').mockReturnValueOnce(true)
 
   const reserveCacheMock = jest
     .spyOn(cacheHttpClient, 'reserveCache')
@@ -150,7 +148,7 @@ test('save with large cache outputs should fail in GHES without error message',
     .spyOn(cacheUtils, 'getCompressionMethod')
     .mockReturnValueOnce(Promise.resolve(compression))
 
-  jest.spyOn(cacheUtils, 'isGhes').mockReturnValueOnce(true)
+  jest.spyOn(config, 'isGhes').mockReturnValueOnce(true)
 
   const reserveCacheMock = jest
     .spyOn(cacheHttpClient, 'reserveCache')
@@ -272,7 +270,12 @@ test('save with server error should fail', async () => {
     compression
   )
   expect(saveCacheMock).toHaveBeenCalledTimes(1)
-  expect(saveCacheMock).toHaveBeenCalledWith(cacheId, archiveFile, undefined)
+  expect(saveCacheMock).toHaveBeenCalledWith(
+    cacheId,
+    archiveFile,
+    '',
+    undefined
+  )
   expect(getCompressionMock).toHaveBeenCalledTimes(1)
 })
 
@@ -317,7 +320,12 @@ test('save with valid inputs uploads a cache', async () => {
     compression
   )
   expect(saveCacheMock).toHaveBeenCalledTimes(1)
-  expect(saveCacheMock).toHaveBeenCalledWith(cacheId, archiveFile, undefined)
+  expect(saveCacheMock).toHaveBeenCalledWith(
+    cacheId,
+    archiveFile,
+    '',
+    undefined
+  )
   expect(getCompressionMock).toHaveBeenCalledTimes(1)
 })
 
@@ -331,74 +339,3 @@ test('save with non existing path should not save cache', async () => {
     `Path Validation Error: Path(s) specified in the action for caching do(es) not exist, hence no cache is being saved.`
   )
 })
-
-test('throwaway test', async () => {
-  const filePath = 'node_modules'
-  const primaryKey = 'Linux-node-bb828da54c148048dd17899ba9fda624811cfb43'
-  const cachePaths = [path.resolve(filePath)]
-
-  const cacheSignedURL = 'https://container.blob.core.windows.net/cache/${primaryKey}?sig=1234'
-  const getCacheBlobUploadURL: GetCacheBlobUploadURLResponse = {
-    urls: [
-      {
-        key: primaryKey,
-        url: cacheSignedURL,
-      },
-    ]
-  }
-
-  const cacheId = 4
-  const reserveCacheMock = jest
-    .spyOn(cacheHttpClient, 'reserveCache')
-    .mockImplementation(async () => {
-      const response: TypedResponse<ReserveCacheResponse> = {
-        statusCode: 500,
-        result: {cacheId},
-        headers: {}
-      }
-      return response
-    })
-
-  const getCacheBlobUploadURLMock = jest
-  .spyOn(BlobCacheServiceClientJSON.prototype, 'GetCacheBlobUploadURL')
-  .mockResolvedValue(getCacheBlobUploadURL)
-
-  const uploadCacheMock = jest
-  .spyOn(uploadCache, 'UploadCacheFile')
-  .mockImplementation(async () => {
-    return {
-      status: 200    
-    }
-  })
-
-  const createTarMock = jest.spyOn(tar, 'createTar')
-
-  const saveCacheMock = jest.spyOn(cacheHttpClient, 'saveCache')
-  const compression = CompressionMethod.Zstd
-  const getCompressionMock = jest
-    .spyOn(cacheUtils, 'getCompressionMethod')
-    .mockReturnValue(Promise.resolve(compression))
-  
-  await uploadCache.UploadCacheFile(getCacheBlobUploadURL, cachePaths[0])
-  await saveCache([filePath], primaryKey)
-
-  expect(reserveCacheMock).toHaveBeenCalledTimes(1)
-  expect(reserveCacheMock).toHaveBeenCalledWith(primaryKey, [filePath], {
-    cacheSize: undefined,
-    compressionMethod: compression,
-    enableCrossOsArchive: false
-  })
-  expect (getCacheBlobUploadURLMock).toHaveBeenCalledTimes(1)
-  const archiveFolder = '/foo/bar'
-  const archiveFile = path.join(archiveFolder, CacheFilename.Zstd)
-  expect(createTarMock).toHaveBeenCalledTimes(1)
-  expect(createTarMock).toHaveBeenCalledWith(
-    archiveFolder,
-    cachePaths,
-    compression
-  )
-  expect(uploadCacheMock).toHaveBeenCalledTimes(2)
-  expect(saveCacheMock).toHaveBeenCalledTimes(1)
-  expect(saveCacheMock).toHaveBeenCalledWith(cacheId, archiveFile, undefined)
-  expect(getCompressionMock).toHaveBeenCalledTimes(1)
-})

packages/cache/__tests__/saveCacheV2.test.ts

@@ -0,0 +1,339 @@
+import * as core from '@actions/core'
+import * as path from 'path'
+import {saveCache} from '../src/cache'
+import * as cacheUtils from '../src/internal/cacheUtils'
+import {CacheFilename, CompressionMethod} from '../src/internal/constants'
+import * as config from '../src/internal/config'
+import * as tar from '../src/internal/tar'
+import {CacheServiceClientJSON} from '../src/generated/results/api/v1/cache.twirp'
+import * as cacheHttpClient from '../src/internal/cacheHttpClient'
+import {UploadOptions} from '../src/options'
+
+let logDebugMock: jest.SpyInstance
+
+jest.mock('../src/internal/tar')
+
+const uploadFileMock = jest.fn()
+const blockBlobClientMock = jest.fn().mockImplementation(() => ({
+  uploadFile: uploadFileMock
+}))
+jest.mock('@azure/storage-blob', () => ({
+  BlobClient: jest.fn().mockImplementation(() => {
+    return {
+      getBlockBlobClient: blockBlobClientMock
+    }
+  })
+}))
+
+beforeAll(() => {
+  process.env['ACTIONS_RUNTIME_TOKEN'] = 'token'
+  jest.spyOn(console, 'log').mockImplementation(() => {})
+  jest.spyOn(core, 'debug').mockImplementation(() => {})
+  jest.spyOn(core, 'info').mockImplementation(() => {})
+  jest.spyOn(core, 'warning').mockImplementation(() => {})
+  jest.spyOn(core, 'error').mockImplementation(() => {})
+  jest.spyOn(cacheUtils, 'resolvePaths').mockImplementation(async filePaths => {
+    return filePaths.map(x => path.resolve(x))
+  })
+  jest.spyOn(cacheUtils, 'createTempDirectory').mockImplementation(async () => {
+    return Promise.resolve('/foo/bar')
+  })
+
+  // Ensure that we're using v2 for these tests
+  jest.spyOn(config, 'getCacheServiceVersion').mockReturnValue('v2')
+
+  logDebugMock = jest.spyOn(core, 'debug')
+})
+
+afterEach(() => {
+  expect(logDebugMock).toHaveBeenCalledWith('Cache service version: v2')
+  jest.clearAllMocks()
+})
+
+test('save with missing input should fail', async () => {
+  const paths: string[] = []
+  const key = 'Linux-node-bb828da54c148048dd17899ba9fda624811cfb43'
+
+  await expect(saveCache(paths, key)).rejects.toThrowError(
+    `Path Validation Error: At least one directory or file path is required`
+  )
+})
+
+test('save with large cache outputs should fail using', async () => {
+  const paths = 'node_modules'
+  const key = 'Linux-node-bb828da54c148048dd17899ba9fda624811cfb43'
+  const cachePaths = [path.resolve(paths)]
+
+  const createTarMock = jest.spyOn(tar, 'createTar')
+  const logWarningMock = jest.spyOn(core, 'warning')
+
+  const cacheSize = 11 * 1024 * 1024 * 1024 //~11GB, over the 10GB limit
+  jest
+    .spyOn(cacheUtils, 'getArchiveFileSizeInBytes')
+    .mockReturnValueOnce(cacheSize)
+  const compression = CompressionMethod.Gzip
+  const getCompressionMock = jest
+    .spyOn(cacheUtils, 'getCompressionMethod')
+    .mockReturnValueOnce(Promise.resolve(compression))
+
+  const cacheId = await saveCache([paths], key)
+  expect(cacheId).toBe(-1)
+  expect(logWarningMock).toHaveBeenCalledWith(
+    'Failed to save: Cache size of ~11264 MB (11811160064 B) is over the 10GB limit, not saving cache.'
+  )
+
+  const archiveFolder = '/foo/bar'
+
+  expect(createTarMock).toHaveBeenCalledWith(
+    archiveFolder,
+    cachePaths,
+    compression
+  )
+  expect(getCompressionMock).toHaveBeenCalledTimes(1)
+})
+
+test('create cache entry failure', async () => {
+  const paths = ['node_modules']
+  const key = 'Linux-node-bb828da54c148048dd17899ba9fda624811cfb43'
+  const infoLogMock = jest.spyOn(core, 'info')
+
+  const createCacheEntryMock = jest
+    .spyOn(CacheServiceClientJSON.prototype, 'CreateCacheEntry')
+    .mockReturnValue(Promise.resolve({ok: false, signedUploadUrl: ''}))
+
+  const createTarMock = jest.spyOn(tar, 'createTar')
+  const finalizeCacheEntryMock = jest.spyOn(
+    CacheServiceClientJSON.prototype,
+    'FinalizeCacheEntryUpload'
+  )
+  const compression = CompressionMethod.Zstd
+  const getCompressionMock = jest
+    .spyOn(cacheUtils, 'getCompressionMethod')
+    .mockReturnValueOnce(Promise.resolve(compression))
+  const archiveFileSize = 1024
+  jest
+    .spyOn(cacheUtils, 'getArchiveFileSizeInBytes')
+    .mockReturnValueOnce(archiveFileSize)
+  const cacheVersion = cacheUtils.getCacheVersion(paths, compression)
+  const saveCacheMock = jest.spyOn(cacheHttpClient, 'saveCache')
+
+  const cacheId = await saveCache(paths, key)
+  expect(cacheId).toBe(-1)
+  expect(infoLogMock).toHaveBeenCalledWith(
+    `Failed to save: Unable to reserve cache with key ${key}, another job may be creating this cache.`
+  )
+
+  expect(createCacheEntryMock).toHaveBeenCalledWith({
+    key,
+    version: cacheVersion
+  })
+  expect(createTarMock).toHaveBeenCalledTimes(1)
+  expect(getCompressionMock).toHaveBeenCalledTimes(1)
+  expect(finalizeCacheEntryMock).toHaveBeenCalledTimes(0)
+  expect(saveCacheMock).toHaveBeenCalledTimes(0)
+})
+
+test('save cache fails if a signedUploadURL was not passed', async () => {
+  const paths = 'node_modules'
+  const key = 'Linux-node-bb828da54c148048dd17899ba9fda624811cfb43'
+  const cachePaths = [path.resolve(paths)]
+  const signedUploadURL = ''
+  const archiveFileSize = 1024
+  const options: UploadOptions = {
+    archiveSizeBytes: archiveFileSize, // These should always match
+    useAzureSdk: true,
+    uploadChunkSize: 64 * 1024 * 1024,
+    uploadConcurrency: 8
+  }
+
+  const createCacheEntryMock = jest
+    .spyOn(CacheServiceClientJSON.prototype, 'CreateCacheEntry')
+    .mockReturnValue(
+      Promise.resolve({ok: true, signedUploadUrl: signedUploadURL})
+    )
+
+  const createTarMock = jest.spyOn(tar, 'createTar')
+  const saveCacheMock = jest.spyOn(cacheHttpClient, 'saveCache')
+
+  const compression = CompressionMethod.Zstd
+  const getCompressionMock = jest
+    .spyOn(cacheUtils, 'getCompressionMethod')
+    .mockReturnValueOnce(Promise.resolve(compression))
+
+  const cacheVersion = cacheUtils.getCacheVersion([paths], compression)
+  jest
+    .spyOn(cacheUtils, 'getArchiveFileSizeInBytes')
+    .mockReturnValueOnce(archiveFileSize)
+
+  const cacheId = await saveCache([paths], key, options)
+
+  expect(cacheId).toBe(-1)
+  expect(createCacheEntryMock).toHaveBeenCalledWith({
+    key,
+    version: cacheVersion
+  })
+
+  const archiveFolder = '/foo/bar'
+  const archiveFile = path.join(archiveFolder, CacheFilename.Zstd)
+  expect(createTarMock).toHaveBeenCalledWith(
+    archiveFolder,
+    cachePaths,
+    compression
+  )
+
+  expect(saveCacheMock).toHaveBeenCalledWith(
+    -1,
+    archiveFile,
+    signedUploadURL,
+    options
+  )
+  expect(getCompressionMock).toHaveBeenCalledTimes(1)
+})
+
+test('finalize save cache failure', async () => {
+  const paths = 'node_modules'
+  const key = 'Linux-node-bb828da54c148048dd17899ba9fda624811cfb43'
+  const cachePaths = [path.resolve(paths)]
+  const logWarningMock = jest.spyOn(core, 'warning')
+  const signedUploadURL = 'https://blob-storage.local?signed=true'
+  const archiveFileSize = 1024
+  const options: UploadOptions = {
+    archiveSizeBytes: archiveFileSize, // These should always match
+    useAzureSdk: true,
+    uploadChunkSize: 64 * 1024 * 1024,
+    uploadConcurrency: 8
+  }
+
+  const createCacheEntryMock = jest
+    .spyOn(CacheServiceClientJSON.prototype, 'CreateCacheEntry')
+    .mockReturnValue(
+      Promise.resolve({ok: true, signedUploadUrl: signedUploadURL})
+    )
+
+  const createTarMock = jest.spyOn(tar, 'createTar')
+  const saveCacheMock = jest
+    .spyOn(cacheHttpClient, 'saveCache')
+    .mockResolvedValue(Promise.resolve())
+
+  const compression = CompressionMethod.Zstd
+  const getCompressionMock = jest
+    .spyOn(cacheUtils, 'getCompressionMethod')
+    .mockReturnValueOnce(Promise.resolve(compression))
+
+  const cacheVersion = cacheUtils.getCacheVersion([paths], compression)
+  jest
+    .spyOn(cacheUtils, 'getArchiveFileSizeInBytes')
+    .mockReturnValueOnce(archiveFileSize)
+
+  const finalizeCacheEntryMock = jest
+    .spyOn(CacheServiceClientJSON.prototype, 'FinalizeCacheEntryUpload')
+    .mockReturnValue(Promise.resolve({ok: false, entryId: ''}))
+
+  const cacheId = await saveCache([paths], key, options)
+
+  expect(createCacheEntryMock).toHaveBeenCalledWith({
+    key,
+    version: cacheVersion
+  })
+
+  const archiveFolder = '/foo/bar'
+  const archiveFile = path.join(archiveFolder, CacheFilename.Zstd)
+  expect(createTarMock).toHaveBeenCalledWith(
+    archiveFolder,
+    cachePaths,
+    compression
+  )
+
+  expect(saveCacheMock).toHaveBeenCalledWith(
+    -1,
+    archiveFile,
+    signedUploadURL,
+    options
+  )
+  expect(getCompressionMock).toHaveBeenCalledTimes(1)
+
+  expect(finalizeCacheEntryMock).toHaveBeenCalledWith({
+    key,
+    version: cacheVersion,
+    sizeBytes: archiveFileSize.toString()
+  })
+
+  expect(cacheId).toBe(-1)
+  expect(logWarningMock).toHaveBeenCalledWith(
+    `Failed to save: Unable to finalize cache with key ${key}, another job may be finalizing this cache.`
+  )
+})
+
+test('save with valid inputs uploads a cache', async () => {
+  const paths = 'node_modules'
+  const key = 'Linux-node-bb828da54c148048dd17899ba9fda624811cfb43'
+  const cachePaths = [path.resolve(paths)]
+  const signedUploadURL = 'https://blob-storage.local?signed=true'
+  const createTarMock = jest.spyOn(tar, 'createTar')
+  const archiveFileSize = 1024
+  const options: UploadOptions = {
+    archiveSizeBytes: archiveFileSize, // These should always match
+    useAzureSdk: true,
+    uploadChunkSize: 64 * 1024 * 1024,
+    uploadConcurrency: 8
+  }
+
+  jest
+    .spyOn(cacheUtils, 'getArchiveFileSizeInBytes')
+    .mockReturnValueOnce(archiveFileSize)
+
+  const cacheId = 4
+  jest
+    .spyOn(CacheServiceClientJSON.prototype, 'CreateCacheEntry')
+    .mockReturnValue(
+      Promise.resolve({ok: true, signedUploadUrl: signedUploadURL})
+    )
+
+  const saveCacheMock = jest.spyOn(cacheHttpClient, 'saveCache')
+
+  const compression = CompressionMethod.Zstd
+  const getCompressionMock = jest
+    .spyOn(cacheUtils, 'getCompressionMethod')
+    .mockReturnValue(Promise.resolve(compression))
+  const cacheVersion = cacheUtils.getCacheVersion([paths], compression)
+
+  const finalizeCacheEntryMock = jest
+    .spyOn(CacheServiceClientJSON.prototype, 'FinalizeCacheEntryUpload')
+    .mockReturnValue(Promise.resolve({ok: true, entryId: cacheId.toString()}))
+
+  const expectedCacheId = await saveCache([paths], key)
+
+  const archiveFolder = '/foo/bar'
+  const archiveFile = path.join(archiveFolder, CacheFilename.Zstd)
+  expect(saveCacheMock).toHaveBeenCalledWith(
+    -1,
+    archiveFile,
+    signedUploadURL,
+    options
+  )
+  expect(createTarMock).toHaveBeenCalledWith(
+    archiveFolder,
+    cachePaths,
+    compression
+  )
+
+  expect(finalizeCacheEntryMock).toHaveBeenCalledWith({
+    key,
+    version: cacheVersion,
+    sizeBytes: archiveFileSize.toString()
+  })
+
+  expect(getCompressionMock).toHaveBeenCalledTimes(1)
+  expect(expectedCacheId).toBe(cacheId)
+})
+
+test('save with non existing path should not save cache using v2 saveCache', async () => {
+  const path = 'node_modules'
+  const key = 'Linux-node-bb828da54c148048dd17899ba9fda624811cfb43'
+  jest.spyOn(cacheUtils, 'resolvePaths').mockImplementation(async () => {
+    return []
+  })
+  await expect(saveCache([path], key)).rejects.toThrowError(
+    `Path Validation Error: Path(s) specified in the action for caching do(es) not exist, hence no cache is being saved.`
+  )
+})

packages/cache/__tests__/uploadUtils.test.ts

@@ -0,0 +1,58 @@
+import * as uploadUtils from '../src/internal/uploadUtils'
+import {TransferProgressEvent} from '@azure/ms-rest-js'
+
+test('upload progress tracked correctly', () => {
+  const progress = new uploadUtils.UploadProgress(1000)
+
+  expect(progress.contentLength).toBe(1000)
+  expect(progress.sentBytes).toBe(0)
+  expect(progress.displayedComplete).toBe(false)
+  expect(progress.timeoutHandle).toBeUndefined()
+  expect(progress.getTransferredBytes()).toBe(0)
+  expect(progress.isDone()).toBe(false)
+
+  progress.onProgress()({loadedBytes: 0} as TransferProgressEvent)
+
+  expect(progress.contentLength).toBe(1000)
+  expect(progress.sentBytes).toBe(0)
+  expect(progress.displayedComplete).toBe(false)
+  expect(progress.timeoutHandle).toBeUndefined()
+  expect(progress.getTransferredBytes()).toBe(0)
+  expect(progress.isDone()).toBe(false)
+
+  progress.onProgress()({loadedBytes: 250} as TransferProgressEvent)
+
+  expect(progress.contentLength).toBe(1000)
+  expect(progress.sentBytes).toBe(250)
+  expect(progress.displayedComplete).toBe(false)
+  expect(progress.timeoutHandle).toBeUndefined()
+  expect(progress.getTransferredBytes()).toBe(250)
+  expect(progress.isDone()).toBe(false)
+
+  progress.onProgress()({loadedBytes: 500} as TransferProgressEvent)
+
+  expect(progress.contentLength).toBe(1000)
+  expect(progress.sentBytes).toBe(500)
+  expect(progress.displayedComplete).toBe(false)
+  expect(progress.timeoutHandle).toBeUndefined()
+  expect(progress.getTransferredBytes()).toBe(500)
+  expect(progress.isDone()).toBe(false)
+
+  progress.onProgress()({loadedBytes: 750} as TransferProgressEvent)
+
+  expect(progress.contentLength).toBe(1000)
+  expect(progress.sentBytes).toBe(750)
+  expect(progress.displayedComplete).toBe(false)
+  expect(progress.timeoutHandle).toBeUndefined()
+  expect(progress.getTransferredBytes()).toBe(750)
+  expect(progress.isDone()).toBe(false)
+
+  progress.onProgress()({loadedBytes: 1000} as TransferProgressEvent)
+
+  expect(progress.contentLength).toBe(1000)
+  expect(progress.sentBytes).toBe(1000)
+  expect(progress.displayedComplete).toBe(false)
+  expect(progress.timeoutHandle).toBeUndefined()
+  expect(progress.getTransferredBytes()).toBe(1000)
+  expect(progress.isDone()).toBe(true)
+})

packages/cache/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actions/cache",
-  "version": "3.2.4",
+  "version": "4.0.0",
   "preview": true,
   "description": "Actions cache lib",
   "keywords": [
@@ -37,8 +37,7 @@
     "url": "https://github.com/actions/toolkit/issues"
   },
   "dependencies": {
-    "@actions/core": "^1.10.0",
-    "@actions/artifact": "^2.1.7",
+    "@actions/core": "^1.11.1",
     "@actions/exec": "^1.0.1",
     "@actions/glob": "^0.1.0",
     "@actions/http-client": "^2.1.1",
@@ -46,12 +45,12 @@
     "@azure/abort-controller": "^1.1.0",
     "@azure/ms-rest-js": "^2.6.0",
     "@azure/storage-blob": "^12.13.0",
+    "@protobuf-ts/plugin": "^2.9.4",
     "semver": "^6.3.1",
-    "uuid": "^3.3.3"
+    "twirp-ts": "^2.5.0"
   },
   "devDependencies": {
     "@types/semver": "^6.0.0",
-    "@types/uuid": "^3.4.5",
     "typescript": "^5.2.2"
   }
-}
+}

packages/cache/src/cache.ts

@@ -1,26 +1,18 @@
 import * as core from '@actions/core'
 import * as path from 'path'
 import * as utils from './internal/cacheUtils'
-import {CacheServiceVersion, CacheUrl} from './internal/constants'
 import * as cacheHttpClient from './internal/cacheHttpClient'
-import * as cacheTwirpClient from './internal/cacheTwirpClient'
-import {createTar, extractTar, listTar} from './internal/tar'
+import * as cacheTwirpClient from './internal/shared/cacheTwirpClient'
+import {getCacheServiceVersion, isGhes} from './internal/config'
 import {DownloadOptions, UploadOptions} from './options'
+import {createTar, extractTar, listTar} from './internal/tar'
 import {
-  GetCacheBlobUploadURLRequest,
-  GetCacheBlobUploadURLResponse,
-  GetCachedBlobRequest,
-  GetCachedBlobResponse
-} from './generated/results/api/v1/blobcache'
-import {UploadCacheStream} from './internal/v2/upload-cache'
-import {StreamExtract} from './internal/v2/download-cache'
-import {
-  UploadZipSpecification,
-  getUploadZipSpecification
-} from '@actions/artifact/lib/internal/upload/upload-zip-specification'
-import {createZipUploadStream} from '@actions/artifact/lib/internal/upload/zip'
-import {getBackendIdsFromToken, BackendIds} from '@actions/artifact/lib/internal/shared/util'
-
+  CreateCacheEntryRequest,
+  FinalizeCacheEntryUploadRequest,
+  FinalizeCacheEntryUploadResponse,
+  GetCacheEntryDownloadURLRequest
+} from './generated/results/api/v1/cache'
+import {CacheFileSizeLimit} from './internal/constants'
 export class ValidationError extends Error {
   constructor(message: string) {
     super(message)
@@ -64,17 +56,16 @@ function checkKey(key: string): void {
  *
  * @returns boolean return true if Actions cache service feature is available, otherwise false
  */
-
 export function isFeatureAvailable(): boolean {
-  return !!CacheUrl
+  return !!process.env['ACTIONS_CACHE_URL']
 }
 
 /**
  * Restores cache from keys
  *
  * @param paths a list of file paths to restore from the cache
- * @param primaryKey an explicit key for restoring the cache
- * @param restoreKeys an optional ordered list of keys to use for restoring the cache if no cache hit occurred for key
+ * @param primaryKey an explicit key for restoring the cache. Lookup is done with prefix matching.
+ * @param restoreKeys an optional ordered list of keys to use for restoring the cache if no cache hit occurred for primaryKey
  * @param downloadOptions cache download options
  * @param enableCrossOsArchive an optional boolean enabled to restore on windows any cache created on any platform
  * @returns string returns the key for the cache hit, otherwise returns undefined
@@ -86,25 +77,49 @@ export async function restoreCache(
   options?: DownloadOptions,
   enableCrossOsArchive = false
 ): Promise<string | undefined> {
+  const cacheServiceVersion: string = getCacheServiceVersion()
+  core.debug(`Cache service version: ${cacheServiceVersion}`)
+
   checkPaths(paths)
 
-  console.debug(`Cache Service Version: ${CacheServiceVersion}`)
-  switch (CacheServiceVersion) {
-    case "v2":
-      return await restoreCachev2(paths, primaryKey, restoreKeys, options, enableCrossOsArchive)
-    case "v1":
+  switch (cacheServiceVersion) {
+    case 'v2':
+      return await restoreCacheV2(
+        paths,
+        primaryKey,
+        restoreKeys,
+        options,
+        enableCrossOsArchive
+      )
+    case 'v1':
     default:
-      return await restoreCachev1(paths, primaryKey, restoreKeys, options, enableCrossOsArchive)
+      return await restoreCacheV1(
+        paths,
+        primaryKey,
+        restoreKeys,
+        options,
+        enableCrossOsArchive
+      )
   }
 }
 
-async function restoreCachev1(
+/**
+ * Restores cache using the legacy Cache Service
+ *
+ * @param paths a list of file paths to restore from the cache
+ * @param primaryKey an explicit key for restoring the cache. Lookup is done with prefix matching.
+ * @param restoreKeys an optional ordered list of keys to use for restoring the cache if no cache hit occurred for primaryKey
+ * @param options cache download options
+ * @param enableCrossOsArchive an optional boolean enabled to restore on Windows any cache created on any platform
+ * @returns string returns the key for the cache hit, otherwise returns undefined
+ */
+async function restoreCacheV1(
   paths: string[],
   primaryKey: string,
   restoreKeys?: string[],
   options?: DownloadOptions,
   enableCrossOsArchive = false
-) {
+): Promise<string | undefined> {
   restoreKeys = restoreKeys || []
   const keys = [primaryKey, ...restoreKeys]
 
@@ -186,14 +201,28 @@ async function restoreCachev1(
   return undefined
 }
 
-async function restoreCachev2(
+/**
+ * Restores cache using Cache Service v2
+ *
+ * @param paths a list of file paths to restore from the cache
+ * @param primaryKey an explicit key for restoring the cache. Lookup is done with prefix matching
+ * @param restoreKeys an optional ordered list of keys to use for restoring the cache if no cache hit occurred for primaryKey
+ * @param downloadOptions cache download options
+ * @param enableCrossOsArchive an optional boolean enabled to restore on windows any cache created on any platform
+ * @returns string returns the key for the cache hit, otherwise returns undefined
+ */
+async function restoreCacheV2(
   paths: string[],
   primaryKey: string,
   restoreKeys?: string[],
   options?: DownloadOptions,
   enableCrossOsArchive = false
-) {
-  
+): Promise<string | undefined> {
+  // Override UploadOptions to force the use of Azure
+  options = {
+    ...options,
+    useAzureSdk: true
+  }
   restoreKeys = restoreKeys || []
   const keys = [primaryKey, ...restoreKeys]
 
@@ -209,33 +238,82 @@ async function restoreCachev2(
     checkKey(key)
   }
 
+  let archivePath = ''
   try {
-    // BackendIds are retrieved form the signed JWT
-    const backendIds: BackendIds = getBackendIdsFromToken()
-    const twirpClient = cacheTwirpClient.internalBlobCacheTwirpClient()
-    const getSignedDownloadURLRequest: GetCachedBlobRequest = {
-      workflowRunBackendId: backendIds.workflowRunBackendId,
-      workflowJobRunBackendId: backendIds.workflowJobRunBackendId,
-      keys: keys,
-    }
-    const signedDownloadURL: GetCachedBlobResponse = await twirpClient.GetCachedBlob(getSignedDownloadURLRequest)
-    core.info(`GetCachedBlobResponse: ${JSON.stringify(signedDownloadURL)}`)
+    const twirpClient = cacheTwirpClient.internalCacheTwirpClient()
+    const compressionMethod = await utils.getCompressionMethod()
 
-    if (signedDownloadURL.blobs.length === 0) {
-      // Cache not found
+    const request: GetCacheEntryDownloadURLRequest = {
+      key: primaryKey,
+      restoreKeys,
+      version: utils.getCacheVersion(
+        paths,
+        compressionMethod,
+        enableCrossOsArchive
+      )
+    }
+
+    const response = await twirpClient.GetCacheEntryDownloadURL(request)
+
+    if (!response.ok) {
       core.warning(`Cache not found for keys: ${keys.join(', ')}`)
       return undefined
     }
 
-    core.info(`Cache hit for: ${signedDownloadURL.blobs[0].key}`)
-    core.info(`Starting download of artifact to: ${paths[0]}`)
-    await StreamExtract(signedDownloadURL.blobs[0].signedUrl, path.dirname(paths[0]))
-    core.info(`Artifact download completed successfully.`)
+    core.info(`Cache hit for: ${request.key}`)
 
-    return keys[0]
+    if (options?.lookupOnly) {
+      core.info('Lookup only - skipping download')
+      return response.matchedKey
+    }
+
+    archivePath = path.join(
+      await utils.createTempDirectory(),
+      utils.getCacheFileName(compressionMethod)
+    )
+    core.debug(`Archive path: ${archivePath}`)
+    core.debug(`Starting download of archive to: ${archivePath}`)
+
+    await cacheHttpClient.downloadCache(
+      response.signedDownloadUrl,
+      archivePath,
+      options
+    )
+
+    const archiveFileSize = utils.getArchiveFileSizeInBytes(archivePath)
+    core.info(
+      `Cache Size: ~${Math.round(
+        archiveFileSize / (1024 * 1024)
+      )} MB (${archiveFileSize} B)`
+    )
+
+    if (core.isDebug()) {
+      await listTar(archivePath, compressionMethod)
+    }
+
+    await extractTar(archivePath, compressionMethod)
+    core.info('Cache restored successfully')
+
+    return response.matchedKey
   } catch (error) {
-    throw new Error(`Unable to download and extract cache: ${error.message}`)
+    const typedError = error as Error
+    if (typedError.name === ValidationError.name) {
+      throw error
+    } else {
+      // Supress all non-validation cache related errors because caching should be optional
+      core.warning(`Failed to restore: ${(error as Error).message}`)
+    }
+  } finally {
+    try {
+      if (archivePath) {
+        await utils.unlinkFile(archivePath)
+      }
+    } catch (error) {
+      core.debug(`Failed to delete archive: ${error}`)
+    }
   }
+
+  return undefined
 }
 
 /**
@@ -253,20 +331,29 @@ export async function saveCache(
   options?: UploadOptions,
   enableCrossOsArchive = false
 ): Promise<number> {
+  const cacheServiceVersion: string = getCacheServiceVersion()
+  core.debug(`Cache service version: ${cacheServiceVersion}`)
   checkPaths(paths)
   checkKey(key)
-  
-  console.debug(`Cache Service Version: ${CacheServiceVersion}`)
-  switch (CacheServiceVersion) {
-    case "v2":
-      return await saveCachev2(paths, key, options, enableCrossOsArchive)
-    case "v1":
+  switch (cacheServiceVersion) {
+    case 'v2':
+      return await saveCacheV2(paths, key, options, enableCrossOsArchive)
+    case 'v1':
     default:
-      return await saveCachev1(paths, key, options, enableCrossOsArchive)
+      return await saveCacheV1(paths, key, options, enableCrossOsArchive)
   }
 }
 
-async function saveCachev1(
+/**
+ * Save cache using the legacy Cache Service
+ *
+ * @param paths
+ * @param key
+ * @param options
+ * @param enableCrossOsArchive
+ * @returns
+ */
+async function saveCacheV1(
   paths: string[],
   key: string,
   options?: UploadOptions,
@@ -303,7 +390,7 @@ async function saveCachev1(
     core.debug(`File Size: ${archiveFileSize}`)
 
     // For GHES, this check will take place in ReserveCache API with enterprise file size limit
-    if (archiveFileSize > fileSizeLimit && !utils.isGhes()) {
+    if (archiveFileSize > fileSizeLimit && !isGhes()) {
       throw new Error(
         `Cache size of ~${Math.round(
           archiveFileSize / (1024 * 1024)
@@ -338,7 +425,7 @@ async function saveCachev1(
     }
 
     core.debug(`Saving Cache (ID: ${cacheId})`)
-    await cacheHttpClient.saveCache(cacheId, archivePath, options)
+    await cacheHttpClient.saveCache(cacheId, archivePath, '', options)
   } catch (error) {
     const typedError = error as Error
     if (typedError.name === ValidationError.name) {
@@ -360,50 +447,133 @@ async function saveCachev1(
   return cacheId
 }
 
-async function saveCachev2(
+/**
+ * Save cache using Cache Service v2
+ *
+ * @param paths a list of file paths to restore from the cache
+ * @param key an explicit key for restoring the cache
+ * @param options cache upload options
+ * @param enableCrossOsArchive an optional boolean enabled to save cache on windows which could be restored on any platform
+ * @returns
+ */
+async function saveCacheV2(
   paths: string[],
   key: string,
   options?: UploadOptions,
   enableCrossOsArchive = false
 ): Promise<number> {
-  // BackendIds are retrieved form the signed JWT
-  const backendIds: BackendIds = getBackendIdsFromToken()
-  const twirpClient = cacheTwirpClient.internalBlobCacheTwirpClient()
-  const getSignedUploadURL: GetCacheBlobUploadURLRequest = {
-    workflowRunBackendId: backendIds.workflowRunBackendId,
-    workflowJobRunBackendId: backendIds.workflowJobRunBackendId,
-    organization: "github",
-    keys: [key],
+  // Override UploadOptions to force the use of Azure
+  // ...options goes first because we want to override the default values
+  // set in UploadOptions with these specific figures
+  options = {
+    ...options,
+    uploadChunkSize: 64 * 1024 * 1024, // 64 MiB
+    uploadConcurrency: 8, // 8 workers for parallel upload
+    useAzureSdk: true
   }
-  const signedUploadURL: GetCacheBlobUploadURLResponse = await twirpClient.GetCacheBlobUploadURL(getSignedUploadURL)
-  core.info(`GetCacheBlobUploadURLResponse: ${JSON.stringify(signedUploadURL)}`)
+  const compressionMethod = await utils.getCompressionMethod()
+  const twirpClient = cacheTwirpClient.internalCacheTwirpClient()
+  let cacheId = -1
 
-  // Archive
-  // We're going to handle 1 path fow now. This needs to be fixed to handle all 
-  // paths passed in.
-  const rootDir = path.dirname(paths[0])
-  const zipSpecs: UploadZipSpecification[] = getUploadZipSpecification(paths, rootDir)
-  if (zipSpecs.length === 0) {
+  const cachePaths = await utils.resolvePaths(paths)
+  core.debug('Cache Paths:')
+  core.debug(`${JSON.stringify(cachePaths)}`)
+
+  if (cachePaths.length === 0) {
     throw new Error(
-      `Error with zip specs: ${zipSpecs.flatMap(s => (s.sourcePath ? [s.sourcePath] : [])).join(', ')}`
+      `Path Validation Error: Path(s) specified in the action for caching do(es) not exist, hence no cache is being saved.`
     )
   }
 
-  // 0: No compression
-  // 1: Best speed
-  // 6: Default compression (same as GNU Gzip)
-  // 9: Best compression Higher levels will result in better compression, but will take longer to complete. For large files that are not easily compressed, a value of 0 is recommended for significantly faster uploads.
-  const zipUploadStream = await createZipUploadStream(
-    zipSpecs,
-    6
+  const archiveFolder = await utils.createTempDirectory()
+  const archivePath = path.join(
+    archiveFolder,
+    utils.getCacheFileName(compressionMethod)
   )
 
-  // Cache v2 upload
-  // inputs:
-  // - getSignedUploadURL
-  // - archivePath
-  core.info(`Saving Cache v2: ${paths[0]}`)
-  await UploadCacheStream(signedUploadURL.urls[0].url, zipUploadStream)
+  core.debug(`Archive Path: ${archivePath}`)
 
-  return 0
-}
+  try {
+    await createTar(archiveFolder, cachePaths, compressionMethod)
+    if (core.isDebug()) {
+      await listTar(archivePath, compressionMethod)
+    }
+
+    const archiveFileSize = utils.getArchiveFileSizeInBytes(archivePath)
+    core.debug(`File Size: ${archiveFileSize}`)
+
+    // For GHES, this check will take place in ReserveCache API with enterprise file size limit
+    if (archiveFileSize > CacheFileSizeLimit && !isGhes()) {
+      throw new Error(
+        `Cache size of ~${Math.round(
+          archiveFileSize / (1024 * 1024)
+        )} MB (${archiveFileSize} B) is over the 10GB limit, not saving cache.`
+      )
+    }
+
+    // Set the archive size in the options, will be used to display the upload progress
+    options.archiveSizeBytes = archiveFileSize
+
+    core.debug('Reserving Cache')
+    const version = utils.getCacheVersion(
+      paths,
+      compressionMethod,
+      enableCrossOsArchive
+    )
+    const request: CreateCacheEntryRequest = {
+      key,
+      version
+    }
+
+    const response = await twirpClient.CreateCacheEntry(request)
+    if (!response.ok) {
+      throw new ReserveCacheError(
+        `Unable to reserve cache with key ${key}, another job may be creating this cache.`
+      )
+    }
+
+    core.debug(`Attempting to upload cache located at: ${archivePath}`)
+    await cacheHttpClient.saveCache(
+      cacheId,
+      archivePath,
+      response.signedUploadUrl,
+      options
+    )
+
+    const finalizeRequest: FinalizeCacheEntryUploadRequest = {
+      key,
+      version,
+      sizeBytes: `${archiveFileSize}`
+    }
+
+    const finalizeResponse: FinalizeCacheEntryUploadResponse =
+      await twirpClient.FinalizeCacheEntryUpload(finalizeRequest)
+    core.debug(`FinalizeCacheEntryUploadResponse: ${finalizeResponse.ok}`)
+
+    if (!finalizeResponse.ok) {
+      throw new Error(
+        `Unable to finalize cache with key ${key}, another job may be finalizing this cache.`
+      )
+    }
+
+    cacheId = parseInt(finalizeResponse.entryId)
+  } catch (error) {
+    const typedError = error as Error
+    if (typedError.name === ValidationError.name) {
+      throw error
+    } else if (typedError.name === ReserveCacheError.name) {
+      core.info(`Failed to save: ${typedError.message}`)
+    } else {
+      core.warning(`Failed to save: ${typedError.message}`)
+    }
+  } finally {
+    // Try to delete the archive to save space
+    try {
+      await utils.unlinkFile(archivePath)
+    } catch (error) {
+      core.debug(`Failed to delete archive: ${error}`)
+    }
+  }
+
+  return cacheId
+}

packages/cache/src/generated/results/api/v1/blobcache.ts

@@ -1,513 +0,0 @@
-// @generated by protobuf-ts 2.9.1 with parameter long_type_string,client_none,generate_dependencies
-// @generated from protobuf file "results/api/v1/blobcache.proto" (package "github.actions.results.api.v1", syntax proto3)
-// tslint:disable
-import { ServiceType } from "@protobuf-ts/runtime-rpc";
-import type { BinaryWriteOptions } from "@protobuf-ts/runtime";
-import type { IBinaryWriter } from "@protobuf-ts/runtime";
-import { WireType } from "@protobuf-ts/runtime";
-import type { BinaryReadOptions } from "@protobuf-ts/runtime";
-import type { IBinaryReader } from "@protobuf-ts/runtime";
-import { UnknownFieldHandler } from "@protobuf-ts/runtime";
-import type { PartialMessage } from "@protobuf-ts/runtime";
-import { reflectionMergePartial } from "@protobuf-ts/runtime";
-import { MESSAGE_TYPE } from "@protobuf-ts/runtime";
-import { MessageType } from "@protobuf-ts/runtime";
-import { Timestamp } from "../../../google/protobuf/timestamp";
-/**
- * @generated from protobuf message github.actions.results.api.v1.GetCachedBlobRequest
- */
-export interface GetCachedBlobRequest {
-    /**
-     * Workflow run backend ID
-     *
-     * @generated from protobuf field: string workflow_run_backend_id = 1;
-     */
-    workflowRunBackendId: string;
-    /**
-     * Workflow job run backend ID
-     *
-     * @generated from protobuf field: string workflow_job_run_backend_id = 2;
-     */
-    workflowJobRunBackendId: string;
-    /**
-     * Key(s) of te blob(s) to be retrieved
-     *
-     * @generated from protobuf field: repeated string keys = 3;
-     */
-    keys: string[];
-}
-/**
- * @generated from protobuf message github.actions.results.api.v1.GetCachedBlobResponse
- */
-export interface GetCachedBlobResponse {
-    /**
-     * List of blobs that match the requested keys
-     *
-     * @generated from protobuf field: repeated github.actions.results.api.v1.GetCachedBlobResponse.Blob blobs = 1;
-     */
-    blobs: GetCachedBlobResponse_Blob[];
-}
-/**
- * @generated from protobuf message github.actions.results.api.v1.GetCachedBlobResponse.Blob
- */
-export interface GetCachedBlobResponse_Blob {
-    /**
-     * Key of the blob
-     *
-     * @generated from protobuf field: string key = 1;
-     */
-    key: string;
-    /**
-     * Download url for the cached blob
-     *
-     * @generated from protobuf field: string signed_url = 2;
-     */
-    signedUrl: string;
-    /**
-     * Version of the cached blob entry
-     *
-     * @generated from protobuf field: int32 version = 3;
-     */
-    version: number;
-    /**
-     * Checksum of the blob
-     *
-     * @generated from protobuf field: string checksum = 4;
-     */
-    checksum: string;
-    /**
-     * Timestamp for when the blob cache entry expires
-     *
-     * @generated from protobuf field: google.protobuf.Timestamp expires_at = 5;
-     */
-    expiresAt?: Timestamp;
-    /**
-     * Timestamp for when the blob cache entry was created
-     *
-     * @generated from protobuf field: google.protobuf.Timestamp created_at = 6;
-     */
-    createdAt?: Timestamp;
-}
-/**
- * @generated from protobuf message github.actions.results.api.v1.GetCacheBlobUploadURLRequest
- */
-export interface GetCacheBlobUploadURLRequest {
-    /**
-     * Workflow run backend ID
-     *
-     * @generated from protobuf field: string workflow_run_backend_id = 1;
-     */
-    workflowRunBackendId: string;
-    /**
-     * Workflow job run backend ID
-     *
-     * @generated from protobuf field: string workflow_job_run_backend_id = 2;
-     */
-    workflowJobRunBackendId: string;
-    /**
-     * / Owner of the blob(s) to be retrieved
-     *
-     * @generated from protobuf field: string organization = 3;
-     */
-    organization: string;
-    /**
-     * Key(s) of te blob(s) to be retrieved
-     *
-     * @generated from protobuf field: repeated string keys = 4;
-     */
-    keys: string[];
-}
-/**
- * @generated from protobuf message github.actions.results.api.v1.GetCacheBlobUploadURLResponse
- */
-export interface GetCacheBlobUploadURLResponse {
-    /**
-     * List of upload URLs that match the requested keys
-     *
-     * @generated from protobuf field: repeated github.actions.results.api.v1.GetCacheBlobUploadURLResponse.Url urls = 1;
-     */
-    urls: GetCacheBlobUploadURLResponse_Url[];
-}
-/**
- * @generated from protobuf message github.actions.results.api.v1.GetCacheBlobUploadURLResponse.Url
- */
-export interface GetCacheBlobUploadURLResponse_Url {
-    /**
-     * Key of the blob
-     *
-     * @generated from protobuf field: string key = 1;
-     */
-    key: string;
-    /**
-     * URL to the blob
-     *
-     * @generated from protobuf field: string url = 2;
-     */
-    url: string;
-}
-// @generated message type with reflection information, may provide speed optimized methods
-class GetCachedBlobRequest$Type extends MessageType<GetCachedBlobRequest> {
-    constructor() {
-        super("github.actions.results.api.v1.GetCachedBlobRequest", [
-            { no: 1, name: "workflow_run_backend_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "workflow_job_run_backend_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 3, name: "keys", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<GetCachedBlobRequest>): GetCachedBlobRequest {
-        const message = { workflowRunBackendId: "", workflowJobRunBackendId: "", keys: [] };
-        globalThis.Object.defineProperty(message, MESSAGE_TYPE, { enumerable: false, value: this });
-        if (value !== undefined)
-            reflectionMergePartial<GetCachedBlobRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetCachedBlobRequest): GetCachedBlobRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string workflow_run_backend_id */ 1:
-                    message.workflowRunBackendId = reader.string();
-                    break;
-                case /* string workflow_job_run_backend_id */ 2:
-                    message.workflowJobRunBackendId = reader.string();
-                    break;
-                case /* repeated string keys */ 3:
-                    message.keys.push(reader.string());
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: GetCachedBlobRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string workflow_run_backend_id = 1; */
-        if (message.workflowRunBackendId !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.workflowRunBackendId);
-        /* string workflow_job_run_backend_id = 2; */
-        if (message.workflowJobRunBackendId !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.workflowJobRunBackendId);
-        /* repeated string keys = 3; */
-        for (let i = 0; i < message.keys.length; i++)
-            writer.tag(3, WireType.LengthDelimited).string(message.keys[i]);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message github.actions.results.api.v1.GetCachedBlobRequest
- */
-export const GetCachedBlobRequest = new GetCachedBlobRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class GetCachedBlobResponse$Type extends MessageType<GetCachedBlobResponse> {
-    constructor() {
-        super("github.actions.results.api.v1.GetCachedBlobResponse", [
-            { no: 1, name: "blobs", kind: "message", repeat: 1 /*RepeatType.PACKED*/, T: () => GetCachedBlobResponse_Blob }
-        ]);
-    }
-    create(value?: PartialMessage<GetCachedBlobResponse>): GetCachedBlobResponse {
-        const message = { blobs: [] };
-        globalThis.Object.defineProperty(message, MESSAGE_TYPE, { enumerable: false, value: this });
-        if (value !== undefined)
-            reflectionMergePartial<GetCachedBlobResponse>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetCachedBlobResponse): GetCachedBlobResponse {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* repeated github.actions.results.api.v1.GetCachedBlobResponse.Blob blobs */ 1:
-                    message.blobs.push(GetCachedBlobResponse_Blob.internalBinaryRead(reader, reader.uint32(), options));
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: GetCachedBlobResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* repeated github.actions.results.api.v1.GetCachedBlobResponse.Blob blobs = 1; */
-        for (let i = 0; i < message.blobs.length; i++)
-            GetCachedBlobResponse_Blob.internalBinaryWrite(message.blobs[i], writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message github.actions.results.api.v1.GetCachedBlobResponse
- */
-export const GetCachedBlobResponse = new GetCachedBlobResponse$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class GetCachedBlobResponse_Blob$Type extends MessageType<GetCachedBlobResponse_Blob> {
-    constructor() {
-        super("github.actions.results.api.v1.GetCachedBlobResponse.Blob", [
-            { no: 1, name: "key", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "signed_url", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 3, name: "version", kind: "scalar", T: 5 /*ScalarType.INT32*/ },
-            { no: 4, name: "checksum", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 5, name: "expires_at", kind: "message", T: () => Timestamp },
-            { no: 6, name: "created_at", kind: "message", T: () => Timestamp }
-        ]);
-    }
-    create(value?: PartialMessage<GetCachedBlobResponse_Blob>): GetCachedBlobResponse_Blob {
-        const message = { key: "", signedUrl: "", version: 0, checksum: "" };
-        globalThis.Object.defineProperty(message, MESSAGE_TYPE, { enumerable: false, value: this });
-        if (value !== undefined)
-            reflectionMergePartial<GetCachedBlobResponse_Blob>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetCachedBlobResponse_Blob): GetCachedBlobResponse_Blob {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string key */ 1:
-                    message.key = reader.string();
-                    break;
-                case /* string signed_url */ 2:
-                    message.signedUrl = reader.string();
-                    break;
-                case /* int32 version */ 3:
-                    message.version = reader.int32();
-                    break;
-                case /* string checksum */ 4:
-                    message.checksum = reader.string();
-                    break;
-                case /* google.protobuf.Timestamp expires_at */ 5:
-                    message.expiresAt = Timestamp.internalBinaryRead(reader, reader.uint32(), options, message.expiresAt);
-                    break;
-                case /* google.protobuf.Timestamp created_at */ 6:
-                    message.createdAt = Timestamp.internalBinaryRead(reader, reader.uint32(), options, message.createdAt);
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: GetCachedBlobResponse_Blob, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string key = 1; */
-        if (message.key !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.key);
-        /* string signed_url = 2; */
-        if (message.signedUrl !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.signedUrl);
-        /* int32 version = 3; */
-        if (message.version !== 0)
-            writer.tag(3, WireType.Varint).int32(message.version);
-        /* string checksum = 4; */
-        if (message.checksum !== "")
-            writer.tag(4, WireType.LengthDelimited).string(message.checksum);
-        /* google.protobuf.Timestamp expires_at = 5; */
-        if (message.expiresAt)
-            Timestamp.internalBinaryWrite(message.expiresAt, writer.tag(5, WireType.LengthDelimited).fork(), options).join();
-        /* google.protobuf.Timestamp created_at = 6; */
-        if (message.createdAt)
-            Timestamp.internalBinaryWrite(message.createdAt, writer.tag(6, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message github.actions.results.api.v1.GetCachedBlobResponse.Blob
- */
-export const GetCachedBlobResponse_Blob = new GetCachedBlobResponse_Blob$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class GetCacheBlobUploadURLRequest$Type extends MessageType<GetCacheBlobUploadURLRequest> {
-    constructor() {
-        super("github.actions.results.api.v1.GetCacheBlobUploadURLRequest", [
-            { no: 1, name: "workflow_run_backend_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "workflow_job_run_backend_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 3, name: "organization", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 4, name: "keys", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<GetCacheBlobUploadURLRequest>): GetCacheBlobUploadURLRequest {
-        const message = { workflowRunBackendId: "", workflowJobRunBackendId: "", organization: "", keys: [] };
-        globalThis.Object.defineProperty(message, MESSAGE_TYPE, { enumerable: false, value: this });
-        if (value !== undefined)
-            reflectionMergePartial<GetCacheBlobUploadURLRequest>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetCacheBlobUploadURLRequest): GetCacheBlobUploadURLRequest {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string workflow_run_backend_id */ 1:
-                    message.workflowRunBackendId = reader.string();
-                    break;
-                case /* string workflow_job_run_backend_id */ 2:
-                    message.workflowJobRunBackendId = reader.string();
-                    break;
-                case /* string organization */ 3:
-                    message.organization = reader.string();
-                    break;
-                case /* repeated string keys */ 4:
-                    message.keys.push(reader.string());
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: GetCacheBlobUploadURLRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string workflow_run_backend_id = 1; */
-        if (message.workflowRunBackendId !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.workflowRunBackendId);
-        /* string workflow_job_run_backend_id = 2; */
-        if (message.workflowJobRunBackendId !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.workflowJobRunBackendId);
-        /* string organization = 3; */
-        if (message.organization !== "")
-            writer.tag(3, WireType.LengthDelimited).string(message.organization);
-        /* repeated string keys = 4; */
-        for (let i = 0; i < message.keys.length; i++)
-            writer.tag(4, WireType.LengthDelimited).string(message.keys[i]);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message github.actions.results.api.v1.GetCacheBlobUploadURLRequest
- */
-export const GetCacheBlobUploadURLRequest = new GetCacheBlobUploadURLRequest$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class GetCacheBlobUploadURLResponse$Type extends MessageType<GetCacheBlobUploadURLResponse> {
-    constructor() {
-        super("github.actions.results.api.v1.GetCacheBlobUploadURLResponse", [
-            { no: 1, name: "urls", kind: "message", repeat: 1 /*RepeatType.PACKED*/, T: () => GetCacheBlobUploadURLResponse_Url }
-        ]);
-    }
-    create(value?: PartialMessage<GetCacheBlobUploadURLResponse>): GetCacheBlobUploadURLResponse {
-        const message = { urls: [] };
-        globalThis.Object.defineProperty(message, MESSAGE_TYPE, { enumerable: false, value: this });
-        if (value !== undefined)
-            reflectionMergePartial<GetCacheBlobUploadURLResponse>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetCacheBlobUploadURLResponse): GetCacheBlobUploadURLResponse {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* repeated github.actions.results.api.v1.GetCacheBlobUploadURLResponse.Url urls */ 1:
-                    message.urls.push(GetCacheBlobUploadURLResponse_Url.internalBinaryRead(reader, reader.uint32(), options));
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: GetCacheBlobUploadURLResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* repeated github.actions.results.api.v1.GetCacheBlobUploadURLResponse.Url urls = 1; */
-        for (let i = 0; i < message.urls.length; i++)
-            GetCacheBlobUploadURLResponse_Url.internalBinaryWrite(message.urls[i], writer.tag(1, WireType.LengthDelimited).fork(), options).join();
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message github.actions.results.api.v1.GetCacheBlobUploadURLResponse
- */
-export const GetCacheBlobUploadURLResponse = new GetCacheBlobUploadURLResponse$Type();
-// @generated message type with reflection information, may provide speed optimized methods
-class GetCacheBlobUploadURLResponse_Url$Type extends MessageType<GetCacheBlobUploadURLResponse_Url> {
-    constructor() {
-        super("github.actions.results.api.v1.GetCacheBlobUploadURLResponse.Url", [
-            { no: 1, name: "key", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
-            { no: 2, name: "url", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
-        ]);
-    }
-    create(value?: PartialMessage<GetCacheBlobUploadURLResponse_Url>): GetCacheBlobUploadURLResponse_Url {
-        const message = { key: "", url: "" };
-        globalThis.Object.defineProperty(message, MESSAGE_TYPE, { enumerable: false, value: this });
-        if (value !== undefined)
-            reflectionMergePartial<GetCacheBlobUploadURLResponse_Url>(this, message, value);
-        return message;
-    }
-    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetCacheBlobUploadURLResponse_Url): GetCacheBlobUploadURLResponse_Url {
-        let message = target ?? this.create(), end = reader.pos + length;
-        while (reader.pos < end) {
-            let [fieldNo, wireType] = reader.tag();
-            switch (fieldNo) {
-                case /* string key */ 1:
-                    message.key = reader.string();
-                    break;
-                case /* string url */ 2:
-                    message.url = reader.string();
-                    break;
-                default:
-                    let u = options.readUnknownField;
-                    if (u === "throw")
-                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
-                    let d = reader.skip(wireType);
-                    if (u !== false)
-                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
-            }
-        }
-        return message;
-    }
-    internalBinaryWrite(message: GetCacheBlobUploadURLResponse_Url, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
-        /* string key = 1; */
-        if (message.key !== "")
-            writer.tag(1, WireType.LengthDelimited).string(message.key);
-        /* string url = 2; */
-        if (message.url !== "")
-            writer.tag(2, WireType.LengthDelimited).string(message.url);
-        let u = options.writeUnknownFields;
-        if (u !== false)
-            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
-        return writer;
-    }
-}
-/**
- * @generated MessageType for protobuf message github.actions.results.api.v1.GetCacheBlobUploadURLResponse.Url
- */
-export const GetCacheBlobUploadURLResponse_Url = new GetCacheBlobUploadURLResponse_Url$Type();
-/**
- * @generated ServiceType for protobuf service github.actions.results.api.v1.BlobCacheService
- */
-export const BlobCacheService = new ServiceType("github.actions.results.api.v1.BlobCacheService", [
-    { name: "GetCachedBlob", options: {}, I: GetCachedBlobRequest, O: GetCachedBlobResponse },
-    { name: "GetCacheBlobUploadURL", options: {}, I: GetCacheBlobUploadURLRequest, O: GetCacheBlobUploadURLResponse }
-]);

packages/cache/src/generated/results/api/v1/blobcache.twirp.ts

@@ -1,433 +0,0 @@
-import {
-  TwirpContext,
-  TwirpServer,
-  RouterEvents,
-  TwirpError,
-  TwirpErrorCode,
-  Interceptor,
-  TwirpContentType,
-  chainInterceptors,
-} from "twirp-ts";
-import {
-  GetCachedBlobRequest,
-  GetCachedBlobResponse,
-  GetCacheBlobUploadURLRequest,
-  GetCacheBlobUploadURLResponse,
-} from "./blobcache";
-
-//==================================//
-//          Client Code             //
-//==================================//
-
-interface Rpc {
-  request(
-    service: string,
-    method: string,
-    contentType: "application/json" | "application/protobuf",
-    data: object | Uint8Array
-  ): Promise<object | Uint8Array>;
-}
-
-export interface BlobCacheServiceClient {
-  GetCachedBlob(request: GetCachedBlobRequest): Promise<GetCachedBlobResponse>;
-  GetCacheBlobUploadURL(
-    request: GetCacheBlobUploadURLRequest
-  ): Promise<GetCacheBlobUploadURLResponse>;
-}
-
-export class BlobCacheServiceClientJSON implements BlobCacheServiceClient {
-  private readonly rpc: Rpc;
-  constructor(rpc: Rpc) {
-    this.rpc = rpc;
-    this.GetCachedBlob.bind(this);
-    this.GetCacheBlobUploadURL.bind(this);
-  }
-  GetCachedBlob(request: GetCachedBlobRequest): Promise<GetCachedBlobResponse> {
-    const data = GetCachedBlobRequest.toJson(request, {
-      useProtoFieldName: true,
-      emitDefaultValues: false,
-    });
-    const promise = this.rpc.request(
-      "github.actions.results.api.v1.BlobCacheService",
-      "GetCachedBlob",
-      "application/json",
-      data as object
-    );
-    return promise.then((data) =>
-      GetCachedBlobResponse.fromJson(data as any, { ignoreUnknownFields: true })
-    );
-  }
-
-  GetCacheBlobUploadURL(
-    request: GetCacheBlobUploadURLRequest
-  ): Promise<GetCacheBlobUploadURLResponse> {
-    const data = GetCacheBlobUploadURLRequest.toJson(request, {
-      useProtoFieldName: true,
-      emitDefaultValues: false,
-    });
-    const promise = this.rpc.request(
-      "github.actions.results.api.v1.BlobCacheService",
-      "GetCacheBlobUploadURL",
-      "application/json",
-      data as object
-    );
-    return promise.then((data) =>
-      GetCacheBlobUploadURLResponse.fromJson(data as any, {
-        ignoreUnknownFields: true,
-      })
-    );
-  }
-}
-
-export class BlobCacheServiceClientProtobuf implements BlobCacheServiceClient {
-  private readonly rpc: Rpc;
-  constructor(rpc: Rpc) {
-    this.rpc = rpc;
-    this.GetCachedBlob.bind(this);
-    this.GetCacheBlobUploadURL.bind(this);
-  }
-  GetCachedBlob(request: GetCachedBlobRequest): Promise<GetCachedBlobResponse> {
-    const data = GetCachedBlobRequest.toBinary(request);
-    const promise = this.rpc.request(
-      "github.actions.results.api.v1.BlobCacheService",
-      "GetCachedBlob",
-      "application/protobuf",
-      data
-    );
-    return promise.then((data) =>
-      GetCachedBlobResponse.fromBinary(data as Uint8Array)
-    );
-  }
-
-  GetCacheBlobUploadURL(
-    request: GetCacheBlobUploadURLRequest
-  ): Promise<GetCacheBlobUploadURLResponse> {
-    const data = GetCacheBlobUploadURLRequest.toBinary(request);
-    const promise = this.rpc.request(
-      "github.actions.results.api.v1.BlobCacheService",
-      "GetCacheBlobUploadURL",
-      "application/protobuf",
-      data
-    );
-    return promise.then((data) =>
-      GetCacheBlobUploadURLResponse.fromBinary(data as Uint8Array)
-    );
-  }
-}
-
-//==================================//
-//          Server Code             //
-//==================================//
-
-export interface BlobCacheServiceTwirp<T extends TwirpContext = TwirpContext> {
-  GetCachedBlob(
-    ctx: T,
-    request: GetCachedBlobRequest
-  ): Promise<GetCachedBlobResponse>;
-  GetCacheBlobUploadURL(
-    ctx: T,
-    request: GetCacheBlobUploadURLRequest
-  ): Promise<GetCacheBlobUploadURLResponse>;
-}
-
-export enum BlobCacheServiceMethod {
-  GetCachedBlob = "GetCachedBlob",
-  GetCacheBlobUploadURL = "GetCacheBlobUploadURL",
-}
-
-export const BlobCacheServiceMethodList = [
-  BlobCacheServiceMethod.GetCachedBlob,
-  BlobCacheServiceMethod.GetCacheBlobUploadURL,
-];
-
-export function createBlobCacheServiceServer<
-  T extends TwirpContext = TwirpContext
->(service: BlobCacheServiceTwirp<T>) {
-  return new TwirpServer<BlobCacheServiceTwirp, T>({
-    service,
-    packageName: "github.actions.results.api.v1",
-    serviceName: "BlobCacheService",
-    methodList: BlobCacheServiceMethodList,
-    matchRoute: matchBlobCacheServiceRoute,
-  });
-}
-
-function matchBlobCacheServiceRoute<T extends TwirpContext = TwirpContext>(
-  method: string,
-  events: RouterEvents<T>
-) {
-  switch (method) {
-    case "GetCachedBlob":
-      return async (
-        ctx: T,
-        service: BlobCacheServiceTwirp,
-        data: Buffer,
-        interceptors?: Interceptor<
-          T,
-          GetCachedBlobRequest,
-          GetCachedBlobResponse
-        >[]
-      ) => {
-        ctx = { ...ctx, methodName: "GetCachedBlob" };
-        await events.onMatch(ctx);
-        return handleBlobCacheServiceGetCachedBlobRequest(
-          ctx,
-          service,
-          data,
-          interceptors
-        );
-      };
-    case "GetCacheBlobUploadURL":
-      return async (
-        ctx: T,
-        service: BlobCacheServiceTwirp,
-        data: Buffer,
-        interceptors?: Interceptor<
-          T,
-          GetCacheBlobUploadURLRequest,
-          GetCacheBlobUploadURLResponse
-        >[]
-      ) => {
-        ctx = { ...ctx, methodName: "GetCacheBlobUploadURL" };
-        await events.onMatch(ctx);
-        return handleBlobCacheServiceGetCacheBlobUploadURLRequest(
-          ctx,
-          service,
-          data,
-          interceptors
-        );
-      };
-    default:
-      events.onNotFound();
-      const msg = `no handler found`;
-      throw new TwirpError(TwirpErrorCode.BadRoute, msg);
-  }
-}
-
-function handleBlobCacheServiceGetCachedBlobRequest<
-  T extends TwirpContext = TwirpContext
->(
-  ctx: T,
-  service: BlobCacheServiceTwirp,
-  data: Buffer,
-  interceptors?: Interceptor<T, GetCachedBlobRequest, GetCachedBlobResponse>[]
-): Promise<string | Uint8Array> {
-  switch (ctx.contentType) {
-    case TwirpContentType.JSON:
-      return handleBlobCacheServiceGetCachedBlobJSON<T>(
-        ctx,
-        service,
-        data,
-        interceptors
-      );
-    case TwirpContentType.Protobuf:
-      return handleBlobCacheServiceGetCachedBlobProtobuf<T>(
-        ctx,
-        service,
-        data,
-        interceptors
-      );
-    default:
-      const msg = "unexpected Content-Type";
-      throw new TwirpError(TwirpErrorCode.BadRoute, msg);
-  }
-}
-
-function handleBlobCacheServiceGetCacheBlobUploadURLRequest<
-  T extends TwirpContext = TwirpContext
->(
-  ctx: T,
-  service: BlobCacheServiceTwirp,
-  data: Buffer,
-  interceptors?: Interceptor<
-    T,
-    GetCacheBlobUploadURLRequest,
-    GetCacheBlobUploadURLResponse
-  >[]
-): Promise<string | Uint8Array> {
-  switch (ctx.contentType) {
-    case TwirpContentType.JSON:
-      return handleBlobCacheServiceGetCacheBlobUploadURLJSON<T>(
-        ctx,
-        service,
-        data,
-        interceptors
-      );
-    case TwirpContentType.Protobuf:
-      return handleBlobCacheServiceGetCacheBlobUploadURLProtobuf<T>(
-        ctx,
-        service,
-        data,
-        interceptors
-      );
-    default:
-      const msg = "unexpected Content-Type";
-      throw new TwirpError(TwirpErrorCode.BadRoute, msg);
-  }
-}
-async function handleBlobCacheServiceGetCachedBlobJSON<
-  T extends TwirpContext = TwirpContext
->(
-  ctx: T,
-  service: BlobCacheServiceTwirp,
-  data: Buffer,
-  interceptors?: Interceptor<T, GetCachedBlobRequest, GetCachedBlobResponse>[]
-) {
-  let request: GetCachedBlobRequest;
-  let response: GetCachedBlobResponse;
-
-  try {
-    const body = JSON.parse(data.toString() || "{}");
-    request = GetCachedBlobRequest.fromJson(body, {
-      ignoreUnknownFields: true,
-    });
-  } catch (e) {
-    if (e instanceof Error) {
-      const msg = "the json request could not be decoded";
-      throw new TwirpError(TwirpErrorCode.Malformed, msg).withCause(e, true);
-    }
-  }
-
-  if (interceptors && interceptors.length > 0) {
-    const interceptor = chainInterceptors(...interceptors) as Interceptor<
-      T,
-      GetCachedBlobRequest,
-      GetCachedBlobResponse
-    >;
-    response = await interceptor(ctx, request!, (ctx, inputReq) => {
-      return service.GetCachedBlob(ctx, inputReq);
-    });
-  } else {
-    response = await service.GetCachedBlob(ctx, request!);
-  }
-
-  return JSON.stringify(
-    GetCachedBlobResponse.toJson(response, {
-      useProtoFieldName: true,
-      emitDefaultValues: false,
-    }) as string
-  );
-}
-
-async function handleBlobCacheServiceGetCacheBlobUploadURLJSON<
-  T extends TwirpContext = TwirpContext
->(
-  ctx: T,
-  service: BlobCacheServiceTwirp,
-  data: Buffer,
-  interceptors?: Interceptor<
-    T,
-    GetCacheBlobUploadURLRequest,
-    GetCacheBlobUploadURLResponse
-  >[]
-) {
-  let request: GetCacheBlobUploadURLRequest;
-  let response: GetCacheBlobUploadURLResponse;
-
-  try {
-    const body = JSON.parse(data.toString() || "{}");
-    request = GetCacheBlobUploadURLRequest.fromJson(body, {
-      ignoreUnknownFields: true,
-    });
-  } catch (e) {
-    if (e instanceof Error) {
-      const msg = "the json request could not be decoded";
-      throw new TwirpError(TwirpErrorCode.Malformed, msg).withCause(e, true);
-    }
-  }
-
-  if (interceptors && interceptors.length > 0) {
-    const interceptor = chainInterceptors(...interceptors) as Interceptor<
-      T,
-      GetCacheBlobUploadURLRequest,
-      GetCacheBlobUploadURLResponse
-    >;
-    response = await interceptor(ctx, request!, (ctx, inputReq) => {
-      return service.GetCacheBlobUploadURL(ctx, inputReq);
-    });
-  } else {
-    response = await service.GetCacheBlobUploadURL(ctx, request!);
-  }
-
-  return JSON.stringify(
-    GetCacheBlobUploadURLResponse.toJson(response, {
-      useProtoFieldName: true,
-      emitDefaultValues: false,
-    }) as string
-  );
-}
-async function handleBlobCacheServiceGetCachedBlobProtobuf<
-  T extends TwirpContext = TwirpContext
->(
-  ctx: T,
-  service: BlobCacheServiceTwirp,
-  data: Buffer,
-  interceptors?: Interceptor<T, GetCachedBlobRequest, GetCachedBlobResponse>[]
-) {
-  let request: GetCachedBlobRequest;
-  let response: GetCachedBlobResponse;
-
-  try {
-    request = GetCachedBlobRequest.fromBinary(data);
-  } catch (e) {
-    if (e instanceof Error) {
-      const msg = "the protobuf request could not be decoded";
-      throw new TwirpError(TwirpErrorCode.Malformed, msg).withCause(e, true);
-    }
-  }
-
-  if (interceptors && interceptors.length > 0) {
-    const interceptor = chainInterceptors(...interceptors) as Interceptor<
-      T,
-      GetCachedBlobRequest,
-      GetCachedBlobResponse
-    >;
-    response = await interceptor(ctx, request!, (ctx, inputReq) => {
-      return service.GetCachedBlob(ctx, inputReq);
-    });
-  } else {
-    response = await service.GetCachedBlob(ctx, request!);
-  }
-
-  return Buffer.from(GetCachedBlobResponse.toBinary(response));
-}
-
-async function handleBlobCacheServiceGetCacheBlobUploadURLProtobuf<
-  T extends TwirpContext = TwirpContext
->(
-  ctx: T,
-  service: BlobCacheServiceTwirp,
-  data: Buffer,
-  interceptors?: Interceptor<
-    T,
-    GetCacheBlobUploadURLRequest,
-    GetCacheBlobUploadURLResponse
-  >[]
-) {
-  let request: GetCacheBlobUploadURLRequest;
-  let response: GetCacheBlobUploadURLResponse;
-
-  try {
-    request = GetCacheBlobUploadURLRequest.fromBinary(data);
-  } catch (e) {
-    if (e instanceof Error) {
-      const msg = "the protobuf request could not be decoded";
-      throw new TwirpError(TwirpErrorCode.Malformed, msg).withCause(e, true);
-    }
-  }
-
-  if (interceptors && interceptors.length > 0) {
-    const interceptor = chainInterceptors(...interceptors) as Interceptor<
-      T,
-      GetCacheBlobUploadURLRequest,
-      GetCacheBlobUploadURLResponse
-    >;
-    response = await interceptor(ctx, request!, (ctx, inputReq) => {
-      return service.GetCacheBlobUploadURL(ctx, inputReq);
-    });
-  } else {
-    response = await service.GetCacheBlobUploadURL(ctx, request!);
-  }
-
-  return Buffer.from(GetCacheBlobUploadURLResponse.toBinary(response));
-}

packages/cache/src/generated/results/api/v1/cache.ts

@@ -0,0 +1,975 @@
+// @generated by protobuf-ts 2.9.1 with parameter long_type_string,client_none,generate_dependencies
+// @generated from protobuf file "results/api/v1/cache.proto" (package "github.actions.results.api.v1", syntax proto3)
+// tslint:disable
+import { ServiceType } from "@protobuf-ts/runtime-rpc";
+import type { BinaryWriteOptions } from "@protobuf-ts/runtime";
+import type { IBinaryWriter } from "@protobuf-ts/runtime";
+import { WireType } from "@protobuf-ts/runtime";
+import type { BinaryReadOptions } from "@protobuf-ts/runtime";
+import type { IBinaryReader } from "@protobuf-ts/runtime";
+import { UnknownFieldHandler } from "@protobuf-ts/runtime";
+import type { PartialMessage } from "@protobuf-ts/runtime";
+import { reflectionMergePartial } from "@protobuf-ts/runtime";
+import { MESSAGE_TYPE } from "@protobuf-ts/runtime";
+import { MessageType } from "@protobuf-ts/runtime";
+import { CacheEntry } from "../../entities/v1/cacheentry";
+import { CacheMetadata } from "../../entities/v1/cachemetadata";
+/**
+ * @generated from protobuf message github.actions.results.api.v1.CreateCacheEntryRequest
+ */
+export interface CreateCacheEntryRequest {
+    /**
+     * Scope and other metadata for the cache entry
+     *
+     * @generated from protobuf field: github.actions.results.entities.v1.CacheMetadata metadata = 1;
+     */
+    metadata?: CacheMetadata;
+    /**
+     * An explicit key for a cache entry
+     *
+     * @generated from protobuf field: string key = 2;
+     */
+    key: string;
+    /**
+     * Hash of the compression tool, runner OS and paths cached
+     *
+     * @generated from protobuf field: string version = 3;
+     */
+    version: string;
+}
+/**
+ * @generated from protobuf message github.actions.results.api.v1.CreateCacheEntryResponse
+ */
+export interface CreateCacheEntryResponse {
+    /**
+     * @generated from protobuf field: bool ok = 1;
+     */
+    ok: boolean;
+    /**
+     * SAS URL to upload the cache archive
+     *
+     * @generated from protobuf field: string signed_upload_url = 2;
+     */
+    signedUploadUrl: string;
+}
+/**
+ * @generated from protobuf message github.actions.results.api.v1.FinalizeCacheEntryUploadRequest
+ */
+export interface FinalizeCacheEntryUploadRequest {
+    /**
+     * Scope and other metadata for the cache entry
+     *
+     * @generated from protobuf field: github.actions.results.entities.v1.CacheMetadata metadata = 1;
+     */
+    metadata?: CacheMetadata;
+    /**
+     * An explicit key for a cache entry
+     *
+     * @generated from protobuf field: string key = 2;
+     */
+    key: string;
+    /**
+     * Size of the cache archive in Bytes
+     *
+     * @generated from protobuf field: int64 size_bytes = 3;
+     */
+    sizeBytes: string;
+    /**
+     * Hash of the compression tool, runner OS and paths cached
+     *
+     * @generated from protobuf field: string version = 4;
+     */
+    version: string;
+}
+/**
+ * @generated from protobuf message github.actions.results.api.v1.FinalizeCacheEntryUploadResponse
+ */
+export interface FinalizeCacheEntryUploadResponse {
+    /**
+     * @generated from protobuf field: bool ok = 1;
+     */
+    ok: boolean;
+    /**
+     * Cache entry database ID
+     *
+     * @generated from protobuf field: int64 entry_id = 2;
+     */
+    entryId: string;
+}
+/**
+ * @generated from protobuf message github.actions.results.api.v1.GetCacheEntryDownloadURLRequest
+ */
+export interface GetCacheEntryDownloadURLRequest {
+    /**
+     * Scope and other metadata for the cache entry
+     *
+     * @generated from protobuf field: github.actions.results.entities.v1.CacheMetadata metadata = 1;
+     */
+    metadata?: CacheMetadata;
+    /**
+     * An explicit key for a cache entry
+     *
+     * @generated from protobuf field: string key = 2;
+     */
+    key: string;
+    /**
+     * Restore keys used for prefix searching
+     *
+     * @generated from protobuf field: repeated string restore_keys = 3;
+     */
+    restoreKeys: string[];
+    /**
+     * Hash of the compression tool, runner OS and paths cached
+     *
+     * @generated from protobuf field: string version = 4;
+     */
+    version: string;
+}
+/**
+ * @generated from protobuf message github.actions.results.api.v1.GetCacheEntryDownloadURLResponse
+ */
+export interface GetCacheEntryDownloadURLResponse {
+    /**
+     * @generated from protobuf field: bool ok = 1;
+     */
+    ok: boolean;
+    /**
+     * SAS URL to download the cache archive
+     *
+     * @generated from protobuf field: string signed_download_url = 2;
+     */
+    signedDownloadUrl: string;
+    /**
+     * Key or restore key that matches the lookup
+     *
+     * @generated from protobuf field: string matched_key = 3;
+     */
+    matchedKey: string;
+}
+/**
+ * @generated from protobuf message github.actions.results.api.v1.DeleteCacheEntryRequest
+ */
+export interface DeleteCacheEntryRequest {
+    /**
+     * Scope and other metadata for the cache entry
+     *
+     * @generated from protobuf field: github.actions.results.entities.v1.CacheMetadata metadata = 1;
+     */
+    metadata?: CacheMetadata;
+    /**
+     * An explicit key for a cache entry
+     *
+     * @generated from protobuf field: string key = 2;
+     */
+    key: string;
+}
+/**
+ * @generated from protobuf message github.actions.results.api.v1.DeleteCacheEntryResponse
+ */
+export interface DeleteCacheEntryResponse {
+    /**
+     * @generated from protobuf field: bool ok = 1;
+     */
+    ok: boolean;
+    /**
+     * Cache entry database ID
+     *
+     * @generated from protobuf field: int64 entry_id = 2;
+     */
+    entryId: string;
+}
+/**
+ * @generated from protobuf message github.actions.results.api.v1.ListCacheEntriesRequest
+ */
+export interface ListCacheEntriesRequest {
+    /**
+     * Scope and other metadata for the cache entry
+     *
+     * @generated from protobuf field: github.actions.results.entities.v1.CacheMetadata metadata = 1;
+     */
+    metadata?: CacheMetadata;
+    /**
+     * An explicit key for a cache entry
+     *
+     * @generated from protobuf field: string key = 2;
+     */
+    key: string;
+    /**
+     * Restore keys used for prefix searching
+     *
+     * @generated from protobuf field: repeated string restore_keys = 3;
+     */
+    restoreKeys: string[];
+}
+/**
+ * @generated from protobuf message github.actions.results.api.v1.ListCacheEntriesResponse
+ */
+export interface ListCacheEntriesResponse {
+    /**
+     * Cache entries in the defined scope
+     *
+     * @generated from protobuf field: repeated github.actions.results.entities.v1.CacheEntry entries = 1;
+     */
+    entries: CacheEntry[];
+}
+/**
+ * @generated from protobuf message github.actions.results.api.v1.LookupCacheEntryRequest
+ */
+export interface LookupCacheEntryRequest {
+    /**
+     * Scope and other metadata for the cache entry
+     *
+     * @generated from protobuf field: github.actions.results.entities.v1.CacheMetadata metadata = 1;
+     */
+    metadata?: CacheMetadata;
+    /**
+     * An explicit key for a cache entry
+     *
+     * @generated from protobuf field: string key = 2;
+     */
+    key: string;
+    /**
+     * Restore keys used for prefix searching
+     *
+     * @generated from protobuf field: repeated string restore_keys = 3;
+     */
+    restoreKeys: string[];
+    /**
+     * Hash of the compression tool, runner OS and paths cached
+     *
+     * @generated from protobuf field: string version = 4;
+     */
+    version: string;
+}
+/**
+ * @generated from protobuf message github.actions.results.api.v1.LookupCacheEntryResponse
+ */
+export interface LookupCacheEntryResponse {
+    /**
+     * Indicates whether the cache entry exists or not
+     *
+     * @generated from protobuf field: bool exists = 1;
+     */
+    exists: boolean;
+    /**
+     * Matched cache entry metadata
+     *
+     * @generated from protobuf field: github.actions.results.entities.v1.CacheEntry entry = 2;
+     */
+    entry?: CacheEntry;
+}
+// @generated message type with reflection information, may provide speed optimized methods
+class CreateCacheEntryRequest$Type extends MessageType<CreateCacheEntryRequest> {
+    constructor() {
+        super("github.actions.results.api.v1.CreateCacheEntryRequest", [
+            { no: 1, name: "metadata", kind: "message", T: () => CacheMetadata },
+            { no: 2, name: "key", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "version", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<CreateCacheEntryRequest>): CreateCacheEntryRequest {
+        const message = { key: "", version: "" };
+        globalThis.Object.defineProperty(message, MESSAGE_TYPE, { enumerable: false, value: this });
+        if (value !== undefined)
+            reflectionMergePartial<CreateCacheEntryRequest>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: CreateCacheEntryRequest): CreateCacheEntryRequest {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* github.actions.results.entities.v1.CacheMetadata metadata */ 1:
+                    message.metadata = CacheMetadata.internalBinaryRead(reader, reader.uint32(), options, message.metadata);
+                    break;
+                case /* string key */ 2:
+                    message.key = reader.string();
+                    break;
+                case /* string version */ 3:
+                    message.version = reader.string();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: CreateCacheEntryRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* github.actions.results.entities.v1.CacheMetadata metadata = 1; */
+        if (message.metadata)
+            CacheMetadata.internalBinaryWrite(message.metadata, writer.tag(1, WireType.LengthDelimited).fork(), options).join();
+        /* string key = 2; */
+        if (message.key !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.key);
+        /* string version = 3; */
+        if (message.version !== "")
+            writer.tag(3, WireType.LengthDelimited).string(message.version);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message github.actions.results.api.v1.CreateCacheEntryRequest
+ */
+export const CreateCacheEntryRequest = new CreateCacheEntryRequest$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class CreateCacheEntryResponse$Type extends MessageType<CreateCacheEntryResponse> {
+    constructor() {
+        super("github.actions.results.api.v1.CreateCacheEntryResponse", [
+            { no: 1, name: "ok", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
+            { no: 2, name: "signed_upload_url", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<CreateCacheEntryResponse>): CreateCacheEntryResponse {
+        const message = { ok: false, signedUploadUrl: "" };
+        globalThis.Object.defineProperty(message, MESSAGE_TYPE, { enumerable: false, value: this });
+        if (value !== undefined)
+            reflectionMergePartial<CreateCacheEntryResponse>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: CreateCacheEntryResponse): CreateCacheEntryResponse {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* bool ok */ 1:
+                    message.ok = reader.bool();
+                    break;
+                case /* string signed_upload_url */ 2:
+                    message.signedUploadUrl = reader.string();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: CreateCacheEntryResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* bool ok = 1; */
+        if (message.ok !== false)
+            writer.tag(1, WireType.Varint).bool(message.ok);
+        /* string signed_upload_url = 2; */
+        if (message.signedUploadUrl !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.signedUploadUrl);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message github.actions.results.api.v1.CreateCacheEntryResponse
+ */
+export const CreateCacheEntryResponse = new CreateCacheEntryResponse$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class FinalizeCacheEntryUploadRequest$Type extends MessageType<FinalizeCacheEntryUploadRequest> {
+    constructor() {
+        super("github.actions.results.api.v1.FinalizeCacheEntryUploadRequest", [
+            { no: 1, name: "metadata", kind: "message", T: () => CacheMetadata },
+            { no: 2, name: "key", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "size_bytes", kind: "scalar", T: 3 /*ScalarType.INT64*/ },
+            { no: 4, name: "version", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<FinalizeCacheEntryUploadRequest>): FinalizeCacheEntryUploadRequest {
+        const message = { key: "", sizeBytes: "0", version: "" };
+        globalThis.Object.defineProperty(message, MESSAGE_TYPE, { enumerable: false, value: this });
+        if (value !== undefined)
+            reflectionMergePartial<FinalizeCacheEntryUploadRequest>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: FinalizeCacheEntryUploadRequest): FinalizeCacheEntryUploadRequest {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* github.actions.results.entities.v1.CacheMetadata metadata */ 1:
+                    message.metadata = CacheMetadata.internalBinaryRead(reader, reader.uint32(), options, message.metadata);
+                    break;
+                case /* string key */ 2:
+                    message.key = reader.string();
+                    break;
+                case /* int64 size_bytes */ 3:
+                    message.sizeBytes = reader.int64().toString();
+                    break;
+                case /* string version */ 4:
+                    message.version = reader.string();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: FinalizeCacheEntryUploadRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* github.actions.results.entities.v1.CacheMetadata metadata = 1; */
+        if (message.metadata)
+            CacheMetadata.internalBinaryWrite(message.metadata, writer.tag(1, WireType.LengthDelimited).fork(), options).join();
+        /* string key = 2; */
+        if (message.key !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.key);
+        /* int64 size_bytes = 3; */
+        if (message.sizeBytes !== "0")
+            writer.tag(3, WireType.Varint).int64(message.sizeBytes);
+        /* string version = 4; */
+        if (message.version !== "")
+            writer.tag(4, WireType.LengthDelimited).string(message.version);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message github.actions.results.api.v1.FinalizeCacheEntryUploadRequest
+ */
+export const FinalizeCacheEntryUploadRequest = new FinalizeCacheEntryUploadRequest$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class FinalizeCacheEntryUploadResponse$Type extends MessageType<FinalizeCacheEntryUploadResponse> {
+    constructor() {
+        super("github.actions.results.api.v1.FinalizeCacheEntryUploadResponse", [
+            { no: 1, name: "ok", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
+            { no: 2, name: "entry_id", kind: "scalar", T: 3 /*ScalarType.INT64*/ }
+        ]);
+    }
+    create(value?: PartialMessage<FinalizeCacheEntryUploadResponse>): FinalizeCacheEntryUploadResponse {
+        const message = { ok: false, entryId: "0" };
+        globalThis.Object.defineProperty(message, MESSAGE_TYPE, { enumerable: false, value: this });
+        if (value !== undefined)
+            reflectionMergePartial<FinalizeCacheEntryUploadResponse>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: FinalizeCacheEntryUploadResponse): FinalizeCacheEntryUploadResponse {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* bool ok */ 1:
+                    message.ok = reader.bool();
+                    break;
+                case /* int64 entry_id */ 2:
+                    message.entryId = reader.int64().toString();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: FinalizeCacheEntryUploadResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* bool ok = 1; */
+        if (message.ok !== false)
+            writer.tag(1, WireType.Varint).bool(message.ok);
+        /* int64 entry_id = 2; */
+        if (message.entryId !== "0")
+            writer.tag(2, WireType.Varint).int64(message.entryId);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message github.actions.results.api.v1.FinalizeCacheEntryUploadResponse
+ */
+export const FinalizeCacheEntryUploadResponse = new FinalizeCacheEntryUploadResponse$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class GetCacheEntryDownloadURLRequest$Type extends MessageType<GetCacheEntryDownloadURLRequest> {
+    constructor() {
+        super("github.actions.results.api.v1.GetCacheEntryDownloadURLRequest", [
+            { no: 1, name: "metadata", kind: "message", T: () => CacheMetadata },
+            { no: 2, name: "key", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "restore_keys", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
+            { no: 4, name: "version", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<GetCacheEntryDownloadURLRequest>): GetCacheEntryDownloadURLRequest {
+        const message = { key: "", restoreKeys: [], version: "" };
+        globalThis.Object.defineProperty(message, MESSAGE_TYPE, { enumerable: false, value: this });
+        if (value !== undefined)
+            reflectionMergePartial<GetCacheEntryDownloadURLRequest>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetCacheEntryDownloadURLRequest): GetCacheEntryDownloadURLRequest {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* github.actions.results.entities.v1.CacheMetadata metadata */ 1:
+                    message.metadata = CacheMetadata.internalBinaryRead(reader, reader.uint32(), options, message.metadata);
+                    break;
+                case /* string key */ 2:
+                    message.key = reader.string();
+                    break;
+                case /* repeated string restore_keys */ 3:
+                    message.restoreKeys.push(reader.string());
+                    break;
+                case /* string version */ 4:
+                    message.version = reader.string();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: GetCacheEntryDownloadURLRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* github.actions.results.entities.v1.CacheMetadata metadata = 1; */
+        if (message.metadata)
+            CacheMetadata.internalBinaryWrite(message.metadata, writer.tag(1, WireType.LengthDelimited).fork(), options).join();
+        /* string key = 2; */
+        if (message.key !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.key);
+        /* repeated string restore_keys = 3; */
+        for (let i = 0; i < message.restoreKeys.length; i++)
+            writer.tag(3, WireType.LengthDelimited).string(message.restoreKeys[i]);
+        /* string version = 4; */
+        if (message.version !== "")
+            writer.tag(4, WireType.LengthDelimited).string(message.version);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message github.actions.results.api.v1.GetCacheEntryDownloadURLRequest
+ */
+export const GetCacheEntryDownloadURLRequest = new GetCacheEntryDownloadURLRequest$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class GetCacheEntryDownloadURLResponse$Type extends MessageType<GetCacheEntryDownloadURLResponse> {
+    constructor() {
+        super("github.actions.results.api.v1.GetCacheEntryDownloadURLResponse", [
+            { no: 1, name: "ok", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
+            { no: 2, name: "signed_download_url", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "matched_key", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<GetCacheEntryDownloadURLResponse>): GetCacheEntryDownloadURLResponse {
+        const message = { ok: false, signedDownloadUrl: "", matchedKey: "" };
+        globalThis.Object.defineProperty(message, MESSAGE_TYPE, { enumerable: false, value: this });
+        if (value !== undefined)
+            reflectionMergePartial<GetCacheEntryDownloadURLResponse>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: GetCacheEntryDownloadURLResponse): GetCacheEntryDownloadURLResponse {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* bool ok */ 1:
+                    message.ok = reader.bool();
+                    break;
+                case /* string signed_download_url */ 2:
+                    message.signedDownloadUrl = reader.string();
+                    break;
+                case /* string matched_key */ 3:
+                    message.matchedKey = reader.string();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: GetCacheEntryDownloadURLResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* bool ok = 1; */
+        if (message.ok !== false)
+            writer.tag(1, WireType.Varint).bool(message.ok);
+        /* string signed_download_url = 2; */
+        if (message.signedDownloadUrl !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.signedDownloadUrl);
+        /* string matched_key = 3; */
+        if (message.matchedKey !== "")
+            writer.tag(3, WireType.LengthDelimited).string(message.matchedKey);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message github.actions.results.api.v1.GetCacheEntryDownloadURLResponse
+ */
+export const GetCacheEntryDownloadURLResponse = new GetCacheEntryDownloadURLResponse$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class DeleteCacheEntryRequest$Type extends MessageType<DeleteCacheEntryRequest> {
+    constructor() {
+        super("github.actions.results.api.v1.DeleteCacheEntryRequest", [
+            { no: 1, name: "metadata", kind: "message", T: () => CacheMetadata },
+            { no: 2, name: "key", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<DeleteCacheEntryRequest>): DeleteCacheEntryRequest {
+        const message = { key: "" };
+        globalThis.Object.defineProperty(message, MESSAGE_TYPE, { enumerable: false, value: this });
+        if (value !== undefined)
+            reflectionMergePartial<DeleteCacheEntryRequest>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: DeleteCacheEntryRequest): DeleteCacheEntryRequest {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* github.actions.results.entities.v1.CacheMetadata metadata */ 1:
+                    message.metadata = CacheMetadata.internalBinaryRead(reader, reader.uint32(), options, message.metadata);
+                    break;
+                case /* string key */ 2:
+                    message.key = reader.string();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: DeleteCacheEntryRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* github.actions.results.entities.v1.CacheMetadata metadata = 1; */
+        if (message.metadata)
+            CacheMetadata.internalBinaryWrite(message.metadata, writer.tag(1, WireType.LengthDelimited).fork(), options).join();
+        /* string key = 2; */
+        if (message.key !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.key);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message github.actions.results.api.v1.DeleteCacheEntryRequest
+ */
+export const DeleteCacheEntryRequest = new DeleteCacheEntryRequest$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class DeleteCacheEntryResponse$Type extends MessageType<DeleteCacheEntryResponse> {
+    constructor() {
+        super("github.actions.results.api.v1.DeleteCacheEntryResponse", [
+            { no: 1, name: "ok", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
+            { no: 2, name: "entry_id", kind: "scalar", T: 3 /*ScalarType.INT64*/ }
+        ]);
+    }
+    create(value?: PartialMessage<DeleteCacheEntryResponse>): DeleteCacheEntryResponse {
+        const message = { ok: false, entryId: "0" };
+        globalThis.Object.defineProperty(message, MESSAGE_TYPE, { enumerable: false, value: this });
+        if (value !== undefined)
+            reflectionMergePartial<DeleteCacheEntryResponse>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: DeleteCacheEntryResponse): DeleteCacheEntryResponse {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* bool ok */ 1:
+                    message.ok = reader.bool();
+                    break;
+                case /* int64 entry_id */ 2:
+                    message.entryId = reader.int64().toString();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: DeleteCacheEntryResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* bool ok = 1; */
+        if (message.ok !== false)
+            writer.tag(1, WireType.Varint).bool(message.ok);
+        /* int64 entry_id = 2; */
+        if (message.entryId !== "0")
+            writer.tag(2, WireType.Varint).int64(message.entryId);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message github.actions.results.api.v1.DeleteCacheEntryResponse
+ */
+export const DeleteCacheEntryResponse = new DeleteCacheEntryResponse$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class ListCacheEntriesRequest$Type extends MessageType<ListCacheEntriesRequest> {
+    constructor() {
+        super("github.actions.results.api.v1.ListCacheEntriesRequest", [
+            { no: 1, name: "metadata", kind: "message", T: () => CacheMetadata },
+            { no: 2, name: "key", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "restore_keys", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<ListCacheEntriesRequest>): ListCacheEntriesRequest {
+        const message = { key: "", restoreKeys: [] };
+        globalThis.Object.defineProperty(message, MESSAGE_TYPE, { enumerable: false, value: this });
+        if (value !== undefined)
+            reflectionMergePartial<ListCacheEntriesRequest>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ListCacheEntriesRequest): ListCacheEntriesRequest {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* github.actions.results.entities.v1.CacheMetadata metadata */ 1:
+                    message.metadata = CacheMetadata.internalBinaryRead(reader, reader.uint32(), options, message.metadata);
+                    break;
+                case /* string key */ 2:
+                    message.key = reader.string();
+                    break;
+                case /* repeated string restore_keys */ 3:
+                    message.restoreKeys.push(reader.string());
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: ListCacheEntriesRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* github.actions.results.entities.v1.CacheMetadata metadata = 1; */
+        if (message.metadata)
+            CacheMetadata.internalBinaryWrite(message.metadata, writer.tag(1, WireType.LengthDelimited).fork(), options).join();
+        /* string key = 2; */
+        if (message.key !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.key);
+        /* repeated string restore_keys = 3; */
+        for (let i = 0; i < message.restoreKeys.length; i++)
+            writer.tag(3, WireType.LengthDelimited).string(message.restoreKeys[i]);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message github.actions.results.api.v1.ListCacheEntriesRequest
+ */
+export const ListCacheEntriesRequest = new ListCacheEntriesRequest$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class ListCacheEntriesResponse$Type extends MessageType<ListCacheEntriesResponse> {
+    constructor() {
+        super("github.actions.results.api.v1.ListCacheEntriesResponse", [
+            { no: 1, name: "entries", kind: "message", repeat: 1 /*RepeatType.PACKED*/, T: () => CacheEntry }
+        ]);
+    }
+    create(value?: PartialMessage<ListCacheEntriesResponse>): ListCacheEntriesResponse {
+        const message = { entries: [] };
+        globalThis.Object.defineProperty(message, MESSAGE_TYPE, { enumerable: false, value: this });
+        if (value !== undefined)
+            reflectionMergePartial<ListCacheEntriesResponse>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: ListCacheEntriesResponse): ListCacheEntriesResponse {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* repeated github.actions.results.entities.v1.CacheEntry entries */ 1:
+                    message.entries.push(CacheEntry.internalBinaryRead(reader, reader.uint32(), options));
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: ListCacheEntriesResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* repeated github.actions.results.entities.v1.CacheEntry entries = 1; */
+        for (let i = 0; i < message.entries.length; i++)
+            CacheEntry.internalBinaryWrite(message.entries[i], writer.tag(1, WireType.LengthDelimited).fork(), options).join();
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message github.actions.results.api.v1.ListCacheEntriesResponse
+ */
+export const ListCacheEntriesResponse = new ListCacheEntriesResponse$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class LookupCacheEntryRequest$Type extends MessageType<LookupCacheEntryRequest> {
+    constructor() {
+        super("github.actions.results.api.v1.LookupCacheEntryRequest", [
+            { no: 1, name: "metadata", kind: "message", T: () => CacheMetadata },
+            { no: 2, name: "key", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "restore_keys", kind: "scalar", repeat: 2 /*RepeatType.UNPACKED*/, T: 9 /*ScalarType.STRING*/ },
+            { no: 4, name: "version", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<LookupCacheEntryRequest>): LookupCacheEntryRequest {
+        const message = { key: "", restoreKeys: [], version: "" };
+        globalThis.Object.defineProperty(message, MESSAGE_TYPE, { enumerable: false, value: this });
+        if (value !== undefined)
+            reflectionMergePartial<LookupCacheEntryRequest>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: LookupCacheEntryRequest): LookupCacheEntryRequest {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* github.actions.results.entities.v1.CacheMetadata metadata */ 1:
+                    message.metadata = CacheMetadata.internalBinaryRead(reader, reader.uint32(), options, message.metadata);
+                    break;
+                case /* string key */ 2:
+                    message.key = reader.string();
+                    break;
+                case /* repeated string restore_keys */ 3:
+                    message.restoreKeys.push(reader.string());
+                    break;
+                case /* string version */ 4:
+                    message.version = reader.string();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: LookupCacheEntryRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* github.actions.results.entities.v1.CacheMetadata metadata = 1; */
+        if (message.metadata)
+            CacheMetadata.internalBinaryWrite(message.metadata, writer.tag(1, WireType.LengthDelimited).fork(), options).join();
+        /* string key = 2; */
+        if (message.key !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.key);
+        /* repeated string restore_keys = 3; */
+        for (let i = 0; i < message.restoreKeys.length; i++)
+            writer.tag(3, WireType.LengthDelimited).string(message.restoreKeys[i]);
+        /* string version = 4; */
+        if (message.version !== "")
+            writer.tag(4, WireType.LengthDelimited).string(message.version);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message github.actions.results.api.v1.LookupCacheEntryRequest
+ */
+export const LookupCacheEntryRequest = new LookupCacheEntryRequest$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class LookupCacheEntryResponse$Type extends MessageType<LookupCacheEntryResponse> {
+    constructor() {
+        super("github.actions.results.api.v1.LookupCacheEntryResponse", [
+            { no: 1, name: "exists", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
+            { no: 2, name: "entry", kind: "message", T: () => CacheEntry }
+        ]);
+    }
+    create(value?: PartialMessage<LookupCacheEntryResponse>): LookupCacheEntryResponse {
+        const message = { exists: false };
+        globalThis.Object.defineProperty(message, MESSAGE_TYPE, { enumerable: false, value: this });
+        if (value !== undefined)
+            reflectionMergePartial<LookupCacheEntryResponse>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: LookupCacheEntryResponse): LookupCacheEntryResponse {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* bool exists */ 1:
+                    message.exists = reader.bool();
+                    break;
+                case /* github.actions.results.entities.v1.CacheEntry entry */ 2:
+                    message.entry = CacheEntry.internalBinaryRead(reader, reader.uint32(), options, message.entry);
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: LookupCacheEntryResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* bool exists = 1; */
+        if (message.exists !== false)
+            writer.tag(1, WireType.Varint).bool(message.exists);
+        /* github.actions.results.entities.v1.CacheEntry entry = 2; */
+        if (message.entry)
+            CacheEntry.internalBinaryWrite(message.entry, writer.tag(2, WireType.LengthDelimited).fork(), options).join();
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message github.actions.results.api.v1.LookupCacheEntryResponse
+ */
+export const LookupCacheEntryResponse = new LookupCacheEntryResponse$Type();
+/**
+ * @generated ServiceType for protobuf service github.actions.results.api.v1.CacheService
+ */
+export const CacheService = new ServiceType("github.actions.results.api.v1.CacheService", [
+    { name: "CreateCacheEntry", options: {}, I: CreateCacheEntryRequest, O: CreateCacheEntryResponse },
+    { name: "FinalizeCacheEntryUpload", options: {}, I: FinalizeCacheEntryUploadRequest, O: FinalizeCacheEntryUploadResponse },
+    { name: "GetCacheEntryDownloadURL", options: {}, I: GetCacheEntryDownloadURLRequest, O: GetCacheEntryDownloadURLResponse },
+    { name: "DeleteCacheEntry", options: {}, I: DeleteCacheEntryRequest, O: DeleteCacheEntryResponse },
+    { name: "ListCacheEntries", options: {}, I: ListCacheEntriesRequest, O: ListCacheEntriesResponse },
+    { name: "LookupCacheEntry", options: {}, I: LookupCacheEntryRequest, O: LookupCacheEntryResponse }
+]);

packages/cache/src/generated/results/entities/v1/cacheentry.ts

@@ -0,0 +1,163 @@
+// @generated by protobuf-ts 2.9.1 with parameter long_type_string,client_none,generate_dependencies
+// @generated from protobuf file "results/entities/v1/cacheentry.proto" (package "github.actions.results.entities.v1", syntax proto3)
+// tslint:disable
+import type { BinaryWriteOptions } from "@protobuf-ts/runtime";
+import type { IBinaryWriter } from "@protobuf-ts/runtime";
+import { WireType } from "@protobuf-ts/runtime";
+import type { BinaryReadOptions } from "@protobuf-ts/runtime";
+import type { IBinaryReader } from "@protobuf-ts/runtime";
+import { UnknownFieldHandler } from "@protobuf-ts/runtime";
+import type { PartialMessage } from "@protobuf-ts/runtime";
+import { reflectionMergePartial } from "@protobuf-ts/runtime";
+import { MESSAGE_TYPE } from "@protobuf-ts/runtime";
+import { MessageType } from "@protobuf-ts/runtime";
+import { Timestamp } from "../../../google/protobuf/timestamp";
+/**
+ * @generated from protobuf message github.actions.results.entities.v1.CacheEntry
+ */
+export interface CacheEntry {
+    /**
+     * An explicit key for a cache entry
+     *
+     * @generated from protobuf field: string key = 1;
+     */
+    key: string;
+    /**
+     * SHA256 hex digest of the cache archive
+     *
+     * @generated from protobuf field: string hash = 2;
+     */
+    hash: string;
+    /**
+     * Cache entry size in bytes
+     *
+     * @generated from protobuf field: int64 size_bytes = 3;
+     */
+    sizeBytes: string;
+    /**
+     * Access scope
+     *
+     * @generated from protobuf field: string scope = 4;
+     */
+    scope: string;
+    /**
+     * Version SHA256 hex digest
+     *
+     * @generated from protobuf field: string version = 5;
+     */
+    version: string;
+    /**
+     * When the cache entry was created
+     *
+     * @generated from protobuf field: google.protobuf.Timestamp created_at = 6;
+     */
+    createdAt?: Timestamp;
+    /**
+     * When the cache entry was last accessed
+     *
+     * @generated from protobuf field: google.protobuf.Timestamp last_accessed_at = 7;
+     */
+    lastAccessedAt?: Timestamp;
+    /**
+     * When the cache entry is set to expire
+     *
+     * @generated from protobuf field: google.protobuf.Timestamp expires_at = 8;
+     */
+    expiresAt?: Timestamp;
+}
+// @generated message type with reflection information, may provide speed optimized methods
+class CacheEntry$Type extends MessageType<CacheEntry> {
+    constructor() {
+        super("github.actions.results.entities.v1.CacheEntry", [
+            { no: 1, name: "key", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "hash", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "size_bytes", kind: "scalar", T: 3 /*ScalarType.INT64*/ },
+            { no: 4, name: "scope", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 5, name: "version", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 6, name: "created_at", kind: "message", T: () => Timestamp },
+            { no: 7, name: "last_accessed_at", kind: "message", T: () => Timestamp },
+            { no: 8, name: "expires_at", kind: "message", T: () => Timestamp }
+        ]);
+    }
+    create(value?: PartialMessage<CacheEntry>): CacheEntry {
+        const message = { key: "", hash: "", sizeBytes: "0", scope: "", version: "" };
+        globalThis.Object.defineProperty(message, MESSAGE_TYPE, { enumerable: false, value: this });
+        if (value !== undefined)
+            reflectionMergePartial<CacheEntry>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: CacheEntry): CacheEntry {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string key */ 1:
+                    message.key = reader.string();
+                    break;
+                case /* string hash */ 2:
+                    message.hash = reader.string();
+                    break;
+                case /* int64 size_bytes */ 3:
+                    message.sizeBytes = reader.int64().toString();
+                    break;
+                case /* string scope */ 4:
+                    message.scope = reader.string();
+                    break;
+                case /* string version */ 5:
+                    message.version = reader.string();
+                    break;
+                case /* google.protobuf.Timestamp created_at */ 6:
+                    message.createdAt = Timestamp.internalBinaryRead(reader, reader.uint32(), options, message.createdAt);
+                    break;
+                case /* google.protobuf.Timestamp last_accessed_at */ 7:
+                    message.lastAccessedAt = Timestamp.internalBinaryRead(reader, reader.uint32(), options, message.lastAccessedAt);
+                    break;
+                case /* google.protobuf.Timestamp expires_at */ 8:
+                    message.expiresAt = Timestamp.internalBinaryRead(reader, reader.uint32(), options, message.expiresAt);
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: CacheEntry, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string key = 1; */
+        if (message.key !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.key);
+        /* string hash = 2; */
+        if (message.hash !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.hash);
+        /* int64 size_bytes = 3; */
+        if (message.sizeBytes !== "0")
+            writer.tag(3, WireType.Varint).int64(message.sizeBytes);
+        /* string scope = 4; */
+        if (message.scope !== "")
+            writer.tag(4, WireType.LengthDelimited).string(message.scope);
+        /* string version = 5; */
+        if (message.version !== "")
+            writer.tag(5, WireType.LengthDelimited).string(message.version);
+        /* google.protobuf.Timestamp created_at = 6; */
+        if (message.createdAt)
+            Timestamp.internalBinaryWrite(message.createdAt, writer.tag(6, WireType.LengthDelimited).fork(), options).join();
+        /* google.protobuf.Timestamp last_accessed_at = 7; */
+        if (message.lastAccessedAt)
+            Timestamp.internalBinaryWrite(message.lastAccessedAt, writer.tag(7, WireType.LengthDelimited).fork(), options).join();
+        /* google.protobuf.Timestamp expires_at = 8; */
+        if (message.expiresAt)
+            Timestamp.internalBinaryWrite(message.expiresAt, writer.tag(8, WireType.LengthDelimited).fork(), options).join();
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message github.actions.results.entities.v1.CacheEntry
+ */
+export const CacheEntry = new CacheEntry$Type();

packages/cache/src/generated/results/entities/v1/cachemetadata.ts

@@ -0,0 +1,85 @@
+// @generated by protobuf-ts 2.9.1 with parameter long_type_string,client_none,generate_dependencies
+// @generated from protobuf file "results/entities/v1/cachemetadata.proto" (package "github.actions.results.entities.v1", syntax proto3)
+// tslint:disable
+import type { BinaryWriteOptions } from "@protobuf-ts/runtime";
+import type { IBinaryWriter } from "@protobuf-ts/runtime";
+import { WireType } from "@protobuf-ts/runtime";
+import type { BinaryReadOptions } from "@protobuf-ts/runtime";
+import type { IBinaryReader } from "@protobuf-ts/runtime";
+import { UnknownFieldHandler } from "@protobuf-ts/runtime";
+import type { PartialMessage } from "@protobuf-ts/runtime";
+import { reflectionMergePartial } from "@protobuf-ts/runtime";
+import { MESSAGE_TYPE } from "@protobuf-ts/runtime";
+import { MessageType } from "@protobuf-ts/runtime";
+import { CacheScope } from "./cachescope";
+/**
+ * @generated from protobuf message github.actions.results.entities.v1.CacheMetadata
+ */
+export interface CacheMetadata {
+    /**
+     * Backend repository id
+     *
+     * @generated from protobuf field: int64 repository_id = 1;
+     */
+    repositoryId: string;
+    /**
+     * Scopes for the cache entry
+     *
+     * @generated from protobuf field: repeated github.actions.results.entities.v1.CacheScope scope = 2;
+     */
+    scope: CacheScope[];
+}
+// @generated message type with reflection information, may provide speed optimized methods
+class CacheMetadata$Type extends MessageType<CacheMetadata> {
+    constructor() {
+        super("github.actions.results.entities.v1.CacheMetadata", [
+            { no: 1, name: "repository_id", kind: "scalar", T: 3 /*ScalarType.INT64*/ },
+            { no: 2, name: "scope", kind: "message", repeat: 1 /*RepeatType.PACKED*/, T: () => CacheScope }
+        ]);
+    }
+    create(value?: PartialMessage<CacheMetadata>): CacheMetadata {
+        const message = { repositoryId: "0", scope: [] };
+        globalThis.Object.defineProperty(message, MESSAGE_TYPE, { enumerable: false, value: this });
+        if (value !== undefined)
+            reflectionMergePartial<CacheMetadata>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: CacheMetadata): CacheMetadata {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* int64 repository_id */ 1:
+                    message.repositoryId = reader.int64().toString();
+                    break;
+                case /* repeated github.actions.results.entities.v1.CacheScope scope */ 2:
+                    message.scope.push(CacheScope.internalBinaryRead(reader, reader.uint32(), options));
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: CacheMetadata, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* int64 repository_id = 1; */
+        if (message.repositoryId !== "0")
+            writer.tag(1, WireType.Varint).int64(message.repositoryId);
+        /* repeated github.actions.results.entities.v1.CacheScope scope = 2; */
+        for (let i = 0; i < message.scope.length; i++)
+            CacheScope.internalBinaryWrite(message.scope[i], writer.tag(2, WireType.LengthDelimited).fork(), options).join();
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message github.actions.results.entities.v1.CacheMetadata
+ */
+export const CacheMetadata = new CacheMetadata$Type();

packages/cache/src/generated/results/entities/v1/cachescope.ts

@@ -0,0 +1,84 @@
+// @generated by protobuf-ts 2.9.1 with parameter long_type_string,client_none,generate_dependencies
+// @generated from protobuf file "results/entities/v1/cachescope.proto" (package "github.actions.results.entities.v1", syntax proto3)
+// tslint:disable
+import type { BinaryWriteOptions } from "@protobuf-ts/runtime";
+import type { IBinaryWriter } from "@protobuf-ts/runtime";
+import { WireType } from "@protobuf-ts/runtime";
+import type { BinaryReadOptions } from "@protobuf-ts/runtime";
+import type { IBinaryReader } from "@protobuf-ts/runtime";
+import { UnknownFieldHandler } from "@protobuf-ts/runtime";
+import type { PartialMessage } from "@protobuf-ts/runtime";
+import { reflectionMergePartial } from "@protobuf-ts/runtime";
+import { MESSAGE_TYPE } from "@protobuf-ts/runtime";
+import { MessageType } from "@protobuf-ts/runtime";
+/**
+ * @generated from protobuf message github.actions.results.entities.v1.CacheScope
+ */
+export interface CacheScope {
+    /**
+     * Determines the scope of the cache entry
+     *
+     * @generated from protobuf field: string scope = 1;
+     */
+    scope: string;
+    /**
+     * None: 0 | Read: 1 | Write: 2 | All: (1|2)
+     *
+     * @generated from protobuf field: int64 permission = 2;
+     */
+    permission: string;
+}
+// @generated message type with reflection information, may provide speed optimized methods
+class CacheScope$Type extends MessageType<CacheScope> {
+    constructor() {
+        super("github.actions.results.entities.v1.CacheScope", [
+            { no: 1, name: "scope", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "permission", kind: "scalar", T: 3 /*ScalarType.INT64*/ }
+        ]);
+    }
+    create(value?: PartialMessage<CacheScope>): CacheScope {
+        const message = { scope: "", permission: "0" };
+        globalThis.Object.defineProperty(message, MESSAGE_TYPE, { enumerable: false, value: this });
+        if (value !== undefined)
+            reflectionMergePartial<CacheScope>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: CacheScope): CacheScope {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string scope */ 1:
+                    message.scope = reader.string();
+                    break;
+                case /* int64 permission */ 2:
+                    message.permission = reader.int64().toString();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: CacheScope, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string scope = 1; */
+        if (message.scope !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.scope);
+        /* int64 permission = 2; */
+        if (message.permission !== "0")
+            writer.tag(2, WireType.Varint).int64(message.permission);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message github.actions.results.entities.v1.CacheScope
+ */
+export const CacheScope = new CacheScope$Type();

packages/cache/src/internal/cacheHttpClient.ts

@@ -5,12 +5,10 @@ import {
   RequestOptions,
   TypedResponse
 } from '@actions/http-client/lib/interfaces'
-import * as crypto from 'crypto'
 import * as fs from 'fs'
 import {URL} from 'url'
-
 import * as utils from './cacheUtils'
-import {CompressionMethod} from './constants'
+import {uploadCacheArchiveSDK} from './uploadUtils'
 import {
   ArtifactCacheEntry,
   InternalCacheOptions,
@@ -36,12 +34,11 @@ import {
   retryHttpClientResponse,
   retryTypedResponse
 } from './requestUtils'
-import {CacheUrl} from './constants'
-
-const versionSalt = '1.0'
+import {getCacheServiceURL} from './config'
+import {getUserAgentString} from './shared/user-agent'
 
 function getCacheApiUrl(resource: string): string {
-  const baseUrl: string = CacheUrl || ''
+  const baseUrl: string = getCacheServiceURL()
   if (!baseUrl) {
     throw new Error('Cache Service Url not found, unable to restore cache.')
   }
@@ -70,49 +67,24 @@ function createHttpClient(): HttpClient {
   const bearerCredentialHandler = new BearerCredentialHandler(token)
 
   return new HttpClient(
-    'actions/cache',
+    getUserAgentString(),
     [bearerCredentialHandler],
     getRequestOptions()
   )
 }
 
-export function getCacheVersion(
-  paths: string[],
-  compressionMethod?: CompressionMethod,
-  enableCrossOsArchive = false
-): string {
-  // don't pass changes upstream
-  const components = paths.slice()
-
-  // Add compression method to cache version to restore
-  // compressed cache as per compression method
-  if (compressionMethod) {
-    components.push(compressionMethod)
-  }
-
-  // Only check for windows platforms if enableCrossOsArchive is false
-  if (process.platform === 'win32' && !enableCrossOsArchive) {
-    components.push('windows-only')
-  }
-
-  // Add salt to cache version to support breaking changes in cache entry
-  components.push(versionSalt)
-
-  return crypto.createHash('sha256').update(components.join('|')).digest('hex')
-}
-
 export async function getCacheEntry(
   keys: string[],
   paths: string[],
   options?: InternalCacheOptions
 ): Promise<ArtifactCacheEntry | null> {
   const httpClient = createHttpClient()
-  const version = getCacheVersion(
+  const version = utils.getCacheVersion(
     paths,
     options?.compressionMethod,
     options?.enableCrossOsArchive
   )
-  
+
   const resource = `cache?keys=${encodeURIComponent(
     keys.join(',')
   )}&version=${version}`
@@ -209,7 +181,7 @@ export async function reserveCache(
   options?: InternalCacheOptions
 ): Promise<ITypedResponseWithError<ReserveCacheResponse>> {
   const httpClient = createHttpClient()
-  const version = getCacheVersion(
+  const version = utils.getCacheVersion(
     paths,
     options?.compressionMethod,
     options?.enableCrossOsArchive
@@ -355,26 +327,45 @@ async function commitCache(
 export async function saveCache(
   cacheId: number,
   archivePath: string,
+  signedUploadURL?: string,
   options?: UploadOptions
 ): Promise<void> {
-  const httpClient = createHttpClient()
+  const uploadOptions = getUploadOptions(options)
 
-  core.debug('Upload cache')
-  await uploadFile(httpClient, cacheId, archivePath, options)
+  if (uploadOptions.useAzureSdk) {
+    // Use Azure storage SDK to upload caches directly to Azure
+    if (!signedUploadURL) {
+      throw new Error(
+        'Azure Storage SDK can only be used when a signed URL is provided.'
+      )
+    }
+    await uploadCacheArchiveSDK(signedUploadURL, archivePath, options)
+  } else {
+    const httpClient = createHttpClient()
 
-  // Commit Cache
-  core.debug('Commiting cache')
-  const cacheSize = utils.getArchiveFileSizeInBytes(archivePath)
-  core.info(
-    `Cache Size: ~${Math.round(cacheSize / (1024 * 1024))} MB (${cacheSize} B)`
-  )
+    core.debug('Upload cache')
+    await uploadFile(httpClient, cacheId, archivePath, options)
 
-  const commitCacheResponse = await commitCache(httpClient, cacheId, cacheSize)
-  if (!isSuccessStatusCode(commitCacheResponse.statusCode)) {
-    throw new Error(
-      `Cache service responded with ${commitCacheResponse.statusCode} during commit cache.`
+    // Commit Cache
+    core.debug('Commiting cache')
+    const cacheSize = utils.getArchiveFileSizeInBytes(archivePath)
+    core.info(
+      `Cache Size: ~${Math.round(
+        cacheSize / (1024 * 1024)
+      )} MB (${cacheSize} B)`
     )
-  }
 
-  core.info('Cache saved successfully')
+    const commitCacheResponse = await commitCache(
+      httpClient,
+      cacheId,
+      cacheSize
+    )
+    if (!isSuccessStatusCode(commitCacheResponse.statusCode)) {
+      throw new Error(
+        `Cache service responded with ${commitCacheResponse.statusCode} during commit cache.`
+      )
+    }
+
+    core.info('Cache saved successfully')
+  }
 }

packages/cache/src/internal/cacheUtils.ts

@@ -2,17 +2,19 @@ import * as core from '@actions/core'
 import * as exec from '@actions/exec'
 import * as glob from '@actions/glob'
 import * as io from '@actions/io'
+import * as crypto from 'crypto'
 import * as fs from 'fs'
 import * as path from 'path'
 import * as semver from 'semver'
 import * as util from 'util'
-import {v4 as uuidV4} from 'uuid'
 import {
   CacheFilename,
   CompressionMethod,
   GnuTarPathOnWindows
 } from './constants'
 
+const versionSalt = '1.0'
+
 // From https://github.com/actions/toolkit/blob/main/packages/tool-cache/src/tool-cache.ts#L23
 export async function createTempDirectory(): Promise<string> {
   const IS_WINDOWS = process.platform === 'win32'
@@ -34,7 +36,7 @@ export async function createTempDirectory(): Promise<string> {
     tempDirectory = path.join(baseLocation, 'actions', 'temp')
   }
 
-  const dest = path.join(tempDirectory, uuidV4())
+  const dest = path.join(tempDirectory, crypto.randomUUID())
   await io.mkdirP(dest)
   return dest
 }
@@ -131,15 +133,35 @@ export function assertDefined<T>(name: string, value?: T): T {
   return value
 }
 
-export function isGhes(): boolean {
-  const ghUrl = new URL(
-    process.env['GITHUB_SERVER_URL'] || 'https://github.com'
-  )
+export function getCacheVersion(
+  paths: string[],
+  compressionMethod?: CompressionMethod,
+  enableCrossOsArchive = false
+): string {
+  // don't pass changes upstream
+  const components = paths.slice()
 
-  const hostname = ghUrl.hostname.trimEnd().toUpperCase()
-  const isGitHubHost = hostname === 'GITHUB.COM'
-  const isGheHost =
-    hostname.endsWith('.GHE.COM') || hostname.endsWith('.GHE.LOCALHOST')
+  // Add compression method to cache version to restore
+  // compressed cache as per compression method
+  if (compressionMethod) {
+    components.push(compressionMethod)
+  }
 
-  return !isGitHubHost && !isGheHost
+  // Only check for windows platforms if enableCrossOsArchive is false
+  if (process.platform === 'win32' && !enableCrossOsArchive) {
+    components.push('windows-only')
+  }
+
+  // Add salt to cache version to support breaking changes in cache entry
+  components.push(versionSalt)
+
+  return crypto.createHash('sha256').update(components.join('|')).digest('hex')
+}
+
+export function getRuntimeToken(): string {
+  const token = process.env['ACTIONS_RUNTIME_TOKEN']
+  if (!token) {
+    throw new Error('Unable to get the ACTIONS_RUNTIME_TOKEN env variable')
+  }
+  return token
 }

packages/cache/src/internal/config.ts

@@ -1,7 +1,39 @@
-export function getRuntimeToken(): string {
-  const token = process.env['ACTIONS_RUNTIME_TOKEN']
-  if (!token) {
-    throw new Error('Unable to get the ACTIONS_RUNTIME_TOKEN env variable')
-  }
-  return token
+export function isGhes(): boolean {
+  const ghUrl = new URL(
+    process.env['GITHUB_SERVER_URL'] || 'https://github.com'
+  )
+
+  const hostname = ghUrl.hostname.trimEnd().toUpperCase()
+  const isGitHubHost = hostname === 'GITHUB.COM'
+  const isGheHost = hostname.endsWith('.GHE.COM')
+  const isLocalHost = hostname.endsWith('.LOCALHOST')
+
+  return !isGitHubHost && !isGheHost && !isLocalHost
+}
+
+export function getCacheServiceVersion(): string {
+  // Cache service v2 is not supported on GHES. We will default to
+  // cache service v1 even if the feature flag was enabled by user.
+  if (isGhes()) return 'v1'
+
+  return process.env['ACTIONS_CACHE_SERVICE_V2'] ? 'v2' : 'v1'
+}
+
+export function getCacheServiceURL(): string {
+  const version = getCacheServiceVersion()
+
+  // Based on the version of the cache service, we will determine which
+  // URL to use.
+  switch (version) {
+    case 'v1':
+      return (
+        process.env['ACTIONS_CACHE_URL'] ||
+        process.env['ACTIONS_RESULTS_URL'] ||
+        ''
+      )
+    case 'v2':
+      return process.env['ACTIONS_RESULTS_URL'] || ''
+    default:
+      throw new Error(`Unsupported cache service version: ${version}`)
+  }
 }

packages/cache/src/internal/constants.ts

@@ -37,6 +37,4 @@ export const TarFilename = 'cache.tar'
 
 export const ManifestFilename = 'manifest.txt'
 
-// Cache Service Metadata
-export const CacheUrl = `${process.env['ACTIONS_CACHE_URL_NEXT']} || ${process.env['ACTIONS_CACHE_URL']}`
-export const CacheServiceVersion = `${process.env['ACTIONS_CACHE_URL_NEXT'] ? 'v2' : 'v1'}`
+export const CacheFileSizeLimit = 10 * Math.pow(1024, 3) // 10GiB per repository

packages/cache/src/internal/shared/cacheTwirpClient.ts

@@ -1,11 +1,11 @@
-import {HttpClient, HttpClientResponse, HttpCodes} from '@actions/http-client'
-import {BearerCredentialHandler} from '@actions/http-client/lib/auth'
 import {info, debug} from '@actions/core'
-import {BlobCacheServiceClientJSON} from '../generated/results/api/v1/blobcache.twirp'
-import {CacheUrl} from './constants'
-import {getRuntimeToken} from './config'
-// import {getUserAgentString} from './user-agent'
-// import {NetworkError, UsageError} from './errors'
+import {getUserAgentString} from './user-agent'
+import {NetworkError, UsageError} from './errors'
+import {getCacheServiceURL} from '../config'
+import {getRuntimeToken} from '../cacheUtils'
+import {BearerCredentialHandler} from '@actions/http-client/lib/auth'
+import {HttpClient, HttpClientResponse, HttpCodes} from '@actions/http-client'
+import {CacheServiceClientJSON} from '../../generated/results/api/v1/cache.twirp'
 
 // The twirp http client must implement this interface
 interface Rpc {
@@ -17,7 +17,14 @@ interface Rpc {
   ): Promise<object | Uint8Array>
 }
 
-class BlobCacheServiceClient implements Rpc {
+/**
+ * This class is a wrapper around the CacheServiceClientJSON class generated by Twirp.
+ *
+ * It adds retry logic to the request method, which is not present in the generated client.
+ *
+ * This class is used to interact with cache service v2.
+ */
+class CacheServiceClient implements Rpc {
   private httpClient: HttpClient
   private baseUrl: string
   private maxAttempts = 5
@@ -31,7 +38,7 @@ class BlobCacheServiceClient implements Rpc {
     retryMultiplier?: number
   ) {
     const token = getRuntimeToken()
-    this.baseUrl = CacheUrl
+    this.baseUrl = getCacheServiceURL()
     if (maxAttempts) {
       this.maxAttempts = maxAttempts
     }
@@ -94,9 +101,9 @@ class BlobCacheServiceClient implements Rpc {
         isRetryable = this.isRetryableHttpStatusCode(statusCode)
         errorMessage = `Failed request: (${statusCode}) ${response.message.statusMessage}`
         if (body.msg) {
-        //   if (UsageError.isUsageErrorMessage(body.msg)) {
-        //     throw new UsageError()
-        //   }
+          if (UsageError.isUsageErrorMessage(body.msg)) {
+            throw new UsageError()
+          }
 
           errorMessage = `${errorMessage}: ${body.msg}`
         }
@@ -105,13 +112,13 @@ class BlobCacheServiceClient implements Rpc {
           debug(`Raw Body: ${rawBody}`)
         }
 
-        // if (error instanceof UsageError) {
-        //   throw error
-        // }
+        if (error instanceof UsageError) {
+          throw error
+        }
 
-        // if (NetworkError.isNetworkErrorCode(error?.code)) {
-        //   throw new NetworkError(error?.code)
-        // }
+        if (NetworkError.isNetworkErrorCode(error?.code)) {
+          throw new NetworkError(error?.code)
+        }
 
         isRetryable = true
         errorMessage = error.message
@@ -182,16 +189,16 @@ class BlobCacheServiceClient implements Rpc {
   }
 }
 
-export function internalBlobCacheTwirpClient(options?: {
+export function internalCacheTwirpClient(options?: {
   maxAttempts?: number
   retryIntervalMs?: number
   retryMultiplier?: number
-}): BlobCacheServiceClientJSON {
-  const client = new BlobCacheServiceClient(
-    'actions/cache',
+}): CacheServiceClientJSON {
+  const client = new CacheServiceClient(
+    getUserAgentString(),
     options?.maxAttempts,
     options?.retryIntervalMs,
     options?.retryMultiplier
   )
-  return new BlobCacheServiceClientJSON(client)
+  return new CacheServiceClientJSON(client)
 }

packages/cache/src/internal/shared/errors.ts

@@ -0,0 +1,72 @@
+export class FilesNotFoundError extends Error {
+  files: string[]
+
+  constructor(files: string[] = []) {
+    let message = 'No files were found to upload'
+    if (files.length > 0) {
+      message += `: ${files.join(', ')}`
+    }
+
+    super(message)
+    this.files = files
+    this.name = 'FilesNotFoundError'
+  }
+}
+
+export class InvalidResponseError extends Error {
+  constructor(message: string) {
+    super(message)
+    this.name = 'InvalidResponseError'
+  }
+}
+
+export class CacheNotFoundError extends Error {
+  constructor(message = 'Cache not found') {
+    super(message)
+    this.name = 'CacheNotFoundError'
+  }
+}
+
+export class GHESNotSupportedError extends Error {
+  constructor(
+    message = '@actions/cache v4.1.4+, actions/cache/save@v4+ and actions/cache/restore@v4+ are not currently supported on GHES.'
+  ) {
+    super(message)
+    this.name = 'GHESNotSupportedError'
+  }
+}
+
+export class NetworkError extends Error {
+  code: string
+
+  constructor(code: string) {
+    const message = `Unable to make request: ${code}\nIf you are using self-hosted runners, please make sure your runner has access to all GitHub endpoints: https://docs.github.com/en/actions/hosting-your-own-runners/managing-self-hosted-runners/about-self-hosted-runners#communication-between-self-hosted-runners-and-github`
+    super(message)
+    this.code = code
+    this.name = 'NetworkError'
+  }
+
+  static isNetworkErrorCode = (code?: string): boolean => {
+    if (!code) return false
+    return [
+      'ECONNRESET',
+      'ENOTFOUND',
+      'ETIMEDOUT',
+      'ECONNREFUSED',
+      'EHOSTUNREACH'
+    ].includes(code)
+  }
+}
+
+export class UsageError extends Error {
+  constructor() {
+    const message = `Cache storage quota has been hit. Unable to upload any new cache entries. Usage is recalculated every 6-12 hours.\nMore info on storage limits: https://docs.github.com/en/billing/managing-billing-for-github-actions/about-billing-for-github-actions#calculating-minute-and-storage-spending`
+    super(message)
+    this.name = 'UsageError'
+  }
+
+  static isUsageErrorMessage = (msg?: string): boolean => {
+    if (!msg) return false
+    return msg.includes('insufficient usage')
+  }
+}

packages/cache/src/internal/shared/user-agent.ts

@@ -0,0 +1,9 @@
+// eslint-disable-next-line @typescript-eslint/no-var-requires, @typescript-eslint/no-require-imports
+const packageJson = require('../../../package.json')
+
+/**
+ * Ensure that this User Agent String is used in all HTTP calls so that we can monitor telemetry between different versions of this package
+ */
+export function getUserAgentString(): string {
+  return `@actions/cache-${packageJson.version}`
+}

packages/cache/src/internal/uploadUtils.ts

@@ -0,0 +1,177 @@
+import * as core from '@actions/core'
+import {
+  BlobClient,
+  BlobUploadCommonResponse,
+  BlockBlobClient,
+  BlockBlobParallelUploadOptions
+} from '@azure/storage-blob'
+import {TransferProgressEvent} from '@azure/ms-rest-js'
+import {InvalidResponseError} from './shared/errors'
+import {UploadOptions} from '../options'
+
+/**
+ * Class for tracking the upload state and displaying stats.
+ */
+export class UploadProgress {
+  contentLength: number
+  sentBytes: number
+  startTime: number
+  displayedComplete: boolean
+  timeoutHandle?: ReturnType<typeof setTimeout>
+
+  constructor(contentLength: number) {
+    this.contentLength = contentLength
+    this.sentBytes = 0
+    this.displayedComplete = false
+    this.startTime = Date.now()
+  }
+
+  /**
+   * Sets the number of bytes sent
+   *
+   * @param sentBytes the number of bytes sent
+   */
+  setSentBytes(sentBytes: number): void {
+    this.sentBytes = sentBytes
+  }
+
+  /**
+   * Returns the total number of bytes transferred.
+   */
+  getTransferredBytes(): number {
+    return this.sentBytes
+  }
+
+  /**
+   * Returns true if the upload is complete.
+   */
+  isDone(): boolean {
+    return this.getTransferredBytes() === this.contentLength
+  }
+
+  /**
+   * Prints the current upload stats. Once the upload completes, this will print one
+   * last line and then stop.
+   */
+  display(): void {
+    if (this.displayedComplete) {
+      return
+    }
+
+    const transferredBytes = this.sentBytes
+    const percentage = (100 * (transferredBytes / this.contentLength)).toFixed(
+      1
+    )
+    const elapsedTime = Date.now() - this.startTime
+    const uploadSpeed = (
+      transferredBytes /
+      (1024 * 1024) /
+      (elapsedTime / 1000)
+    ).toFixed(1)
+
+    core.info(
+      `Sent ${transferredBytes} of ${this.contentLength} (${percentage}%), ${uploadSpeed} MBs/sec`
+    )
+
+    if (this.isDone()) {
+      this.displayedComplete = true
+    }
+  }
+
+  /**
+   * Returns a function used to handle TransferProgressEvents.
+   */
+  onProgress(): (progress: TransferProgressEvent) => void {
+    return (progress: TransferProgressEvent) => {
+      this.setSentBytes(progress.loadedBytes)
+    }
+  }
+
+  /**
+   * Starts the timer that displays the stats.
+   *
+   * @param delayInMs the delay between each write
+   */
+  startDisplayTimer(delayInMs = 1000): void {
+    const displayCallback = (): void => {
+      this.display()
+
+      if (!this.isDone()) {
+        this.timeoutHandle = setTimeout(displayCallback, delayInMs)
+      }
+    }
+
+    this.timeoutHandle = setTimeout(displayCallback, delayInMs)
+  }
+
+  /**
+   * Stops the timer that displays the stats. As this typically indicates the upload
+   * is complete, this will display one last line, unless the last line has already
+   * been written.
+   */
+  stopDisplayTimer(): void {
+    if (this.timeoutHandle) {
+      clearTimeout(this.timeoutHandle)
+      this.timeoutHandle = undefined
+    }
+
+    this.display()
+  }
+}
+
+/**
+ * Uploads a cache archive directly to Azure Blob Storage using the Azure SDK.
+ * This function will display progress information to the console. Concurrency of the
+ * upload is determined by the calling functions.
+ *
+ * @param signedUploadURL
+ * @param archivePath
+ * @param options
+ * @returns
+ */
+export async function uploadCacheArchiveSDK(
+  signedUploadURL: string,
+  archivePath: string,
+  options?: UploadOptions
+): Promise<BlobUploadCommonResponse> {
+  const blobClient: BlobClient = new BlobClient(signedUploadURL)
+  const blockBlobClient: BlockBlobClient = blobClient.getBlockBlobClient()
+  const uploadProgress = new UploadProgress(options?.archiveSizeBytes ?? 0)
+
+  // Specify data transfer options
+  const uploadOptions: BlockBlobParallelUploadOptions = {
+    blockSize: options?.uploadChunkSize,
+    concurrency: options?.uploadConcurrency, // maximum number of parallel transfer workers
+    maxSingleShotSize: 128 * 1024 * 1024, // 128 MiB initial transfer size
+    onProgress: uploadProgress.onProgress()
+  }
+
+  try {
+    uploadProgress.startDisplayTimer()
+
+    core.debug(
+      `BlobClient: ${blobClient.name}:${blobClient.accountName}:${blobClient.containerName}`
+    )
+
+    const response = await blockBlobClient.uploadFile(
+      archivePath,
+      uploadOptions
+    )
+
+    // TODO: better management of non-retryable errors
+    if (response._response.status >= 400) {
+      throw new InvalidResponseError(
+        `uploadCacheArchiveSDK: upload failed with status code ${response._response.status}`
+      )
+    }
+
+    return response
+  } catch (error) {
+    core.warning(
+      `uploadCacheArchiveSDK: internal error uploading cache archive: ${error.message}`
+    )
+    throw error
+  } finally {
+    uploadProgress.stopDisplayTimer()
+  }
+}

packages/cache/src/internal/v2/download-cache.ts

@@ -1,68 +0,0 @@
-import * as core from '@actions/core'
-import * as httpClient from '@actions/http-client'
-import unzip from 'unzip-stream'
-const packageJson = require('../../../package.json')
-
-export async function StreamExtract(url: string, directory: string): Promise<void> {
-    let retryCount = 0
-    while (retryCount < 5) {
-      try {
-        await streamExtractExternal(url, directory)
-        return
-      } catch (error) {
-        retryCount++
-        core.info(
-          `Failed to download cache after ${retryCount} retries due to ${error.message}. Retrying in 5 seconds...`
-        )
-        // wait 5 seconds before retrying
-        await new Promise(resolve => setTimeout(resolve, 5000))
-      }
-    }
-
-    throw new Error(`Cache download failed after ${retryCount} retries.`)
-}
-
-export async function streamExtractExternal(
-    url: string,
-    directory: string
-  ): Promise<void> {
-    const client = new httpClient.HttpClient(`@actions/cache-${packageJson.version}`)
-    const response = await client.get(url)
-    if (response.message.statusCode !== 200) {
-      core.info(`Failed to download cache. HTTP status code: ${response.message.statusCode}`)
-      throw new Error(
-        `Unexpected HTTP response from blob storage: ${response.message.statusCode} ${response.message.statusMessage}`
-      )
-    }
-  
-    const timeout = 30 * 1000 // 30 seconds
-  
-    return new Promise((resolve, reject) => {
-      const timerFn = (): void => {
-        response.message.destroy(
-          new Error(`Blob storage chunk did not respond in ${timeout}ms`)
-        )
-      }
-      const timer = setTimeout(timerFn, timeout)
-  
-      response.message
-        .on('data', () => {
-          timer.refresh()
-        })
-        .on('error', (error: Error) => {
-          core.info(
-            `response.message: Cache download failed: ${error.message}`
-          )
-          clearTimeout(timer)
-          reject(error)
-        })
-        .pipe(unzip.Extract({path: directory}))
-        .on('close', () => {
-          clearTimeout(timer)
-          resolve()
-        })
-        .on('error', (error: Error) => {
-          reject(error)
-        })
-    })
-  }

packages/cache/src/internal/v2/upload-cache.ts

@@ -1,130 +0,0 @@
-import * as core from '@actions/core'
-import {GetCacheBlobUploadURLResponse} from '../../generated/results/api/v1/blobcache'
-import {ZipUploadStream} from '@actions/artifact/lib/internal/upload/zip'
-import {NetworkError} from '@actions/artifact/'
-import {TransferProgressEvent} from '@azure/core-http'
-import * as stream from 'stream'
-import * as crypto from 'crypto'
-import {
-  BlobClient, 
-  BlockBlobClient, 
-  BlockBlobUploadStreamOptions,
-  BlockBlobParallelUploadOptions
-} from '@azure/storage-blob'
-
-export async function UploadCacheStream(
-  signedUploadURL: string,
-  zipUploadStream: ZipUploadStream
-): Promise<{}> {
-  let uploadByteCount = 0
-  let lastProgressTime = Date.now()
-  let timeoutId: NodeJS.Timeout | undefined
-
-  const chunkTimer = (timeout: number): NodeJS.Timeout => {
-    // clear the previous timeout
-    if (timeoutId) {
-      clearTimeout(timeoutId)
-    }
-
-    timeoutId = setTimeout(() => {
-      const now = Date.now()
-      // if there's been more than 30 seconds since the
-      // last progress event, then we'll consider the upload stalled
-      if (now - lastProgressTime > timeout) {
-        throw new Error('Upload progress stalled.')
-      }
-    }, timeout)
-    return timeoutId
-  }
-
-  const maxConcurrency = 32
-  const bufferSize = 8 * 1024 * 1024 // 8 MB Chunks
-  const blobClient = new BlobClient(signedUploadURL)
-  const blockBlobClient = blobClient.getBlockBlobClient()
-  const timeoutDuration = 300000 // 30 seconds
-
-  core.debug(
-    `Uploading cache zip to blob storage with maxConcurrency: ${maxConcurrency}, bufferSize: ${bufferSize}`
-  )
-
-  const uploadCallback = (progress: TransferProgressEvent): void => {
-    core.info(`Uploaded bytes ${progress.loadedBytes}`)
-    uploadByteCount = progress.loadedBytes
-    chunkTimer(timeoutDuration)
-    lastProgressTime = Date.now()
-  }
-
-  const options: BlockBlobUploadStreamOptions = {
-    blobHTTPHeaders: {blobContentType: 'zip'},
-    onProgress: uploadCallback
-  }
-
-  let sha256Hash: string | undefined = undefined
-  const uploadStream = new stream.PassThrough()
-  const hashStream = crypto.createHash('sha256')
-
-  zipUploadStream.pipe(uploadStream) // This stream is used for the upload
-  zipUploadStream.pipe(hashStream).setEncoding('hex') // This stream is used to compute a hash of the zip content that gets used. Integrity check
-
-  core.info('Beginning upload of cache to blob storage')
-  try {
-    // Start the chunk timer
-    timeoutId = chunkTimer(timeoutDuration)
-    await blockBlobClient.uploadStream(
-      uploadStream,
-      bufferSize,
-      maxConcurrency,
-      options
-    )
-  } catch (error) {
-    if (NetworkError.isNetworkErrorCode(error?.code)) {
-      throw new NetworkError(error?.code)
-    }
-    throw error
-  } finally {
-    // clear the timeout whether or not the upload completes
-    if (timeoutId) {
-      clearTimeout(timeoutId)
-    }
-  }
-
-  core.info('Finished uploading cache content to blob storage!')
-  
-  hashStream.end()
-  sha256Hash = hashStream.read() as string
-  core.info(`SHA256 hash of uploaded artifact zip is ${sha256Hash}`)
-  core.info(`Uploaded: ${uploadByteCount} bytes`)
-
-  if (uploadByteCount === 0) {
-    core.error(
-      `No data was uploaded to blob storage. Reported upload byte count is 0.`
-    )
-  }
-  return {
-    uploadSize: uploadByteCount,
-    sha256Hash
-  }
-}
-
-export async function UploadCacheFile(
-  uploadURL: GetCacheBlobUploadURLResponse,
-  archivePath: string,
-): Promise<{}> {
-  core.info(`Uploading ${archivePath} to: ${JSON.stringify(uploadURL)}`)
-  
-  // Specify data transfer options
-  const uploadOptions: BlockBlobParallelUploadOptions = {
-    blockSize: 4 * 1024 * 1024, // 4 MiB max block size
-    concurrency: 2, // maximum number of parallel transfer workers
-    maxSingleShotSize: 8 * 1024 * 1024, // 8 MiB initial transfer size
-  };
-
-  // const blobClient: BlobClient = new BlobClient(uploadURL.urls[0])
-  const blobClient: BlobClient = new BlobClient(uploadURL.urls[0].url)
-  const blockBlobClient: BlockBlobClient = blobClient.getBlockBlobClient()
-
-  core.info(`BlobClient: ${JSON.stringify(blobClient)}`)
-  core.info(`blockBlobClient: ${JSON.stringify(blockBlobClient)}`)
-
-  return blockBlobClient.uploadFile(archivePath, uploadOptions);
-}

packages/cache/src/options.ts

@@ -4,6 +4,14 @@ import * as core from '@actions/core'
  * Options to control cache upload
  */
 export interface UploadOptions {
+  /**
+   * Indicates whether to use the Azure Blob SDK to download caches
+   * that are stored on Azure Blob Storage to improve reliability and
+   * performance
+   *
+   * @default false
+   */
+  useAzureSdk?: boolean
   /**
    * Number of parallel cache upload
    *
@@ -16,6 +24,10 @@ export interface UploadOptions {
    * @default 32MB
    */
   uploadChunkSize?: number
+  /**
+   * Archive size in bytes
+   */
+  archiveSizeBytes?: number
 }
 
 /**
@@ -76,12 +88,18 @@ export interface DownloadOptions {
  * @param copy the original upload options
  */
 export function getUploadOptions(copy?: UploadOptions): UploadOptions {
+  // Defaults if not overriden
   const result: UploadOptions = {
+    useAzureSdk: false,
     uploadConcurrency: 4,
     uploadChunkSize: 32 * 1024 * 1024
   }
 
   if (copy) {
+    if (typeof copy.useAzureSdk === 'boolean') {
+      result.useAzureSdk = copy.useAzureSdk
+    }
+
     if (typeof copy.uploadConcurrency === 'number') {
       result.uploadConcurrency = copy.uploadConcurrency
     }
@@ -91,6 +109,26 @@ export function getUploadOptions(copy?: UploadOptions): UploadOptions {
     }
   }
 
+  /**
+   * Add env var overrides
+   */
+  // Cap the uploadConcurrency at 32
+  result.uploadConcurrency = !isNaN(
+    Number(process.env['CACHE_UPLOAD_CONCURRENCY'])
+  )
+    ? Math.min(32, Number(process.env['CACHE_UPLOAD_CONCURRENCY']))
+    : result.uploadConcurrency
+  // Cap the uploadChunkSize at 128MiB
+  result.uploadChunkSize = !isNaN(
+    Number(process.env['CACHE_UPLOAD_CHUNK_SIZE'])
+  )
+    ? Math.min(
+        128 * 1024 * 1024,
+        Number(process.env['CACHE_UPLOAD_CHUNK_SIZE']) * 1024 * 1024
+      )
+    : result.uploadChunkSize
+
+  core.debug(`Use Azure SDK: ${result.useAzureSdk}`)
   core.debug(`Upload concurrency: ${result.uploadConcurrency}`)
   core.debug(`Upload chunk size: ${result.uploadChunkSize}`)
 

packages/core/RELEASES.md

@@ -1,5 +1,12 @@
 # @actions/core Releases
 
+### 1.11.1
+- Fix uses of `crypto.randomUUID` on Node 18 and earlier [#1842](https://github.com/actions/toolkit/pull/1842)
+
+### 1.11.0
+- Add platform info utilities [#1551](https://github.com/actions/toolkit/pull/1551)
+- Remove dependency on `uuid` package [#1824](https://github.com/actions/toolkit/pull/1824)
+
 ### 1.10.1
 - Fix error message reference in oidc utils [#1511](https://github.com/actions/toolkit/pull/1511)
 

packages/core/__tests__/core.test.ts

@@ -4,9 +4,6 @@ import * as path from 'path'
 import * as core from '../src/core'
 import {HttpClient} from '@actions/http-client'
 import {toCommandProperties} from '../src/utils'
-import * as uuid from 'uuid'
-
-jest.mock('uuid')
 
 /* eslint-disable @typescript-eslint/unbound-method */
 
@@ -49,11 +46,23 @@ const testEnvVars = {
 const UUID = '9b1deb4d-3b7d-4bad-9bdd-2b0d7b3dcb6d'
 const DELIMITER = `ghadelimiter_${UUID}`
 
+jest.mock('crypto', () => ({
+  ...jest.requireActual('crypto'),
+  randomUUID: jest.fn(() => UUID)
+}))
+
+const TEMP_DIR = path.join(__dirname, '_temp')
+
 describe('@actions/core', () => {
   beforeAll(() => {
-    const filePath = path.join(__dirname, `test`)
+    const filePath = TEMP_DIR
     if (!fs.existsSync(filePath)) {
       fs.mkdirSync(filePath)
+    } else {
+      // Clear out the temp directory
+      for (const file of fs.readdirSync(filePath)) {
+        fs.unlinkSync(path.join(filePath, file))
+      }
     }
   })
 
@@ -62,10 +71,6 @@ describe('@actions/core', () => {
       process.env[key] = testEnvVars[key as keyof typeof testEnvVars]
     }
     process.stdout.write = jest.fn()
-
-    jest.spyOn(uuid, 'v4').mockImplementation(() => {
-      return UUID
-    })
   })
 
   afterEach(() => {
@@ -141,7 +146,7 @@ describe('@actions/core', () => {
       `Unexpected input: value should not contain the delimiter "${DELIMITER}"`
     )
 
-    const filePath = path.join(__dirname, `test/${command}`)
+    const filePath = path.join(TEMP_DIR, command)
     fs.unlinkSync(filePath)
   })
 
@@ -155,7 +160,7 @@ describe('@actions/core', () => {
       `Unexpected input: name should not contain the delimiter "${DELIMITER}"`
     )
 
-    const filePath = path.join(__dirname, `test/${command}`)
+    const filePath = path.join(TEMP_DIR, command)
     fs.unlinkSync(filePath)
   })
 
@@ -347,7 +352,7 @@ describe('@actions/core', () => {
       `Unexpected input: value should not contain the delimiter "${DELIMITER}"`
     )
 
-    const filePath = path.join(__dirname, `test/${command}`)
+    const filePath = path.join(TEMP_DIR, command)
     fs.unlinkSync(filePath)
   })
 
@@ -361,7 +366,7 @@ describe('@actions/core', () => {
       `Unexpected input: name should not contain the delimiter "${DELIMITER}"`
     )
 
-    const filePath = path.join(__dirname, `test/${command}`)
+    const filePath = path.join(TEMP_DIR, command)
     fs.unlinkSync(filePath)
   })
 
@@ -585,7 +590,7 @@ describe('@actions/core', () => {
       `Unexpected input: value should not contain the delimiter "${DELIMITER}"`
     )
 
-    const filePath = path.join(__dirname, `test/${command}`)
+    const filePath = path.join(TEMP_DIR, command)
     fs.unlinkSync(filePath)
   })
 
@@ -599,7 +604,7 @@ describe('@actions/core', () => {
       `Unexpected input: name should not contain the delimiter "${DELIMITER}"`
     )
 
-    const filePath = path.join(__dirname, `test/${command}`)
+    const filePath = path.join(TEMP_DIR, command)
     fs.unlinkSync(filePath)
   })
 
@@ -641,7 +646,7 @@ function assertWriteCalls(calls: string[]): void {
 }
 
 function createFileCommandFile(command: string): void {
-  const filePath = path.join(__dirname, `test/${command}`)
+  const filePath = path.join(__dirname, `_temp/${command}`)
   process.env[`GITHUB_${command}`] = filePath
   fs.appendFileSync(filePath, '', {
     encoding: 'utf8'
@@ -649,7 +654,7 @@ function createFileCommandFile(command: string): void {
 }
 
 function verifyFileCommand(command: string, expectedContents: string): void {
-  const filePath = path.join(__dirname, `test/${command}`)
+  const filePath = path.join(__dirname, `_temp/${command}`)
   const contents = fs.readFileSync(filePath, 'utf8')
   try {
     expect(contents).toEqual(expectedContents)

packages/core/package-lock.json

@@ -1,21 +1,19 @@
 {
   "name": "@actions/core",
-  "version": "1.10.1",
+  "version": "1.11.1",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {
     "": {
       "name": "@actions/core",
-      "version": "1.10.1",
+      "version": "1.11.1",
       "license": "MIT",
       "dependencies": {
         "@actions/exec": "^1.1.1",
-        "@actions/http-client": "^2.0.1",
-        "uuid": "^8.3.2"
+        "@actions/http-client": "^2.0.1"
       },
       "devDependencies": {
-        "@types/node": "^12.0.2",
-        "@types/uuid": "^8.3.4"
+        "@types/node": "^16.18.112"
       }
     },
     "node_modules/@actions/exec": {
@@ -40,15 +38,9 @@
       "integrity": "sha512-wi9JjgKLYS7U/z8PPbco+PvTb/nRWjeoFlJ1Qer83k/3C5PHQi28hiVdeE2kHXmIL99mQFawx8qt/JPjZilJ8Q=="
     },
     "node_modules/@types/node": {
-      "version": "12.0.2",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-12.0.2.tgz",
-      "integrity": "sha512-5tabW/i+9mhrfEOUcLDu2xBPsHJ+X5Orqy9FKpale3SjDA17j5AEpYq5vfy3oAeAHGcvANRCO3NV3d2D6q3NiA==",
-      "dev": true
-    },
-    "node_modules/@types/uuid": {
-      "version": "8.3.4",
-      "resolved": "https://registry.npmjs.org/@types/uuid/-/uuid-8.3.4.tgz",
-      "integrity": "sha512-c/I8ZRb51j+pYGAu5CrFMRxqZ2ke4y2grEBO5AUjgSkSk+qT2Ea+OdWElz/OiMf5MNpn2b17kuVBwZLQJXzihw==",
+      "version": "16.18.112",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-16.18.112.tgz",
+      "integrity": "sha512-EKrbKUGJROm17+dY/gMi31aJlGLJ75e1IkTojt9n6u+hnaTBDs+M1bIdOawpk2m6YUAXq/R2W0SxCng1tndHCg==",
       "dev": true
     },
     "node_modules/tunnel": {
@@ -58,14 +50,6 @@
       "engines": {
         "node": ">=0.6.11 <=0.7.0 || >=0.7.3"
       }
-    },
-    "node_modules/uuid": {
-      "version": "8.3.2",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-8.3.2.tgz",
-      "integrity": "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==",
-      "bin": {
-        "uuid": "dist/bin/uuid"
-      }
     }
   },
   "dependencies": {
@@ -91,26 +75,15 @@
       "integrity": "sha512-wi9JjgKLYS7U/z8PPbco+PvTb/nRWjeoFlJ1Qer83k/3C5PHQi28hiVdeE2kHXmIL99mQFawx8qt/JPjZilJ8Q=="
     },
     "@types/node": {
-      "version": "12.0.2",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-12.0.2.tgz",
-      "integrity": "sha512-5tabW/i+9mhrfEOUcLDu2xBPsHJ+X5Orqy9FKpale3SjDA17j5AEpYq5vfy3oAeAHGcvANRCO3NV3d2D6q3NiA==",
-      "dev": true
-    },
-    "@types/uuid": {
-      "version": "8.3.4",
-      "resolved": "https://registry.npmjs.org/@types/uuid/-/uuid-8.3.4.tgz",
-      "integrity": "sha512-c/I8ZRb51j+pYGAu5CrFMRxqZ2ke4y2grEBO5AUjgSkSk+qT2Ea+OdWElz/OiMf5MNpn2b17kuVBwZLQJXzihw==",
+      "version": "16.18.112",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-16.18.112.tgz",
+      "integrity": "sha512-EKrbKUGJROm17+dY/gMi31aJlGLJ75e1IkTojt9n6u+hnaTBDs+M1bIdOawpk2m6YUAXq/R2W0SxCng1tndHCg==",
       "dev": true
     },
     "tunnel": {
       "version": "0.0.6",
       "resolved": "https://registry.npmjs.org/tunnel/-/tunnel-0.0.6.tgz",
       "integrity": "sha512-1h/Lnq9yajKY2PEbBadPXj3VxsDDu844OnaAo52UVmIzIvwwtBPIuNvkjuzBlTWpfJyUbG3ez0KSBibQkj4ojg=="
-    },
-    "uuid": {
-      "version": "8.3.2",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-8.3.2.tgz",
-      "integrity": "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg=="
     }
   }
 }

packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actions/core",
-  "version": "1.10.1",
+  "version": "1.11.1",
   "description": "Actions core lib",
   "keywords": [
     "github",
@@ -37,11 +37,9 @@
   },
   "dependencies": {
     "@actions/exec": "^1.1.1",
-    "@actions/http-client": "^2.0.1",
-    "uuid": "^8.3.2"
+    "@actions/http-client": "^2.0.1"
   },
   "devDependencies": {
-    "@types/node": "^12.0.2",
-    "@types/uuid": "^8.3.4"
+    "@types/node": "^16.18.112"
   }
 }

packages/core/src/file-command.ts

@@ -3,9 +3,9 @@
 // We use any as a valid input type
 /* eslint-disable @typescript-eslint/no-explicit-any */
 
+import * as crypto from 'crypto'
 import * as fs from 'fs'
 import * as os from 'os'
-import {v4 as uuidv4} from 'uuid'
 import {toCommandValue} from './utils'
 
 export function issueFileCommand(command: string, message: any): void {
@@ -25,7 +25,7 @@ export function issueFileCommand(command: string, message: any): void {
 }
 
 export function prepareKeyValueMessage(key: string, value: any): string {
-  const delimiter = `ghadelimiter_${uuidv4()}`
+  const delimiter = `ghadelimiter_${crypto.randomUUID()}`
   const convertedValue = toCommandValue(value)
 
   // These should realistically never happen, but just in case someone finds a

packages/glob/RELEASES.md

@@ -1,5 +1,8 @@
 # @actions/glob Releases
 
+### 0.5.0
+- Added `excludeHiddenFiles` option, which is disabled by default to preserve existing behavior [#1791: Add glob option to ignore hidden files](https://github.com/actions/toolkit/pull/1791)
+
 ### 0.4.0
 - Pass in the current workspace as a parameter to HashFiles [#1318](https://github.com/actions/toolkit/pull/1318)
 

packages/glob/__tests__/internal-globber.test.ts

@@ -708,7 +708,7 @@ describe('globber', () => {
     expect(itemPaths).toEqual([])
   })
 
-  it('returns hidden files', async () => {
+  it('returns hidden files by default', async () => {
     // Create the following layout:
     //   <root>
     //   <root>/.emptyFolder
@@ -734,6 +734,26 @@ describe('globber', () => {
     ])
   })
 
+  it('ignores hidden files when excludeHiddenFiles is set', async () => {
+    // Create the following layout:
+    //   <root>
+    //   <root>/.emptyFolder
+    //   <root>/.file
+    //   <root>/.folder
+    //   <root>/.folder/file
+    const root = path.join(getTestTemp(), 'ignores-hidden-files')
+    await createHiddenDirectory(path.join(root, '.emptyFolder'))
+    await createHiddenDirectory(path.join(root, '.folder'))
+    await createHiddenFile(path.join(root, '.file'), 'test .file content')
+    await fs.writeFile(
+      path.join(root, '.folder', 'file'),
+      'test .folder/file content'
+    )
+
+    const itemPaths = await glob(root, {excludeHiddenFiles: true})
+    expect(itemPaths).toEqual([root])
+  })
+
   it('returns normalized paths', async () => {
     // Create the following layout:
     //   <root>/hello/world.txt

packages/glob/package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "@actions/glob",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "lockfileVersion": 3,
   "requires": true,
   "description": "Actions glob lib",
@@ -21,7 +21,7 @@
   "packages": {
     "": {
       "name": "@actions/glob",
-      "version": "0.4.0",
+      "version": "0.5.0",
       "license": "MIT",
       "dependencies": {
         "@actions/core": "^1.9.1",

packages/glob/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actions/glob",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "preview": true,
   "description": "Actions glob lib",
   "keywords": [

packages/glob/src/internal-glob-options-helper.ts

@@ -9,7 +9,8 @@ export function getOptions(copy?: GlobOptions): GlobOptions {
     followSymbolicLinks: true,
     implicitDescendants: true,
     matchDirectories: true,
-    omitBrokenSymbolicLinks: true
+    omitBrokenSymbolicLinks: true,
+    excludeHiddenFiles: false
   }
 
   if (copy) {
@@ -32,6 +33,11 @@ export function getOptions(copy?: GlobOptions): GlobOptions {
       result.omitBrokenSymbolicLinks = copy.omitBrokenSymbolicLinks
       core.debug(`omitBrokenSymbolicLinks '${result.omitBrokenSymbolicLinks}'`)
     }
+
+    if (typeof copy.excludeHiddenFiles === 'boolean') {
+      result.excludeHiddenFiles = copy.excludeHiddenFiles
+      core.debug(`excludeHiddenFiles '${result.excludeHiddenFiles}'`)
+    }
   }
 
   return result

packages/glob/src/internal-glob-options.ts

@@ -36,4 +36,13 @@ export interface GlobOptions {
    * @default true
    */
   omitBrokenSymbolicLinks?: boolean
+
+  /**
+   * Indicates whether to exclude hidden files (files and directories starting with a `.`).
+   * This does not apply to Windows files and directories with the hidden attribute unless
+   * they are also prefixed with a `.`.
+   *
+   * @default false
+   */
+  excludeHiddenFiles?: boolean
 }

packages/glob/src/internal-globber.ts

@@ -128,6 +128,11 @@ export class DefaultGlobber implements Globber {
         continue
       }
 
+      // Hidden file or directory?
+      if (options.excludeHiddenFiles && path.basename(item.path).match(/^\./)) {
+        continue
+      }
+
       // Directory
       if (stats.isDirectory()) {
         // Matched

packages/http-client/RELEASES.md

@@ -1,5 +1,14 @@
 ## Releases
 
+## 2.2.3
+- Fixed an issue where proxy username and password were not handled correctly [#1799](https://github.com/actions/toolkit/pull/1799)
+
+## 2.2.2
+- Better handling of url encoded usernames and passwords in proxy config [#1782](https://github.com/actions/toolkit/pull/1782)
+
+## 2.2.1
+- Make sure RequestOptions.keepAlive is applied properly on node20 runtime [#1572](https://github.com/actions/toolkit/pull/1572)
+
 ## 2.2.0
 - Add function to return proxy agent dispatcher for compatibility with latest octokit packages [#1547](https://github.com/actions/toolkit/pull/1547)
 

packages/http-client/__tests__/basics.test.ts

@@ -37,7 +37,7 @@ describe('basics', () => {
   //       "user-agent": "typed-test-client-tests"
   //     },
   //     "origin": "173.95.152.44",
-  //     "url": "https://postman-echo.com/get"
+  //     "url": "http://postman-echo.com/get"
   //  }
 
   it('does basic http get request', async () => {
@@ -63,16 +63,17 @@ describe('basics', () => {
     expect(obj.headers['user-agent']).toBeFalsy()
   })
 
+  /* TODO write a mock rather then relying on a third party
   it('does basic https get request', async () => {
     const res: httpm.HttpClientResponse = await _http.get(
-      'https://postman-echo.com/get'
+      'http://postman-echo.com/get'
     )
     expect(res.message.statusCode).toBe(200)
     const body: string = await res.readBody()
     const obj = JSON.parse(body)
-    expect(obj.url).toBe('https://postman-echo.com/get')
+    expect(obj.url).toBe('http://postman-echo.com/get')
   })
-
+*/
   it('does basic http get request with default headers', async () => {
     const http: httpm.HttpClient = new httpm.HttpClient(
       'http-client-tests',
@@ -125,12 +126,12 @@ describe('basics', () => {
   it('pipes a get request', async () => {
     return new Promise<void>(async resolve => {
       const file = fs.createWriteStream(sampleFilePath)
-      ;(await _http.get('https://postman-echo.com/get')).message
+      ;(await _http.get('http://postman-echo.com/get')).message
         .pipe(file)
         .on('close', () => {
           const body: string = fs.readFileSync(sampleFilePath).toString()
           const obj = JSON.parse(body)
-          expect(obj.url).toBe('https://postman-echo.com/get')
+          expect(obj.url).toBe('http://postman-echo.com/get')
           resolve()
         })
     })
@@ -138,32 +139,32 @@ describe('basics', () => {
 
   it('does basic get request with redirects', async () => {
     const res: httpm.HttpClientResponse = await _http.get(
-      `https://postman-echo.com/redirect-to?url=${encodeURIComponent(
-        'https://postman-echo.com/get'
+      `http://postman-echo.com/redirect-to?url=${encodeURIComponent(
+        'http://postman-echo.com/get'
       )}`
     )
     expect(res.message.statusCode).toBe(200)
     const body: string = await res.readBody()
     const obj = JSON.parse(body)
-    expect(obj.url).toBe('https://postman-echo.com/get')
+    expect(obj.url).toBe('http://postman-echo.com/get')
   })
 
   it('does basic get request with redirects (303)', async () => {
     const res: httpm.HttpClientResponse = await _http.get(
-      `https://postman-echo.com/redirect-to?url=${encodeURIComponent(
-        'https://postman-echo.com/get'
+      `http://postman-echo.com/redirect-to?url=${encodeURIComponent(
+        'http://postman-echo.com/get'
       )}&status_code=303`
     )
     expect(res.message.statusCode).toBe(200)
     const body: string = await res.readBody()
     const obj = JSON.parse(body)
-    expect(obj.url).toBe('https://postman-echo.com/get')
+    expect(obj.url).toBe('http://postman-echo.com/get')
   })
 
   it('returns 404 for not found get request on redirect', async () => {
     const res: httpm.HttpClientResponse = await _http.get(
-      `https://postman-echo.com/redirect-to?url=${encodeURIComponent(
-        'https://postman-echo.com/status/404'
+      `http://postman-echo.com/redirect-to?url=${encodeURIComponent(
+        'http://postman-echo.com/status/404'
       )}&status_code=303`
     )
     expect(res.message.statusCode).toBe(404)
@@ -177,8 +178,8 @@ describe('basics', () => {
       {allowRedirects: false}
     )
     const res: httpm.HttpClientResponse = await http.get(
-      `https://postman-echo.com/redirect-to?url=${encodeURIComponent(
-        'https://postman-echo.com/get'
+      `http://postman-echo.com/redirect-to?url=${encodeURIComponent(
+        'http://postman-echo.com/get'
       )}`
     )
     expect(res.message.statusCode).toBe(302)
@@ -191,8 +192,8 @@ describe('basics', () => {
       authorization: 'shhh'
     }
     const res: httpm.HttpClientResponse = await _http.get(
-      `https://postman-echo.com/redirect-to?url=${encodeURIComponent(
-        'https://www.postman-echo.com/get'
+      `http://postman-echo.com/redirect-to?url=${encodeURIComponent(
+        'http://www.postman-echo.com/get'
       )}`,
       headers
     )
@@ -204,7 +205,7 @@ describe('basics', () => {
     expect(obj.headers[httpm.Headers.Accept]).toBe('application/json')
     expect(obj.headers['Authorization']).toBeUndefined()
     expect(obj.headers['authorization']).toBeUndefined()
-    expect(obj.url).toBe('https://www.postman-echo.com/get')
+    expect(obj.url).toBe('http://www.postman-echo.com/get')
   })
 
   it('does not pass Auth with diff hostname redirects', async () => {
@@ -213,8 +214,8 @@ describe('basics', () => {
       Authorization: 'shhh'
     }
     const res: httpm.HttpClientResponse = await _http.get(
-      `https://postman-echo.com/redirect-to?url=${encodeURIComponent(
-        'https://www.postman-echo.com/get'
+      `http://postman-echo.com/redirect-to?url=${encodeURIComponent(
+        'http://www.postman-echo.com/get'
       )}`,
       headers
     )
@@ -226,7 +227,7 @@ describe('basics', () => {
     expect(obj.headers[httpm.Headers.Accept]).toBe('application/json')
     expect(obj.headers['Authorization']).toBeUndefined()
     expect(obj.headers['authorization']).toBeUndefined()
-    expect(obj.url).toBe('https://www.postman-echo.com/get')
+    expect(obj.url).toBe('http://www.postman-echo.com/get')
   })
 
   it('does basic head request', async () => {
@@ -289,11 +290,11 @@ describe('basics', () => {
 
   it('gets a json object', async () => {
     const jsonObj = await _http.getJson<HttpBinData>(
-      'https://postman-echo.com/get'
+      'http://postman-echo.com/get'
     )
     expect(jsonObj.statusCode).toBe(200)
     expect(jsonObj.result).toBeDefined()
-    expect(jsonObj.result?.url).toBe('https://postman-echo.com/get')
+    expect(jsonObj.result?.url).toBe('http://postman-echo.com/get')
     expect(jsonObj.result?.headers[httpm.Headers.Accept]).toBe(
       httpm.MediaTypes.ApplicationJson
     )
@@ -304,7 +305,7 @@ describe('basics', () => {
 
   it('getting a non existent json object returns null', async () => {
     const jsonObj = await _http.getJson<HttpBinData>(
-      'https://postman-echo.com/status/404'
+      'http://postman-echo.com/status/404'
     )
     expect(jsonObj.statusCode).toBe(404)
     expect(jsonObj.result).toBeNull()
@@ -313,12 +314,12 @@ describe('basics', () => {
   it('posts a json object', async () => {
     const res = {name: 'foo'}
     const restRes = await _http.postJson<HttpBinData>(
-      'https://postman-echo.com/post',
+      'http://postman-echo.com/post',
       res
     )
     expect(restRes.statusCode).toBe(200)
     expect(restRes.result).toBeDefined()
-    expect(restRes.result?.url).toBe('https://postman-echo.com/post')
+    expect(restRes.result?.url).toBe('http://postman-echo.com/post')
     expect(restRes.result?.json.name).toBe('foo')
     expect(restRes.result?.headers[httpm.Headers.Accept]).toBe(
       httpm.MediaTypes.ApplicationJson
@@ -334,12 +335,12 @@ describe('basics', () => {
   it('puts a json object', async () => {
     const res = {name: 'foo'}
     const restRes = await _http.putJson<HttpBinData>(
-      'https://postman-echo.com/put',
+      'http://postman-echo.com/put',
       res
     )
     expect(restRes.statusCode).toBe(200)
     expect(restRes.result).toBeDefined()
-    expect(restRes.result?.url).toBe('https://postman-echo.com/put')
+    expect(restRes.result?.url).toBe('http://postman-echo.com/put')
     expect(restRes.result?.json.name).toBe('foo')
 
     expect(restRes.result?.headers[httpm.Headers.Accept]).toBe(
@@ -356,12 +357,12 @@ describe('basics', () => {
   it('patch a json object', async () => {
     const res = {name: 'foo'}
     const restRes = await _http.patchJson<HttpBinData>(
-      'https://postman-echo.com/patch',
+      'http://postman-echo.com/patch',
       res
     )
     expect(restRes.statusCode).toBe(200)
     expect(restRes.result).toBeDefined()
-    expect(restRes.result?.url).toBe('https://postman-echo.com/patch')
+    expect(restRes.result?.url).toBe('http://postman-echo.com/patch')
     expect(restRes.result?.json.name).toBe('foo')
     expect(restRes.result?.headers[httpm.Headers.Accept]).toBe(
       httpm.MediaTypes.ApplicationJson

packages/http-client/__tests__/headers.test.ts

@@ -12,7 +12,7 @@ describe('headers', () => {
   it('preserves existing headers on getJson', async () => {
     const additionalHeaders = {[httpm.Headers.Accept]: 'foo'}
     let jsonObj = await _http.getJson<any>(
-      'https://postman-echo.com/get',
+      'http://postman-echo.com/get',
       additionalHeaders
     )
     expect(jsonObj.result.headers[httpm.Headers.Accept]).toBe('foo')
@@ -26,7 +26,7 @@ describe('headers', () => {
         [httpm.Headers.Accept]: 'baz'
       }
     }
-    jsonObj = await httpWithHeaders.getJson<any>('https://postman-echo.com/get')
+    jsonObj = await httpWithHeaders.getJson<any>('http://postman-echo.com/get')
     expect(jsonObj.result.headers[httpm.Headers.Accept]).toBe('baz')
     expect(jsonObj.headers[httpm.Headers.ContentType]).toContain(
       httpm.MediaTypes.ApplicationJson
@@ -36,7 +36,7 @@ describe('headers', () => {
   it('preserves existing headers on postJson', async () => {
     const additionalHeaders = {[httpm.Headers.Accept]: 'foo'}
     let jsonObj = await _http.postJson<any>(
-      'https://postman-echo.com/post',
+      'http://postman-echo.com/post',
       {},
       additionalHeaders
     )
@@ -52,7 +52,7 @@ describe('headers', () => {
       }
     }
     jsonObj = await httpWithHeaders.postJson<any>(
-      'https://postman-echo.com/post',
+      'http://postman-echo.com/post',
       {}
     )
     expect(jsonObj.result.headers[httpm.Headers.Accept]).toBe('baz')
@@ -64,7 +64,7 @@ describe('headers', () => {
   it('preserves existing headers on putJson', async () => {
     const additionalHeaders = {[httpm.Headers.Accept]: 'foo'}
     let jsonObj = await _http.putJson<any>(
-      'https://postman-echo.com/put',
+      'http://postman-echo.com/put',
       {},
       additionalHeaders
     )
@@ -80,7 +80,7 @@ describe('headers', () => {
       }
     }
     jsonObj = await httpWithHeaders.putJson<any>(
-      'https://postman-echo.com/put',
+      'http://postman-echo.com/put',
       {}
     )
     expect(jsonObj.result.headers[httpm.Headers.Accept]).toBe('baz')
@@ -92,7 +92,7 @@ describe('headers', () => {
   it('preserves existing headers on patchJson', async () => {
     const additionalHeaders = {[httpm.Headers.Accept]: 'foo'}
     let jsonObj = await _http.patchJson<any>(
-      'https://postman-echo.com/patch',
+      'http://postman-echo.com/patch',
       {},
       additionalHeaders
     )
@@ -108,7 +108,7 @@ describe('headers', () => {
       }
     }
     jsonObj = await httpWithHeaders.patchJson<any>(
-      'https://postman-echo.com/patch',
+      'http://postman-echo.com/patch',
       {}
     )
     expect(jsonObj.result.headers[httpm.Headers.Accept]).toBe('baz')

packages/http-client/__tests__/proxy.test.ts

@@ -222,30 +222,33 @@ describe('proxy', () => {
     expect(_proxyConnects).toHaveLength(0)
   })
 
+  // TODO mock this out so we don't rely on a third party
+  /*
   it('HttpClient does basic https get request through proxy', async () => {
     process.env['https_proxy'] = _proxyUrl
     const httpClient = new httpm.HttpClient()
     const res: httpm.HttpClientResponse = await httpClient.get(
-      'https://postman-echo.com/get'
+      'http://postman-echo.com/get'
     )
     expect(res.message.statusCode).toBe(200)
     const body: string = await res.readBody()
     const obj = JSON.parse(body)
-    expect(obj.url).toBe('https://postman-echo.com/get')
+    expect(obj.url).toBe('http://postman-echo.com/get')
     expect(_proxyConnects).toEqual(['postman-echo.com:443'])
   })
+  */
 
-  it('HttpClient does basic https get request when bypass proxy', async () => {
-    process.env['https_proxy'] = _proxyUrl
+  it('HttpClient does basic http get request when bypass proxy', async () => {
+    process.env['http_proxy'] = _proxyUrl
     process.env['no_proxy'] = 'postman-echo.com'
     const httpClient = new httpm.HttpClient()
     const res: httpm.HttpClientResponse = await httpClient.get(
-      'https://postman-echo.com/get'
+      'http://postman-echo.com/get'
     )
     expect(res.message.statusCode).toBe(200)
     const body: string = await res.readBody()
     const obj = JSON.parse(body)
-    expect(obj.url).toBe('https://postman-echo.com/get')
+    expect(obj.url).toBe('http://postman-echo.com/get')
     expect(_proxyConnects).toHaveLength(0)
   })
 
@@ -304,6 +307,18 @@ describe('proxy', () => {
     console.log(agent)
     expect(agent instanceof ProxyAgent).toBe(true)
   })
+
+  it('proxyAuth is set in tunnel agent when authentication is provided with URIencoding', async () => {
+    process.env['https_proxy'] =
+      'http://user%40github.com:p%40ssword@127.0.0.1:8080'
+    const httpClient = new httpm.HttpClient()
+    const agent: any = httpClient.getAgent('https://some-url')
+    // eslint-disable-next-line no-console
+    console.log(agent)
+    expect(agent.proxyOptions.host).toBe('127.0.0.1')
+    expect(agent.proxyOptions.port).toBe('8080')
+    expect(agent.proxyOptions.proxyAuth).toBe('user@github.com:p@ssword')
+  })
 })
 
 function _clearVars(): void {

packages/http-client/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@actions/http-client",
-  "version": "2.2.1",
+  "version": "2.2.3",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {
     "": {
       "name": "@actions/http-client",
-      "version": "2.2.1",
+      "version": "2.2.3",
       "license": "MIT",
       "dependencies": {
         "tunnel": "^0.0.6",

packages/http-client/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actions/http-client",
-  "version": "2.2.1",
+  "version": "2.2.3",
   "description": "Actions Http Client",
   "keywords": [
     "github",

packages/http-client/src/index.ts

@@ -726,7 +726,9 @@ export class HttpClient {
       uri: proxyUrl.href,
       pipelining: !this._keepAlive ? 0 : 1,
       ...((proxyUrl.username || proxyUrl.password) && {
-        token: `${proxyUrl.username}:${proxyUrl.password}`
+        token: `Basic ${Buffer.from(
+          `${proxyUrl.username}:${proxyUrl.password}`
+        ).toString('base64')}`
       })
     })
     this._proxyAgentDispatcher = proxyAgent

packages/http-client/src/proxy.ts

@@ -15,10 +15,10 @@ export function getProxyUrl(reqUrl: URL): URL | undefined {
 
   if (proxyVar) {
     try {
-      return new URL(proxyVar)
+      return new DecodedURL(proxyVar)
     } catch {
       if (!proxyVar.startsWith('http://') && !proxyVar.startsWith('https://'))
-        return new URL(`http://${proxyVar}`)
+        return new DecodedURL(`http://${proxyVar}`)
     }
   } else {
     return undefined
@@ -87,3 +87,22 @@ function isLoopbackAddress(host: string): boolean {
     hostLower.startsWith('[0:0:0:0:0:0:0:1]')
   )
 }
+
+class DecodedURL extends URL {
+  private _decodedUsername: string
+  private _decodedPassword: string
+
+  constructor(url: string | URL, base?: string | URL) {
+    super(url, base)
+    this._decodedUsername = decodeURIComponent(super.username)
+    this._decodedPassword = decodeURIComponent(super.password)
+  }
+
+  get username(): string {
+    return this._decodedUsername
+  }
+
+  get password(): string {
+    return this._decodedPassword
+  }
+}

packages/tool-cache/RELEASES.md

@@ -1,5 +1,8 @@
 # @actions/tool-cache Releases
 
+### Unreleased
+- Remove dependency on `uuid` package [#1824](https://github.com/actions/toolkit/pull/1824), [#1842](https://github.com/actions/toolkit/pull/1842)
+
 ### 2.0.1
 - Update to v2.0.1 of `@actions/http-client` [#1087](https://github.com/actions/toolkit/pull/1087)
 

packages/tool-cache/package-lock.json

@@ -13,13 +13,11 @@
         "@actions/exec": "^1.0.0",
         "@actions/http-client": "^2.0.1",
         "@actions/io": "^1.1.1",
-        "semver": "^6.1.0",
-        "uuid": "^3.3.2"
+        "semver": "^6.1.0"
       },
       "devDependencies": {
         "@types/nock": "^11.1.0",
         "@types/semver": "^6.0.0",
-        "@types/uuid": "^3.4.4",
         "nock": "^13.2.9"
       }
     },
@@ -71,27 +69,12 @@
         "nock": "*"
       }
     },
-    "node_modules/@types/node": {
-      "version": "12.7.0",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-12.7.0.tgz",
-      "integrity": "sha512-vqcj1MVm2Sla4PpMfYKh1MyDN4D2f/mPIZD7RdAGqEsbE+JxfeqQHHVbRDQ0Nqn8i73gJa1HQ1Pu3+nH4Q0Yiw==",
-      "dev": true
-    },
     "node_modules/@types/semver": {
       "version": "6.0.1",
       "resolved": "https://registry.npmjs.org/@types/semver/-/semver-6.0.1.tgz",
       "integrity": "sha512-ffCdcrEE5h8DqVxinQjo+2d1q+FV5z7iNtPofw3JsrltSoSVlOGaW0rY8XxtO9XukdTn8TaCGWmk2VFGhI70mg==",
       "dev": true
     },
-    "node_modules/@types/uuid": {
-      "version": "3.4.5",
-      "resolved": "https://registry.npmjs.org/@types/uuid/-/uuid-3.4.5.tgz",
-      "integrity": "sha512-MNL15wC3EKyw1VLF+RoVO4hJJdk9t/Hlv3rt1OL65Qvuadm4BYo6g9ZJQqoq7X8NBFSsQXgAujWciovh2lpVjA==",
-      "dev": true,
-      "dependencies": {
-        "@types/node": "*"
-      }
-    },
     "node_modules/debug": {
       "version": "4.3.4",
       "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.4.tgz",
@@ -166,15 +149,6 @@
       "engines": {
         "node": ">=0.6.11 <=0.7.0 || >=0.7.3"
       }
-    },
-    "node_modules/uuid": {
-      "version": "3.3.2",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-3.3.2.tgz",
-      "integrity": "sha512-yXJmeNaw3DnnKAOKJE51sL/ZaYfWJRl1pK9dr19YFCu0ObS231AB1/LbqTKRAQ5kw8A90rA6fr4riOUpTZvQZA==",
-      "deprecated": "Please upgrade  to version 7 or higher.  Older versions may use Math.random() in certain circumstances, which is known to be problematic.  See https://v8.dev/blog/math-random for details.",
-      "bin": {
-        "uuid": "bin/uuid"
-      }
     }
   },
   "dependencies": {
@@ -224,27 +198,12 @@
         "nock": "*"
       }
     },
-    "@types/node": {
-      "version": "12.7.0",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-12.7.0.tgz",
-      "integrity": "sha512-vqcj1MVm2Sla4PpMfYKh1MyDN4D2f/mPIZD7RdAGqEsbE+JxfeqQHHVbRDQ0Nqn8i73gJa1HQ1Pu3+nH4Q0Yiw==",
-      "dev": true
-    },
     "@types/semver": {
       "version": "6.0.1",
       "resolved": "https://registry.npmjs.org/@types/semver/-/semver-6.0.1.tgz",
       "integrity": "sha512-ffCdcrEE5h8DqVxinQjo+2d1q+FV5z7iNtPofw3JsrltSoSVlOGaW0rY8XxtO9XukdTn8TaCGWmk2VFGhI70mg==",
       "dev": true
     },
-    "@types/uuid": {
-      "version": "3.4.5",
-      "resolved": "https://registry.npmjs.org/@types/uuid/-/uuid-3.4.5.tgz",
-      "integrity": "sha512-MNL15wC3EKyw1VLF+RoVO4hJJdk9t/Hlv3rt1OL65Qvuadm4BYo6g9ZJQqoq7X8NBFSsQXgAujWciovh2lpVjA==",
-      "dev": true,
-      "requires": {
-        "@types/node": "*"
-      }
-    },
     "debug": {
       "version": "4.3.4",
       "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.4.tgz",
@@ -299,11 +258,6 @@
       "version": "0.0.6",
       "resolved": "https://registry.npmjs.org/tunnel/-/tunnel-0.0.6.tgz",
       "integrity": "sha512-1h/Lnq9yajKY2PEbBadPXj3VxsDDu844OnaAo52UVmIzIvwwtBPIuNvkjuzBlTWpfJyUbG3ez0KSBibQkj4ojg=="
-    },
-    "uuid": {
-      "version": "3.3.2",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-3.3.2.tgz",
-      "integrity": "sha512-yXJmeNaw3DnnKAOKJE51sL/ZaYfWJRl1pK9dr19YFCu0ObS231AB1/LbqTKRAQ5kw8A90rA6fr4riOUpTZvQZA=="
     }
   }
 }

packages/tool-cache/package.json

@@ -40,13 +40,11 @@
     "@actions/exec": "^1.0.0",
     "@actions/http-client": "^2.0.1",
     "@actions/io": "^1.1.1",
-    "semver": "^6.1.0",
-    "uuid": "^3.3.2"
+    "semver": "^6.1.0"
   },
   "devDependencies": {
     "@types/nock": "^11.1.0",
     "@types/semver": "^6.0.0",
-    "@types/uuid": "^3.4.4",
     "nock": "^13.2.9"
   }
 }

packages/tool-cache/src/tool-cache.ts

@@ -1,5 +1,6 @@
 import * as core from '@actions/core'
 import * as io from '@actions/io'
+import * as crypto from 'crypto'
 import * as fs from 'fs'
 import * as mm from './manifest'
 import * as os from 'os'
@@ -10,7 +11,6 @@ import * as stream from 'stream'
 import * as util from 'util'
 import {ok} from 'assert'
 import {OutgoingHttpHeaders} from 'http'
-import uuidV4 from 'uuid/v4'
 import {exec} from '@actions/exec/lib/exec'
 import {ExecOptions} from '@actions/exec/lib/interfaces'
 import {RetryHelper} from './retry-helper'
@@ -41,7 +41,7 @@ export async function downloadTool(
   auth?: string,
   headers?: OutgoingHttpHeaders
 ): Promise<string> {
-  dest = dest || path.join(_getTempDirectory(), uuidV4())
+  dest = dest || path.join(_getTempDirectory(), crypto.randomUUID())
   await io.mkdirP(path.dirname(dest))
   core.debug(`Downloading ${url}`)
   core.debug(`Destination ${dest}`)
@@ -651,7 +651,7 @@ export async function findFromManifest(
 async function _createExtractFolder(dest?: string): Promise<string> {
   if (!dest) {
     // create a temp dir
-    dest = path.join(_getTempDirectory(), uuidV4())
+    dest = path.join(_getTempDirectory(), crypto.randomUUID())
   }
   await io.mkdirP(dest)
   return dest