chore: fix linting issues

- Remove unused eslint-disable directives for @typescript-eslint/no-var-requires
chore: convert to ESLint flat config
2026-01-30 09:29:43 -05:00 · 2026-01-30 09:29:32 -05:00 · 2026-01-30 09:29:23 -05:00
20 changed files with 672 additions and 1013 deletions
@@ -1,5 +0,0 @@
 node_modules/
 packages/*/node_modules/
 packages/*/lib/
 packages/glob/__tests__/_temp
 packages/*/src/generated/*/
@@ -1,107 +0,0 @@
 {
  "plugins": [
    "jest",
    "@typescript-eslint",
    "prettier"
  ],
  "extends": [
    "plugin:github/recommended",
    "plugin:prettier/recommended"
  ],
  "parser": "@typescript-eslint/parser",
  "parserOptions": {
    "ecmaVersion": 9,
    "sourceType": "module",
    "project": "./tsconfig.eslint.json"
  },
  "rules": {
    "prettier/prettier": [
      "error",
      {
        "endOfLine": "auto"
      }
    ],
    "eslint-comments/no-use": "off",
    "no-constant-condition": ["error", { "checkLoops": false }],
    "github/no-then": "off",
    "import/no-namespace": "off",
    "no-shadow": "off",
    "no-unused-vars": "off",
    "i18n-text/no-en": "off",
    "filenames/match-regex": "off",
    "import/no-commonjs": "off",
    "import/named": "off",
    "no-sequences": "off",
    "import/no-unresolved": "off",
    "no-undef": "off",
    "no-only-tests/no-only-tests": "off",
    "@typescript-eslint/no-unused-vars": "error",
    "@typescript-eslint/explicit-member-accessibility": [
      "error",
      {
        "accessibility": "no-public"
      }
    ],
    "@typescript-eslint/no-require-imports": "error",
    "@typescript-eslint/array-type": "error",
    "@typescript-eslint/await-thenable": "error",
    "@typescript-eslint/ban-ts-comment": "error",
    "camelcase": "off",
    "@typescript-eslint/camelcase": "off",
    "@typescript-eslint/consistent-type-assertions": "off",
    "@typescript-eslint/explicit-function-return-type": [
      "error",
      {
        "allowExpressions": true
      }
    ],
    "@typescript-eslint/func-call-spacing": [
      "error",
      "never"
    ],
    "@typescript-eslint/naming-convention": [
      "error",
      {
        "format": null,
        "filter": {
          // you can expand this regex as you find more cases that require quoting that you want to allow
          "regex": "^[A-Z][A-Za-z]*$",
          "match": true
        },
        "selector": "memberLike"
      }
    ],
    "@typescript-eslint/no-array-constructor": "error",
    "@typescript-eslint/no-empty-interface": "error",
    "@typescript-eslint/no-explicit-any": "error",
    "@typescript-eslint/no-extraneous-class": "error",
    "@typescript-eslint/no-for-in-array": "error",
    "@typescript-eslint/no-inferrable-types": "error",
    "@typescript-eslint/no-misused-new": "error",
    "@typescript-eslint/no-namespace": "error",
    "@typescript-eslint/no-non-null-assertion": "warn",
    "@typescript-eslint/no-unnecessary-qualifier": "error",
    "@typescript-eslint/no-unnecessary-type-assertion": "error",
    "@typescript-eslint/no-useless-constructor": "error",
    "@typescript-eslint/no-var-requires": "error",
    "@typescript-eslint/prefer-for-of": "warn",
    "@typescript-eslint/prefer-function-type": "warn",
    "@typescript-eslint/prefer-includes": "error",
    "@typescript-eslint/prefer-string-starts-ends-with": "error",
    "@typescript-eslint/promise-function-async": "error",
    "@typescript-eslint/require-array-sort-compare": "error",
    "semi": "off",
    "@typescript-eslint/semi": [
      "error",
      "never"
    ],
    "@typescript-eslint/type-annotation-spacing": "error",
    "@typescript-eslint/unbound-method": "error"
  },
  "ignorePatterns": "packages/glob/__tests__/_temp/**/",
  "env": {
    "node": true,
    "es6": true,
    "jest/globals": true
  }
 }
@@ -24,7 +24,7 @@ on:
 jobs:
  test:
-    runs-on: ubuntu-latest
+    runs-on: macos-latest-large
    steps:
      - name: setup repo
@@ -61,7 +61,7 @@ jobs:
          path: packages/${{ github.event.inputs.package }}/*.tgz
  publish:
-    runs-on: ubuntu-slim
+    runs-on: macos-latest-large
    needs: test
    environment: npm-publish
    permissions:
@@ -0,0 +1,118 @@
 import github from 'eslint-plugin-github'
 import jest from 'eslint-plugin-jest'
 import prettier from 'eslint-plugin-prettier/recommended'
 const githubConfigs = github.getFlatConfigs()
 export default [
  {
    ignores: [
      '**/node_modules/**',
      '**/lib/**',
      '**/dist/**',
      'packages/glob/__tests__/_temp/**',
      '**/generated/**'
    ]
  },
  githubConfigs.recommended,
  ...githubConfigs.typescript,
  prettier,
  {
    files: ['**/*.ts'],
    languageOptions: {
      parserOptions: {
        project: './tsconfig.eslint.json'
      }
    },
    rules: {
      // Prettier
      'prettier/prettier': ['error', {endOfLine: 'auto'}],
      // Disable rules that conflict with project style
      'eslint-comments/no-use': 'off',
      'github/no-then': 'off',
      'github/filenames-match-regex': 'off',
      'import/no-namespace': 'off',
      'import/no-commonjs': 'off',
      'import/named': 'off',
      'import/no-unresolved': 'off',
      'i18n-text/no-en': 'off',
      'filenames/match-regex': 'off',
      'no-shadow': 'off',
      'no-unused-vars': 'off',
      'no-sequences': 'off',
      'no-undef': 'off',
      'no-only-tests/no-only-tests': 'off',
      'no-constant-condition': ['error', {checkLoops: false}],
      camelcase: 'off',
      // Disable stricter rules from eslint-plugin-github v6
      '@typescript-eslint/no-shadow': 'off',
      '@typescript-eslint/array-type': 'off',
      '@typescript-eslint/no-wrapper-object-types': 'off',
      '@typescript-eslint/no-unsafe-function-type': 'off',
      // TypeScript rules
      '@typescript-eslint/no-unused-vars': 'off',
      '@typescript-eslint/explicit-member-accessibility': [
        'error',
        {accessibility: 'no-public'}
      ],
      '@typescript-eslint/no-require-imports': 'error',
      '@typescript-eslint/await-thenable': 'error',
      '@typescript-eslint/ban-ts-comment': 'error',
      '@typescript-eslint/consistent-type-assertions': 'off',
      '@typescript-eslint/explicit-function-return-type': [
        'error',
        {allowExpressions: true}
      ],
      '@typescript-eslint/naming-convention': [
        'error',
        {
          format: null,
          filter: {
            regex: '^[A-Z][A-Za-z]*$',
            match: true
          },
          selector: 'memberLike'
        }
      ],
      '@typescript-eslint/no-array-constructor': 'error',
      '@typescript-eslint/no-empty-object-type': 'error',
      '@typescript-eslint/no-explicit-any': 'error',
      '@typescript-eslint/no-extraneous-class': 'error',
      '@typescript-eslint/no-for-in-array': 'error',
      '@typescript-eslint/no-inferrable-types': 'error',
      '@typescript-eslint/no-misused-new': 'error',
      '@typescript-eslint/no-namespace': 'error',
      '@typescript-eslint/no-non-null-assertion': 'warn',
      '@typescript-eslint/no-unnecessary-qualifier': 'error',
      '@typescript-eslint/no-unnecessary-type-assertion': 'error',
      '@typescript-eslint/no-useless-constructor': 'error',
      '@typescript-eslint/prefer-for-of': 'warn',
      '@typescript-eslint/prefer-function-type': 'warn',
      '@typescript-eslint/prefer-includes': 'error',
      '@typescript-eslint/prefer-string-starts-ends-with': 'error',
      '@typescript-eslint/promise-function-async': 'error',
      '@typescript-eslint/require-array-sort-compare': 'error',
      '@typescript-eslint/unbound-method': 'error'
    }
  },
  {
    files: ['**/__tests__/**/*.ts'],
    ...jest.configs['flat/recommended'],
    rules: {
      ...jest.configs['flat/recommended'].rules,
      'jest/expect-expect': 'off',
      'jest/no-conditional-expect': 'off',
      'jest/no-standalone-expect': 'off',
      'jest/no-alias-methods': 'off',
      'jest/valid-expect': 'off',
      'jest/no-export': 'off',
      'jest/no-done-callback': 'off',
      'jest/no-jasmine-globals': 'off',
      'jest/no-identical-title': 'off',
      'jest/no-commented-out-tests': 'off'
    }
  }
 ]
@@ -20,10 +20,10 @@
    "@types/node": "^24.1.0",
    "@types/signale": "^1.4.1",
    "concurrently": "^6.1.0",
-    "eslint": "^8.0.1",
+    "eslint": "^9.39.2",
-    "eslint-config-prettier": "^8.9.0",
+    "eslint-config-prettier": "^10.1.8",
-    "eslint-plugin-github": "^4.9.2",
+    "eslint-plugin-github": "^6.0.0",
-    "eslint-plugin-jest": "^27.2.3",
+    "eslint-plugin-jest": "^29.12.1",
    "eslint-plugin-prettier": "^5.0.0",
    "flow-bin": "^0.115.0",
    "jest": "^29.6.4",
@@ -1,14 +1,5 @@
 # @actions/artifact Releases
 ## 6.1.0
 - Support downloading non-zip artifacts. Zipped artifacts will be decompressed automatically (with an optional override). Un-zipped artifacts will be downloaded as-is.
 ## 6.0.0
 - **Breaking change**: Package is now ESM-only
  - CommonJS consumers must use dynamic `import()` instead of `require()`
 ## 5.0.3
 - Bump `@actions/http-client` to `3.0.2`
@@ -104,7 +104,6 @@ const cleanup = async (): Promise<void> => {
 const mockGetArtifactSuccess = jest.fn(() => {
  const message = new http.IncomingMessage(new net.Socket())
  message.statusCode = 200
  message.headers['content-type'] = 'application/zip'
  message.push(fs.readFileSync(fixtures.exampleArtifact.path))
  message.push(null)
  return {
@@ -115,7 +114,6 @@ const mockGetArtifactSuccess = jest.fn(() => {
 const mockGetArtifactHung = jest.fn(() => {
  const message = new http.IncomingMessage(new net.Socket())
  message.statusCode = 200
  message.headers['content-type'] = 'application/zip'
  // Don't push any data or call push(null) to end the stream
  // This creates a stream that hangs and never completes
  return {
@@ -136,7 +134,6 @@ const mockGetArtifactFailure = jest.fn(() => {
 const mockGetArtifactMalicious = jest.fn(() => {
  const message = new http.IncomingMessage(new net.Socket())
  message.statusCode = 200
  message.headers['content-type'] = 'application/zip'
  message.push(fs.readFileSync(path.join(__dirname, 'fixtures', 'evil.zip'))) // evil.zip contains files that are formatted x/../../etc/hosts
  message.push(null)
  return {
@@ -622,17 +619,10 @@ describe('download-artifact', () => {
        ...fixtures.backendIds,
        name: fixtures.artifactName
      })
-    }, 38000)
+    })
  })
  describe('streamExtractExternal', () => {
    beforeEach(async () => {
      await setup()
      // Create workspace directory for streamExtractExternal tests
      await fs.promises.mkdir(fixtures.workspaceDir, {recursive: true})
    })
    afterEach(cleanup)
    it('should fail if the timeout is exceeded', async () => {
      const mockSlowGetArtifact = jest.fn(mockGetArtifactHung)
@@ -651,331 +641,12 @@ describe('download-artifact', () => {
          {timeout: 2}
        )
        expect(true).toBe(false) // should not be called
-      } catch (error: unknown) {
+      } catch (e) {
        const e = error as Error
        expect(e).toBeInstanceOf(Error)
        expect(e.message).toContain('did not respond in 2ms')
        expect(mockHttpClient).toHaveBeenCalledWith(getUserAgentString())
        expect(mockSlowGetArtifact).toHaveBeenCalledTimes(1)
      }
    })
    it('should extract zip file when content-type is application/zip', async () => {
      const mockHttpClient = (HttpClient as jest.Mock).mockImplementation(
        () => {
          return {
            get: mockGetArtifactSuccess
          }
        }
      )
      await streamExtractExternal(
        fixtures.blobStorageUrl,
        fixtures.workspaceDir
      )
      expect(mockHttpClient).toHaveBeenCalledWith(getUserAgentString())
      // Verify files were extracted (not saved as a single file)
      await expectExtractedArchive(fixtures.workspaceDir)
    })
    it('should save raw file without extracting when content-type is not a zip', async () => {
      const rawFileContent = 'This is a raw text file, not a zip'
      const rawFileName = 'my-artifact.txt'
      const mockGetRawFile = jest.fn(() => {
        const message = new http.IncomingMessage(new net.Socket())
        message.statusCode = 200
        message.headers['content-type'] = 'text/plain'
        message.headers['content-disposition'] =
          `attachment; filename="${rawFileName}"`
        message.push(Buffer.from(rawFileContent))
        message.push(null)
        return {
          message
        }
      })
      const mockHttpClient = (HttpClient as jest.Mock).mockImplementation(
        () => {
          return {
            get: mockGetRawFile
          }
        }
      )
      await streamExtractExternal(
        fixtures.blobStorageUrl,
        fixtures.workspaceDir
      )
      expect(mockHttpClient).toHaveBeenCalledWith(getUserAgentString())
      // Verify file was saved as-is, not extracted
      const savedFilePath = path.join(fixtures.workspaceDir, rawFileName)
      expect(fs.existsSync(savedFilePath)).toBe(true)
      expect(fs.readFileSync(savedFilePath, 'utf8')).toBe(rawFileContent)
    })
    it('should save raw file with default name when content-disposition is missing', async () => {
      const rawFileContent = 'Binary content here'
      const mockGetRawFileNoDisposition = jest.fn(() => {
        const message = new http.IncomingMessage(new net.Socket())
        message.statusCode = 200
        message.headers['content-type'] = 'application/octet-stream'
        // No content-disposition header
        message.push(Buffer.from(rawFileContent))
        message.push(null)
        return {
          message
        }
      })
      const mockHttpClient = (HttpClient as jest.Mock).mockImplementation(
        () => {
          return {
            get: mockGetRawFileNoDisposition
          }
        }
      )
      await streamExtractExternal(
        fixtures.blobStorageUrl,
        fixtures.workspaceDir
      )
      expect(mockHttpClient).toHaveBeenCalledWith(getUserAgentString())
      // Verify file was saved with default name 'artifact'
      const savedFilePath = path.join(fixtures.workspaceDir, 'artifact')
      expect(fs.existsSync(savedFilePath)).toBe(true)
      expect(fs.readFileSync(savedFilePath, 'utf8')).toBe(rawFileContent)
    })
    it('should not attempt to unzip when content-type is image/png', async () => {
      const pngFileName = 'screenshot.png'
      // Simple PNG header bytes for testing
      const pngContent = Buffer.from([
        0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a
      ])
      const mockGetPngFile = jest.fn(() => {
        const message = new http.IncomingMessage(new net.Socket())
        message.statusCode = 200
        message.headers['content-type'] = 'image/png'
        message.headers['content-disposition'] =
          `attachment; filename="${pngFileName}"`
        message.push(pngContent)
        message.push(null)
        return {
          message
        }
      })
      const mockHttpClient = (HttpClient as jest.Mock).mockImplementation(
        () => {
          return {
            get: mockGetPngFile
          }
        }
      )
      await streamExtractExternal(
        fixtures.blobStorageUrl,
        fixtures.workspaceDir
      )
      expect(mockHttpClient).toHaveBeenCalledWith(getUserAgentString())
      // Verify PNG was saved as-is
      const savedFilePath = path.join(fixtures.workspaceDir, pngFileName)
      expect(fs.existsSync(savedFilePath)).toBe(true)
      expect(fs.readFileSync(savedFilePath)).toEqual(pngContent)
    })
    it('should extract when content-type is application/x-zip-compressed', async () => {
      const mockGetZipCompressed = jest.fn(() => {
        const message = new http.IncomingMessage(new net.Socket())
        message.statusCode = 200
        message.headers['content-type'] = 'application/x-zip-compressed'
        message.push(fs.readFileSync(fixtures.exampleArtifact.path))
        message.push(null)
        return {
          message
        }
      })
      const mockHttpClient = (HttpClient as jest.Mock).mockImplementation(
        () => {
          return {
            get: mockGetZipCompressed
          }
        }
      )
      await streamExtractExternal(
        fixtures.blobStorageUrl,
        fixtures.workspaceDir
      )
      expect(mockHttpClient).toHaveBeenCalledWith(getUserAgentString())
      // Verify files were extracted
      await expectExtractedArchive(fixtures.workspaceDir)
    })
    it('should extract zip when URL ends with .zip even if content-type is not application/zip', async () => {
      const blobUrlWithZipExtension =
        'https://blob-storage.local/artifact.zip?sig=abc123'
      const mockGetZipByUrl = jest.fn(() => {
        const message = new http.IncomingMessage(new net.Socket())
        message.statusCode = 200
        // Azure Blob Storage may return a generic content-type
        message.headers['content-type'] = 'application/octet-stream'
        message.push(fs.readFileSync(fixtures.exampleArtifact.path))
        message.push(null)
        return {
          message
        }
      })
      const mockHttpClient = (HttpClient as jest.Mock).mockImplementation(
        () => {
          return {
            get: mockGetZipByUrl
          }
        }
      )
      await streamExtractExternal(
        blobUrlWithZipExtension,
        fixtures.workspaceDir
      )
      expect(mockHttpClient).toHaveBeenCalledWith(getUserAgentString())
      // Verify files were extracted based on URL .zip extension
      await expectExtractedArchive(fixtures.workspaceDir)
    })
    it('should skip decompression when skipDecompress option is true even for zip content-type', async () => {
      const mockHttpClient = (HttpClient as jest.Mock).mockImplementation(
        () => {
          return {
            get: mockGetArtifactSuccess
          }
        }
      )
      await streamExtractExternal(
        fixtures.blobStorageUrl,
        fixtures.workspaceDir,
        {skipDecompress: true}
      )
      expect(mockHttpClient).toHaveBeenCalledWith(getUserAgentString())
      // Verify zip was saved as-is, not extracted
      // When skipDecompress is true, the file should be saved with default name 'artifact'
      const savedFilePath = path.join(fixtures.workspaceDir, 'artifact')
      expect(fs.existsSync(savedFilePath)).toBe(true)
      // The saved file should be the raw zip content
      const savedContent = fs.readFileSync(savedFilePath)
      const originalZipContent = fs.readFileSync(fixtures.exampleArtifact.path)
      expect(savedContent).toEqual(originalZipContent)
    })
    it('should sanitize path traversal attempts in Content-Disposition filename', async () => {
      const rawFileContent = 'malicious content'
      const maliciousFileName = '../../../etc/passwd'
      const mockGetMaliciousFile = jest.fn(() => {
        const message = new http.IncomingMessage(new net.Socket())
        message.statusCode = 200
        message.headers['content-type'] = 'text/plain'
        message.headers['content-disposition'] =
          `attachment; filename="${maliciousFileName}"`
        message.push(Buffer.from(rawFileContent))
        message.push(null)
        return {
          message
        }
      })
      const mockHttpClient = (HttpClient as jest.Mock).mockImplementation(
        () => {
          return {
            get: mockGetMaliciousFile
          }
        }
      )
      await streamExtractExternal(
        fixtures.blobStorageUrl,
        fixtures.workspaceDir
      )
      expect(mockHttpClient).toHaveBeenCalledWith(getUserAgentString())
      // Verify file was saved with sanitized name (just 'passwd', not the full path)
      const sanitizedFileName = 'passwd'
      const savedFilePath = path.join(fixtures.workspaceDir, sanitizedFileName)
      expect(fs.existsSync(savedFilePath)).toBe(true)
      expect(fs.readFileSync(savedFilePath, 'utf8')).toBe(rawFileContent)
      // Verify the file was NOT written outside the workspace directory
      const maliciousPath = path.resolve(
        fixtures.workspaceDir,
        maliciousFileName
      )
      expect(fs.existsSync(maliciousPath)).toBe(false)
    })
    it('should handle encoded path traversal attempts in Content-Disposition filename', async () => {
      const rawFileContent = 'encoded malicious content'
      // URL encoded version of ../../../etc/passwd
      const encodedMaliciousFileName = '..%2F..%2F..%2Fetc%2Fpasswd'
      const mockGetEncodedMaliciousFile = jest.fn(() => {
        const message = new http.IncomingMessage(new net.Socket())
        message.statusCode = 200
        message.headers['content-type'] = 'application/octet-stream'
        message.headers['content-disposition'] =
          `attachment; filename="${encodedMaliciousFileName}"`
        message.push(Buffer.from(rawFileContent))
        message.push(null)
        return {
          message
        }
      })
      const mockHttpClient = (HttpClient as jest.Mock).mockImplementation(
        () => {
          return {
            get: mockGetEncodedMaliciousFile
          }
        }
      )
      await streamExtractExternal(
        fixtures.blobStorageUrl,
        fixtures.workspaceDir
      )
      expect(mockHttpClient).toHaveBeenCalledWith(getUserAgentString())
      // After decoding and sanitizing, should just be 'passwd'
      const sanitizedFileName = 'passwd'
      const savedFilePath = path.join(fixtures.workspaceDir, sanitizedFileName)
      expect(fs.existsSync(savedFilePath)).toBe(true)
      expect(fs.readFileSync(savedFilePath, 'utf8')).toBe(rawFileContent)
      // Verify the file was NOT written outside the workspace directory
      const maliciousPathEncoded = path.resolve(
        fixtures.workspaceDir,
        encodedMaliciousFileName
      )
      expect(fs.existsSync(maliciousPathEncoded)).toBe(false)
      const maliciousPath = path.resolve(
        fixtures.workspaceDir,
        '../../../etc/passwd'
      )
      expect(fs.existsSync(maliciousPath)).toBe(false)
    })
  })
 })
@@ -1,12 +1,12 @@
 {
  "name": "@actions/artifact",
-  "version": "6.1.0",
+  "version": "6.0.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "@actions/artifact",
-      "version": "6.1.0",
+      "version": "6.0.0",
      "license": "MIT",
      "dependencies": {
        "@actions/core": "^3.0.0",
@@ -1112,9 +1112,9 @@
      "license": "MIT"
    },
    "node_modules/fast-xml-parser": {
-      "version": "5.3.4",
+      "version": "5.3.3",
-      "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.3.4.tgz",
+      "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.3.3.tgz",
-      "integrity": "sha512-EFd6afGmXlCx8H8WTZHhAoDaWaGyuIBoZJ2mknrNxug+aZKjkp0a0dlars9Izl+jF+7Gu1/5f/2h68cQpe0IiA==",
+      "integrity": "sha512-2O3dkPAAC6JavuMm8+4+pgTk+5hoAs+CjZ+sWcQLkX9+/tHRuTkQh/Oaifr8qDmZ8iEHb771Ea6G8CdwkrgvYA==",
      "funding": [
        {
          "type": "github",
@@ -1795,6 +1795,7 @@
      "version": "5.9.3",
      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
      "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
      "dev": true,
      "license": "Apache-2.0",
      "bin": {
        "tsc": "bin/tsc",
@@ -1,6 +1,6 @@
 {
  "name": "@actions/artifact",
-  "version": "6.1.0",
+  "version": "6.0.0",
  "preview": true,
  "description": "Actions artifact lib",
  "keywords": [
@@ -1,8 +1,6 @@
 import fs from 'fs/promises'
 import * as fsSync from 'fs'
 import * as crypto from 'crypto'
 import * as stream from 'stream'
 import * as path from 'path'
 import * as github from '@actions/github'
 import * as core from '@actions/core'
@@ -45,13 +43,12 @@ async function exists(path: string): Promise<boolean> {
 async function streamExtract(
  url: string,
-  directory: string,
+  directory: string
  skipDecompress?: boolean
 ): Promise<StreamExtractResponse> {
  let retryCount = 0
  while (retryCount < 5) {
    try {
-      return await streamExtractExternal(url, directory, {skipDecompress})
+      return await streamExtractExternal(url, directory)
    } catch (error) {
      retryCount++
      core.debug(
@@ -68,9 +65,8 @@ async function streamExtract(
 export async function streamExtractExternal(
  url: string,
  directory: string,
-  opts: {timeout?: number; skipDecompress?: boolean} = {}
+  opts: {timeout: number} = {timeout: 30 * 1000}
 ): Promise<StreamExtractResponse> {
  const {timeout = 30 * 1000, skipDecompress = false} = opts
  const client = new httpClient.HttpClient(getUserAgentString())
  const response = await client.get(url)
  if (response.message.statusCode !== 200) {
@@ -79,91 +75,49 @@ export async function streamExtractExternal(
    )
  }
  const contentType = response.message.headers['content-type'] || ''
  const mimeType = contentType.split(';', 1)[0].trim().toLowerCase()
  // Check if the URL path ends with .zip (ignoring query parameters)
  const urlPath = new URL(url).pathname.toLowerCase()
  const urlEndsWithZip = urlPath.endsWith('.zip')
  const isZip =
    mimeType === 'application/zip' ||
    mimeType === 'application/x-zip-compressed' ||
    mimeType === 'application/zip-compressed' ||
    urlEndsWithZip
  // Extract filename from Content-Disposition header
  const contentDisposition =
    response.message.headers['content-disposition'] || ''
  let fileName = 'artifact'
  const filenameMatch = contentDisposition.match(
    /filename\*?=['"]?(?:UTF-\d['"]*)?([^;\r\n"']*)['"]?/i
  )
  if (filenameMatch && filenameMatch[1]) {
    // Sanitize fileName to prevent path traversal attacks
    // Use path.basename to extract only the filename component
    fileName = path.basename(decodeURIComponent(filenameMatch[1].trim()))
  }
  core.debug(
    `Content-Type: ${contentType}, mimeType: ${mimeType}, urlEndsWithZip: ${urlEndsWithZip}, isZip: ${isZip}, skipDecompress: ${skipDecompress}`
  )
  core.debug(
    `Content-Disposition: ${contentDisposition}, fileName: ${fileName}`
  )
  let sha256Digest: string | undefined = undefined
  return new Promise((resolve, reject) => {
    const timerFn = (): void => {
      const timeoutError = new Error(
-        `Blob storage chunk did not respond in ${timeout}ms`
+        `Blob storage chunk did not respond in ${opts.timeout}ms`
      )
      response.message.destroy(timeoutError)
      reject(timeoutError)
    }
-    const timer = setTimeout(timerFn, timeout)
+    const timer = setTimeout(timerFn, opts.timeout)
    const onError = (error: Error): void => {
      core.debug(`response.message: Artifact download failed: ${error.message}`)
      clearTimeout(timer)
      reject(error)
    }
    const hashStream = crypto.createHash('sha256').setEncoding('hex')
    const passThrough = new stream.PassThrough()
      .on('data', () => {
        timer.refresh()
      })
      .on('error', onError)
    response.message.pipe(passThrough)
    passThrough.pipe(hashStream)
    const extractStream = passThrough
-    const onClose = (): void => {
+    extractStream
-      clearTimeout(timer)
+      .on('data', () => {
-      if (hashStream) {
+        timer.refresh()
-        hashStream.end()
+      })
-        sha256Digest = hashStream.read() as string
+      .on('error', (error: Error) => {
-        core.info(`SHA256 digest of downloaded artifact is ${sha256Digest}`)
+        core.debug(
-      }
+          `response.message: Artifact download failed: ${error.message}`
-      resolve({sha256Digest: `sha256:${sha256Digest}`})
+        )
-    }
+        clearTimeout(timer)
-
+        reject(error)
-    if (isZip && !skipDecompress) {
+      })
-      // Extract zip file
+      .pipe(unzip.Extract({path: directory}))
-      passThrough
+      .on('close', () => {
-        .pipe(unzip.Extract({path: directory}))
+        clearTimeout(timer)
-        .on('close', onClose)
+        if (hashStream) {
-        .on('error', onError)
+          hashStream.end()
-    } else {
+          sha256Digest = hashStream.read() as string
-      // Save raw file without extracting
+          core.info(`SHA256 digest of downloaded artifact is ${sha256Digest}`)
-      const filePath = path.join(directory, fileName)
+        }
-      const writeStream = fsSync.createWriteStream(filePath)
+        resolve({sha256Digest: `sha256:${sha256Digest}`})
-
+      })
-      core.info(`Downloading raw file (non-zip) to: ${filePath}`)
+      .on('error', (error: Error) => {
-      passThrough.pipe(writeStream).on('close', onClose).on('error', onError)
+        reject(error)
-    }
+      })
  })
 }
@@ -209,11 +163,7 @@ export async function downloadArtifactPublic(
  try {
    core.info(`Starting download of artifact to: ${downloadPath}`)
-    const extractResponse = await streamExtract(
+    const extractResponse = await streamExtract(location, downloadPath)
      location,
      downloadPath,
      options?.skipDecompress
    )
    core.info(`Artifact download completed successfully.`)
    if (options?.expectedHash) {
      if (options?.expectedHash !== extractResponse.sha256Digest) {
@@ -274,11 +224,7 @@ export async function downloadArtifactInternal(
  try {
    core.info(`Starting download of artifact to: ${downloadPath}`)
-    const extractResponse = await streamExtract(
+    const extractResponse = await streamExtract(signedUrl, downloadPath)
      signedUrl,
      downloadPath,
      options?.skipDecompress
    )
    core.info(`Artifact download completed successfully.`)
    if (options?.expectedHash) {
      if (options?.expectedHash !== extractResponse.sha256Digest) {
@@ -113,12 +113,6 @@ export interface DownloadArtifactOptions {
   * matches the expected hash.
   */
  expectedHash?: string
  /**
   * If true, the downloaded artifact will not be automatically extracted/decompressed.
   * The artifact will be saved as-is to the destination path.
   */
  skipDecompress?: boolean
 }
 export interface StreamExtractResponse {
@@ -1,9 +1,5 @@
 # @actions/attest Releases
 ## 3.1.0
 - Add support for `ACTIONS_ORCHESTRATION_ID` in user-agent [#2320](https://github.com/actions/toolkit/pull/2320)
 ## 3.0.0
 - **Breaking change**: Package is now ESM-only
@@ -1,6 +1,6 @@
 {
  "name": "@actions/attest",
-  "version": "3.1.0",
+  "version": "3.0.0",
  "description": "Actions attestation lib",
  "keywords": [
    "github",
@@ -36,7 +36,7 @@
  },
  "scripts": {
    "test": "echo \"Error: run tests from root\" && exit 1",
-    "tsc": "tsc && cp src/package-version.cjs lib/"
+    "tsc": "tsc"
  },
  "bugs": {
    "url": "https://github.com/actions/toolkit/issues"
@@ -1,7 +0,0 @@
 // This file exists as a CommonJS module to read the version from package.json.
 // In an ESM package, using `require()` directly in .ts files requires disabling
 // ESLint rules and doesn't work reliably across all Node.js versions.
 // By keeping this as a .cjs file, we can use require() naturally and export
 // the version for the ESM modules to import.
 const packageJson = require('../package.json')
 module.exports = {version: packageJson.version}
@@ -1,7 +1,6 @@
 import * as github from '@actions/github'
 import {retry} from '@octokit/plugin-retry'
 import {RequestHeaders} from '@octokit/types'
 import {version} from './package-version.cjs'
 const CREATE_ATTESTATION_REQUEST = 'POST /repos/{owner}/{repo}/attestations'
 const DEFAULT_RETRY_COUNT = 5
@@ -25,16 +24,11 @@ export const writeAttestation = async (
  const retries = options.retry ?? DEFAULT_RETRY_COUNT
  const octokit = github.getOctokit(token, {retry: {retries}}, retry)
  const headers = {
    'User-Agent': getUserAgent(),
    ...options.headers
  }
  try {
    const response = await octokit.request(CREATE_ATTESTATION_REQUEST, {
      owner: github.context.repo.owner,
      repo: github.context.repo.repo,
-      headers,
+      headers: options.headers,
      bundle: attestation as {
        mediaType?: string
        verificationMaterial?: {[key: string]: unknown}
@@ -52,17 +46,3 @@ export const writeAttestation = async (
    throw new Error(`Failed to persist attestation: ${message}`)
  }
 }
 const getUserAgent = (): string => {
  const baseUserAgent = `@actions/attest-${version}`
  const orchId = process.env['ACTIONS_ORCHESTRATION_ID']
  if (orchId) {
    // Sanitize the orchestration ID to ensure it contains only valid characters
    // Valid characters: 0-9, a-z, _, -, .
    const sanitizedId = orchId.replace(/[^a-z0-9_.-]/gi, '_')
    return `${baseUserAgent} actions_orchestration_id/${sanitizedId}`
  }
  return baseUserAgent
 }
@@ -677,8 +677,5 @@ describe('oidc-client-tests', () => {
    const http = new HttpClient('actions/oidc-client')
    const res = await http.get(getTokenEndPoint())
    expect(res.message.statusCode).toBe(200)
    // Consume the response to close the socket
    await res.readBody()
    res.message.destroy()
  })
 })
@@ -238,8 +238,6 @@ describe('basics', () => {
      'https://postman-echo.com/get'
    )
    expect(res.message.statusCode).toBe(200)
    // Consume the response to close the socket
    res.message.destroy()
  })
  it('does basic http delete request', async () => {
@@ -4,7 +4,7 @@ import * as http from 'http'
 import * as httpm from '../lib/'
 import * as pm from '../lib/proxy'
 import {ProxyAgent} from 'undici'
-// eslint-disable-next-line @typescript-eslint/no-var-requires, @typescript-eslint/no-require-imports
+// eslint-disable-next-line @typescript-eslint/no-require-imports
 const proxy = require('proxy')
 let _proxyConnects: string[]
@@ -14,7 +14,7 @@ const repo = 'some-tool'
 const fakeToken = 'notrealtoken'
 // just loading data and require handles BOMs etc.
-// eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-var-requires
+// eslint-disable-next-line @typescript-eslint/no-require-imports
 const manifestData = require('./data/versions-manifest.json')
 describe('@actions/tool-cache-manifest', () => {