Downgrade nock since it's conflicting with @actions/attest's version

.github/workflows/cache-tests.yml

@@ -55,8 +55,10 @@ jobs:
       shell: bash
       run: packages/cache/__tests__/create-cache-files.sh ${{ runner.os }} ~/test-cache
 
+    # We're using node -e to call the functions directly available in the @actions/cache package
     - name: Save cache using saveCache()
-      run: node packages/cache/__tests__/save-cache.mjs ${{ runner.os }} ${{ github.run_id }}
+      run: |
+        node -e "Promise.resolve(require('./packages/cache/lib/cache').saveCache(['test-cache','~/test-cache'],'test-${{ runner.os }}-${{ github.run_id }}'))"
 
     - name: Delete cache folders before restoring
       shell: bash
@@ -65,7 +67,8 @@ jobs:
         rm -rf ~/test-cache
 
     - name: Restore cache using restoreCache() with http-client
-      run: node packages/cache/__tests__/restore-cache.mjs ${{ runner.os }} ${{ github.run_id }} false
+      run: |
+        node -e "Promise.resolve(require('./packages/cache/lib/cache').restoreCache(['test-cache','~/test-cache'],'test-${{ runner.os }}-${{ github.run_id }}',[],{useAzureSdk: false}))"
 
     - name: Verify cache restored with http-client
       shell: bash
@@ -80,7 +83,8 @@ jobs:
         rm -rf ~/test-cache
 
     - name: Restore cache using restoreCache() with Azure SDK
-      run: node packages/cache/__tests__/restore-cache.mjs ${{ runner.os }} ${{ github.run_id }} true
+      run: |
+        node -e "Promise.resolve(require('./packages/cache/lib/cache').restoreCache(['test-cache','~/test-cache'],'test-${{ runner.os }}-${{ github.run_id }}'))"
 
     - name: Verify cache restored with Azure SDK
       shell: bash

.github/workflows/cache-windows-test.yml

@@ -52,8 +52,10 @@ jobs:
       shell: bash
       run: packages/cache/__tests__/create-cache-files.sh ${{ runner.os }} ~/test-cache
 
+    # We're using node -e to call the functions directly available in the @actions/cache package
     - name: Save cache using saveCache()
-      run: node packages/cache/__tests__/save-cache.mjs ${{ runner.os }} ${{ github.run_id }}
+      run: |
+        node -e "Promise.resolve(require('./packages/cache/lib/cache').saveCache(['test-cache','~/test-cache'],'test-${{ runner.os }}-${{ github.run_id }}'))"
 
     - name: Delete cache folders before restoring
       shell: bash
@@ -62,7 +64,8 @@ jobs:
         rm -rf ~/test-cache
 
     - name: Restore cache using restoreCache() with http-client
-      run: node packages/cache/__tests__/restore-cache.mjs ${{ runner.os }} ${{ github.run_id }} false
+      run: |
+        node -e "Promise.resolve(require('./packages/cache/lib/cache').restoreCache(['test-cache','~/test-cache'],'test-${{ runner.os }}-${{ github.run_id }}',[],{useAzureSdk: false}))"
 
     - name: Verify cache restored with http-client
       shell: bash
@@ -77,7 +80,8 @@ jobs:
         rm -rf ~/test-cache
 
     - name: Restore cache using restoreCache() with Azure SDK
-      run: node packages/cache/__tests__/restore-cache.mjs ${{ runner.os }} ${{ github.run_id }} true
+      run: |
+        node -e "Promise.resolve(require('./packages/cache/lib/cache').restoreCache(['test-cache','~/test-cache'],'test-${{ runner.os }}-${{ github.run_id }}'))"
 
     - name: Verify cache restored with Azure SDK
       shell: bash

.github/workflows/releases.yml

@@ -24,7 +24,7 @@ on:
 
 jobs:
   test:
-    runs-on: ubuntu-latest
+    runs-on: macos-latest-large
 
     steps:
       - name: setup repo
@@ -61,7 +61,7 @@ jobs:
           path: packages/${{ github.event.inputs.package }}/*.tgz
 
   publish:
-    runs-on: ubuntu-slim
+    runs-on: macos-latest-large
     needs: test
     environment: npm-publish
     permissions:

jest.config.js

@@ -16,9 +16,7 @@ module.exports = {
     '^@actions/github$': '<rootDir>/packages/github/lib/github.js',
     '^@actions/github/lib/utils$': '<rootDir>/packages/github/lib/utils.js',
     '^@actions/glob$': '<rootDir>/packages/glob/lib/glob.js',
-    '^@actions/tool-cache$': '<rootDir>/packages/tool-cache/lib/tool-cache.js',
+    '^@actions/tool-cache$': '<rootDir>/packages/tool-cache/lib/tool-cache.js'
-    '^@actions/cache$': '<rootDir>/packages/cache/lib/cache.js',
-    '^@actions/attest$': '<rootDir>/packages/attest/lib/index.js'
   },
   transform: {
     '^.+\\.(ts|js)$': ['ts-jest', {
@@ -32,7 +30,7 @@ module.exports = {
     }]
   },
   transformIgnorePatterns: [
-    '/node_modules/(?!(@octokit|@actions/github|@actions/http-client|@actions/io|@actions/exec|@actions/core|@actions/glob|@actions/tool-cache|@actions/cache|@actions/attest|universal-user-agent|before-after-hook)/)'
+    '/node_modules/(?!(@octokit|@actions/github|@actions/http-client|@actions/io|@actions/exec|@actions/core|@actions/glob|@actions/tool-cache|universal-user-agent|before-after-hook)/)'
   ],
   verbose: true
 }

packages/artifact/RELEASES.md

@@ -1,14 +1,5 @@
 # @actions/artifact Releases
 
-## 6.1.0
-
-- Support downloading non-zip artifacts. Zipped artifacts will be decompressed automatically (with an optional override). Un-zipped artifacts will be downloaded as-is.
-
-## 6.0.0
-
-- **Breaking change**: Package is now ESM-only
-  - CommonJS consumers must use dynamic `import()` instead of `require()`
-
 ## 5.0.3
 
 - Bump `@actions/http-client` to `3.0.2`

packages/artifact/__tests__/download-artifact.test.ts

@@ -104,7 +104,6 @@ const cleanup = async (): Promise<void> => {
 const mockGetArtifactSuccess = jest.fn(() => {
   const message = new http.IncomingMessage(new net.Socket())
   message.statusCode = 200
-  message.headers['content-type'] = 'application/zip'
   message.push(fs.readFileSync(fixtures.exampleArtifact.path))
   message.push(null)
   return {
@@ -115,7 +114,6 @@ const mockGetArtifactSuccess = jest.fn(() => {
 const mockGetArtifactHung = jest.fn(() => {
   const message = new http.IncomingMessage(new net.Socket())
   message.statusCode = 200
-  message.headers['content-type'] = 'application/zip'
   // Don't push any data or call push(null) to end the stream
   // This creates a stream that hangs and never completes
   return {
@@ -136,7 +134,6 @@ const mockGetArtifactFailure = jest.fn(() => {
 const mockGetArtifactMalicious = jest.fn(() => {
   const message = new http.IncomingMessage(new net.Socket())
   message.statusCode = 200
-  message.headers['content-type'] = 'application/zip'
   message.push(fs.readFileSync(path.join(__dirname, 'fixtures', 'evil.zip'))) // evil.zip contains files that are formatted x/../../etc/hosts
   message.push(null)
   return {
@@ -622,17 +619,10 @@ describe('download-artifact', () => {
         ...fixtures.backendIds,
         name: fixtures.artifactName
       })
-    }, 38000)
+    })
   })
 
   describe('streamExtractExternal', () => {
-    beforeEach(async () => {
-      await setup()
-      // Create workspace directory for streamExtractExternal tests
-      await fs.promises.mkdir(fixtures.workspaceDir, {recursive: true})
-    })
-    afterEach(cleanup)
-
     it('should fail if the timeout is exceeded', async () => {
       const mockSlowGetArtifact = jest.fn(mockGetArtifactHung)
 
@@ -651,331 +641,12 @@ describe('download-artifact', () => {
           {timeout: 2}
         )
         expect(true).toBe(false) // should not be called
-      } catch (error: unknown) {
+      } catch (e) {
-        const e = error as Error
         expect(e).toBeInstanceOf(Error)
         expect(e.message).toContain('did not respond in 2ms')
         expect(mockHttpClient).toHaveBeenCalledWith(getUserAgentString())
         expect(mockSlowGetArtifact).toHaveBeenCalledTimes(1)
       }
     })
-
-    it('should extract zip file when content-type is application/zip', async () => {
-      const mockHttpClient = (HttpClient as jest.Mock).mockImplementation(
-        () => {
-          return {
-            get: mockGetArtifactSuccess
-          }
-        }
-      )
-
-      await streamExtractExternal(
-        fixtures.blobStorageUrl,
-        fixtures.workspaceDir
-      )
-
-      expect(mockHttpClient).toHaveBeenCalledWith(getUserAgentString())
-      // Verify files were extracted (not saved as a single file)
-      await expectExtractedArchive(fixtures.workspaceDir)
-    })
-
-    it('should save raw file without extracting when content-type is not a zip', async () => {
-      const rawFileContent = 'This is a raw text file, not a zip'
-      const rawFileName = 'my-artifact.txt'
-
-      const mockGetRawFile = jest.fn(() => {
-        const message = new http.IncomingMessage(new net.Socket())
-        message.statusCode = 200
-        message.headers['content-type'] = 'text/plain'
-        message.headers['content-disposition'] =
-          `attachment; filename="${rawFileName}"`
-        message.push(Buffer.from(rawFileContent))
-        message.push(null)
-        return {
-          message
-        }
-      })
-
-      const mockHttpClient = (HttpClient as jest.Mock).mockImplementation(
-        () => {
-          return {
-            get: mockGetRawFile
-          }
-        }
-      )
-
-      await streamExtractExternal(
-        fixtures.blobStorageUrl,
-        fixtures.workspaceDir
-      )
-
-      expect(mockHttpClient).toHaveBeenCalledWith(getUserAgentString())
-      // Verify file was saved as-is, not extracted
-      const savedFilePath = path.join(fixtures.workspaceDir, rawFileName)
-      expect(fs.existsSync(savedFilePath)).toBe(true)
-      expect(fs.readFileSync(savedFilePath, 'utf8')).toBe(rawFileContent)
-    })
-
-    it('should save raw file with default name when content-disposition is missing', async () => {
-      const rawFileContent = 'Binary content here'
-
-      const mockGetRawFileNoDisposition = jest.fn(() => {
-        const message = new http.IncomingMessage(new net.Socket())
-        message.statusCode = 200
-        message.headers['content-type'] = 'application/octet-stream'
-        // No content-disposition header
-        message.push(Buffer.from(rawFileContent))
-        message.push(null)
-        return {
-          message
-        }
-      })
-
-      const mockHttpClient = (HttpClient as jest.Mock).mockImplementation(
-        () => {
-          return {
-            get: mockGetRawFileNoDisposition
-          }
-        }
-      )
-
-      await streamExtractExternal(
-        fixtures.blobStorageUrl,
-        fixtures.workspaceDir
-      )
-
-      expect(mockHttpClient).toHaveBeenCalledWith(getUserAgentString())
-      // Verify file was saved with default name 'artifact'
-      const savedFilePath = path.join(fixtures.workspaceDir, 'artifact')
-      expect(fs.existsSync(savedFilePath)).toBe(true)
-      expect(fs.readFileSync(savedFilePath, 'utf8')).toBe(rawFileContent)
-    })
-
-    it('should not attempt to unzip when content-type is image/png', async () => {
-      const pngFileName = 'screenshot.png'
-      // Simple PNG header bytes for testing
-      const pngContent = Buffer.from([
-        0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a
-      ])
-
-      const mockGetPngFile = jest.fn(() => {
-        const message = new http.IncomingMessage(new net.Socket())
-        message.statusCode = 200
-        message.headers['content-type'] = 'image/png'
-        message.headers['content-disposition'] =
-          `attachment; filename="${pngFileName}"`
-        message.push(pngContent)
-        message.push(null)
-        return {
-          message
-        }
-      })
-
-      const mockHttpClient = (HttpClient as jest.Mock).mockImplementation(
-        () => {
-          return {
-            get: mockGetPngFile
-          }
-        }
-      )
-
-      await streamExtractExternal(
-        fixtures.blobStorageUrl,
-        fixtures.workspaceDir
-      )
-
-      expect(mockHttpClient).toHaveBeenCalledWith(getUserAgentString())
-      // Verify PNG was saved as-is
-      const savedFilePath = path.join(fixtures.workspaceDir, pngFileName)
-      expect(fs.existsSync(savedFilePath)).toBe(true)
-      expect(fs.readFileSync(savedFilePath)).toEqual(pngContent)
-    })
-
-    it('should extract when content-type is application/x-zip-compressed', async () => {
-      const mockGetZipCompressed = jest.fn(() => {
-        const message = new http.IncomingMessage(new net.Socket())
-        message.statusCode = 200
-        message.headers['content-type'] = 'application/x-zip-compressed'
-        message.push(fs.readFileSync(fixtures.exampleArtifact.path))
-        message.push(null)
-        return {
-          message
-        }
-      })
-
-      const mockHttpClient = (HttpClient as jest.Mock).mockImplementation(
-        () => {
-          return {
-            get: mockGetZipCompressed
-          }
-        }
-      )
-
-      await streamExtractExternal(
-        fixtures.blobStorageUrl,
-        fixtures.workspaceDir
-      )
-
-      expect(mockHttpClient).toHaveBeenCalledWith(getUserAgentString())
-      // Verify files were extracted
-      await expectExtractedArchive(fixtures.workspaceDir)
-    })
-
-    it('should extract zip when URL ends with .zip even if content-type is not application/zip', async () => {
-      const blobUrlWithZipExtension =
-        'https://blob-storage.local/artifact.zip?sig=abc123'
-
-      const mockGetZipByUrl = jest.fn(() => {
-        const message = new http.IncomingMessage(new net.Socket())
-        message.statusCode = 200
-        // Azure Blob Storage may return a generic content-type
-        message.headers['content-type'] = 'application/octet-stream'
-        message.push(fs.readFileSync(fixtures.exampleArtifact.path))
-        message.push(null)
-        return {
-          message
-        }
-      })
-
-      const mockHttpClient = (HttpClient as jest.Mock).mockImplementation(
-        () => {
-          return {
-            get: mockGetZipByUrl
-          }
-        }
-      )
-
-      await streamExtractExternal(
-        blobUrlWithZipExtension,
-        fixtures.workspaceDir
-      )
-
-      expect(mockHttpClient).toHaveBeenCalledWith(getUserAgentString())
-      // Verify files were extracted based on URL .zip extension
-      await expectExtractedArchive(fixtures.workspaceDir)
-    })
-
-    it('should skip decompression when skipDecompress option is true even for zip content-type', async () => {
-      const mockHttpClient = (HttpClient as jest.Mock).mockImplementation(
-        () => {
-          return {
-            get: mockGetArtifactSuccess
-          }
-        }
-      )
-
-      await streamExtractExternal(
-        fixtures.blobStorageUrl,
-        fixtures.workspaceDir,
-        {skipDecompress: true}
-      )
-
-      expect(mockHttpClient).toHaveBeenCalledWith(getUserAgentString())
-      // Verify zip was saved as-is, not extracted
-      // When skipDecompress is true, the file should be saved with default name 'artifact'
-      const savedFilePath = path.join(fixtures.workspaceDir, 'artifact')
-      expect(fs.existsSync(savedFilePath)).toBe(true)
-      // The saved file should be the raw zip content
-      const savedContent = fs.readFileSync(savedFilePath)
-      const originalZipContent = fs.readFileSync(fixtures.exampleArtifact.path)
-      expect(savedContent).toEqual(originalZipContent)
-    })
-
-    it('should sanitize path traversal attempts in Content-Disposition filename', async () => {
-      const rawFileContent = 'malicious content'
-      const maliciousFileName = '../../../etc/passwd'
-
-      const mockGetMaliciousFile = jest.fn(() => {
-        const message = new http.IncomingMessage(new net.Socket())
-        message.statusCode = 200
-        message.headers['content-type'] = 'text/plain'
-        message.headers['content-disposition'] =
-          `attachment; filename="${maliciousFileName}"`
-        message.push(Buffer.from(rawFileContent))
-        message.push(null)
-        return {
-          message
-        }
-      })
-
-      const mockHttpClient = (HttpClient as jest.Mock).mockImplementation(
-        () => {
-          return {
-            get: mockGetMaliciousFile
-          }
-        }
-      )
-
-      await streamExtractExternal(
-        fixtures.blobStorageUrl,
-        fixtures.workspaceDir
-      )
-
-      expect(mockHttpClient).toHaveBeenCalledWith(getUserAgentString())
-      // Verify file was saved with sanitized name (just 'passwd', not the full path)
-      const sanitizedFileName = 'passwd'
-      const savedFilePath = path.join(fixtures.workspaceDir, sanitizedFileName)
-      expect(fs.existsSync(savedFilePath)).toBe(true)
-      expect(fs.readFileSync(savedFilePath, 'utf8')).toBe(rawFileContent)
-
-      // Verify the file was NOT written outside the workspace directory
-      const maliciousPath = path.resolve(
-        fixtures.workspaceDir,
-        maliciousFileName
-      )
-      expect(fs.existsSync(maliciousPath)).toBe(false)
-    })
-
-    it('should handle encoded path traversal attempts in Content-Disposition filename', async () => {
-      const rawFileContent = 'encoded malicious content'
-      // URL encoded version of ../../../etc/passwd
-      const encodedMaliciousFileName = '..%2F..%2F..%2Fetc%2Fpasswd'
-
-      const mockGetEncodedMaliciousFile = jest.fn(() => {
-        const message = new http.IncomingMessage(new net.Socket())
-        message.statusCode = 200
-        message.headers['content-type'] = 'application/octet-stream'
-        message.headers['content-disposition'] =
-          `attachment; filename="${encodedMaliciousFileName}"`
-        message.push(Buffer.from(rawFileContent))
-        message.push(null)
-        return {
-          message
-        }
-      })
-
-      const mockHttpClient = (HttpClient as jest.Mock).mockImplementation(
-        () => {
-          return {
-            get: mockGetEncodedMaliciousFile
-          }
-        }
-      )
-
-      await streamExtractExternal(
-        fixtures.blobStorageUrl,
-        fixtures.workspaceDir
-      )
-
-      expect(mockHttpClient).toHaveBeenCalledWith(getUserAgentString())
-      // After decoding and sanitizing, should just be 'passwd'
-      const sanitizedFileName = 'passwd'
-      const savedFilePath = path.join(fixtures.workspaceDir, sanitizedFileName)
-      expect(fs.existsSync(savedFilePath)).toBe(true)
-      expect(fs.readFileSync(savedFilePath, 'utf8')).toBe(rawFileContent)
-
-      // Verify the file was NOT written outside the workspace directory
-      const maliciousPathEncoded = path.resolve(
-        fixtures.workspaceDir,
-        encodedMaliciousFileName
-      )
-      expect(fs.existsSync(maliciousPathEncoded)).toBe(false)
-
-      const maliciousPath = path.resolve(
-        fixtures.workspaceDir,
-        '../../../etc/passwd'
-      )
-      expect(fs.existsSync(maliciousPath)).toBe(false)
-    })
   })
 })

packages/artifact/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@actions/artifact",
-  "version": "6.1.0",
+  "version": "6.0.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@actions/artifact",
-      "version": "6.1.0",
+      "version": "6.0.0",
       "license": "MIT",
       "dependencies": {
         "@actions/core": "^3.0.0",
@@ -1795,6 +1795,7 @@
       "version": "5.9.3",
       "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz",
       "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
+      "dev": true,
       "license": "Apache-2.0",
       "bin": {
         "tsc": "bin/tsc",

packages/artifact/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actions/artifact",
-  "version": "6.1.0",
+  "version": "6.0.0",
   "preview": true,
   "description": "Actions artifact lib",
   "keywords": [

packages/artifact/src/internal/download/download-artifact.ts

@@ -1,8 +1,6 @@
 import fs from 'fs/promises'
-import * as fsSync from 'fs'
 import * as crypto from 'crypto'
 import * as stream from 'stream'
-import * as path from 'path'
 
 import * as github from '@actions/github'
 import * as core from '@actions/core'
@@ -45,13 +43,12 @@ async function exists(path: string): Promise<boolean> {
 
 async function streamExtract(
   url: string,
-  directory: string,
+  directory: string
-  skipDecompress?: boolean
 ): Promise<StreamExtractResponse> {
   let retryCount = 0
   while (retryCount < 5) {
     try {
-      return await streamExtractExternal(url, directory, {skipDecompress})
+      return await streamExtractExternal(url, directory)
     } catch (error) {
       retryCount++
       core.debug(
@@ -68,9 +65,8 @@ async function streamExtract(
 export async function streamExtractExternal(
   url: string,
   directory: string,
-  opts: {timeout?: number; skipDecompress?: boolean} = {}
+  opts: {timeout: number} = {timeout: 30 * 1000}
 ): Promise<StreamExtractResponse> {
-  const {timeout = 30 * 1000, skipDecompress = false} = opts
   const client = new httpClient.HttpClient(getUserAgentString())
   const response = await client.get(url)
   if (response.message.statusCode !== 200) {
@@ -79,91 +75,49 @@ export async function streamExtractExternal(
     )
   }
 
-  const contentType = response.message.headers['content-type'] || ''
-  const mimeType = contentType.split(';', 1)[0].trim().toLowerCase()
-
-  // Check if the URL path ends with .zip (ignoring query parameters)
-  const urlPath = new URL(url).pathname.toLowerCase()
-  const urlEndsWithZip = urlPath.endsWith('.zip')
-
-  const isZip =
-    mimeType === 'application/zip' ||
-    mimeType === 'application/x-zip-compressed' ||
-    mimeType === 'application/zip-compressed' ||
-    urlEndsWithZip
-
-  // Extract filename from Content-Disposition header
-  const contentDisposition =
-    response.message.headers['content-disposition'] || ''
-  let fileName = 'artifact'
-  const filenameMatch = contentDisposition.match(
-    /filename\*?=['"]?(?:UTF-\d['"]*)?([^;\r\n"']*)['"]?/i
-  )
-  if (filenameMatch && filenameMatch[1]) {
-    // Sanitize fileName to prevent path traversal attacks
-    // Use path.basename to extract only the filename component
-    fileName = path.basename(decodeURIComponent(filenameMatch[1].trim()))
-  }
-
-  core.debug(
-    `Content-Type: ${contentType}, mimeType: ${mimeType}, urlEndsWithZip: ${urlEndsWithZip}, isZip: ${isZip}, skipDecompress: ${skipDecompress}`
-  )
-  core.debug(
-    `Content-Disposition: ${contentDisposition}, fileName: ${fileName}`
-  )
-
   let sha256Digest: string | undefined = undefined
 
   return new Promise((resolve, reject) => {
     const timerFn = (): void => {
       const timeoutError = new Error(
-        `Blob storage chunk did not respond in ${timeout}ms`
+        `Blob storage chunk did not respond in ${opts.timeout}ms`
       )
       response.message.destroy(timeoutError)
       reject(timeoutError)
     }
-    const timer = setTimeout(timerFn, timeout)
+    const timer = setTimeout(timerFn, opts.timeout)
-
-    const onError = (error: Error): void => {
-      core.debug(`response.message: Artifact download failed: ${error.message}`)
-      clearTimeout(timer)
-      reject(error)
-    }
 
     const hashStream = crypto.createHash('sha256').setEncoding('hex')
     const passThrough = new stream.PassThrough()
-      .on('data', () => {
-        timer.refresh()
-      })
-      .on('error', onError)
 
     response.message.pipe(passThrough)
     passThrough.pipe(hashStream)
+    const extractStream = passThrough
 
-    const onClose = (): void => {
+    extractStream
-      clearTimeout(timer)
+      .on('data', () => {
-      if (hashStream) {
+        timer.refresh()
-        hashStream.end()
+      })
-        sha256Digest = hashStream.read() as string
+      .on('error', (error: Error) => {
-        core.info(`SHA256 digest of downloaded artifact is ${sha256Digest}`)
+        core.debug(
-      }
+          `response.message: Artifact download failed: ${error.message}`
-      resolve({sha256Digest: `sha256:${sha256Digest}`})
+        )
-    }
+        clearTimeout(timer)
-
+        reject(error)
-    if (isZip && !skipDecompress) {
+      })
-      // Extract zip file
+      .pipe(unzip.Extract({path: directory}))
-      passThrough
+      .on('close', () => {
-        .pipe(unzip.Extract({path: directory}))
+        clearTimeout(timer)
-        .on('close', onClose)
+        if (hashStream) {
-        .on('error', onError)
+          hashStream.end()
-    } else {
+          sha256Digest = hashStream.read() as string
-      // Save raw file without extracting
+          core.info(`SHA256 digest of downloaded artifact is ${sha256Digest}`)
-      const filePath = path.join(directory, fileName)
+        }
-      const writeStream = fsSync.createWriteStream(filePath)
+        resolve({sha256Digest: `sha256:${sha256Digest}`})
-
+      })
-      core.info(`Downloading raw file (non-zip) to: ${filePath}`)
+      .on('error', (error: Error) => {
-      passThrough.pipe(writeStream).on('close', onClose).on('error', onError)
+        reject(error)
-    }
+      })
   })
 }
 
@@ -209,11 +163,7 @@ export async function downloadArtifactPublic(
 
   try {
     core.info(`Starting download of artifact to: ${downloadPath}`)
-    const extractResponse = await streamExtract(
+    const extractResponse = await streamExtract(location, downloadPath)
-      location,
-      downloadPath,
-      options?.skipDecompress
-    )
     core.info(`Artifact download completed successfully.`)
     if (options?.expectedHash) {
       if (options?.expectedHash !== extractResponse.sha256Digest) {
@@ -274,11 +224,7 @@ export async function downloadArtifactInternal(
 
   try {
     core.info(`Starting download of artifact to: ${downloadPath}`)
-    const extractResponse = await streamExtract(
+    const extractResponse = await streamExtract(signedUrl, downloadPath)
-      signedUrl,
-      downloadPath,
-      options?.skipDecompress
-    )
     core.info(`Artifact download completed successfully.`)
     if (options?.expectedHash) {
       if (options?.expectedHash !== extractResponse.sha256Digest) {

packages/artifact/src/internal/shared/interfaces.ts

@@ -113,12 +113,6 @@ export interface DownloadArtifactOptions {
    * matches the expected hash.
    */
   expectedHash?: string
-
-  /**
-   * If true, the downloaded artifact will not be automatically extracted/decompressed.
-   * The artifact will be saved as-is to the destination path.
-   */
-  skipDecompress?: boolean
 }
 
 export interface StreamExtractResponse {

packages/attest/RELEASES.md

@@ -1,35 +1,28 @@
 # @actions/attest Releases
 
-## 3.0.0
+### 2.2.1
-
-- **Breaking change**: Package is now ESM-only
-  - CommonJS consumers must use dynamic `import()` instead of `require()`
-- Bump `@actions/core` to `^3.0.0`
-- Bump `@actions/http-client` to `^4.0.0`
-
-## 2.2.1
 
 - Bump `@actions/http-client` to `3.0.2`
 - Bump `undici` to `6.23.0`
 
-## 2.2.0
+### 2.2.0
 
 - Bump @actions/core from 1.11.1 to 2.0.2
 - Bump @actions/github from 6.0.0 to 7.0.0
 - Bump @actions/http-client from 2.2.3 to 3.0.1
 
-## 2.0.0
+### 2.0.0
 
 - Add support for Node 24 [#2110](https://github.com/actions/toolkit/pull/2110)
 - Bump @sigstore/bundle from 3.0.0 to 3.1.0
 - Bump @sigstore/sign from 3.0.0 to 3.1.0
 - Bump jose from 5.2.3 to 5.10.0
 
-## 1.6.0
+### 1.6.0
 
 - Update `buildSLSAProvenancePredicate` to populate `workflow.ref` field from the `ref` claim in the OIDC token [#1969](https://github.com/actions/toolkit/pull/1969)
 
-## 1.5.0
+### 1.5.0
 
 - Bump @actions/core from 1.10.1 to 1.11.1 [#1847](https://github.com/actions/toolkit/pull/1847)
 - Bump @sigstore/bundle from 2.3.2 to 3.0.0 [#1846](https://github.com/actions/toolkit/pull/1846)
@@ -37,24 +30,23 @@
 - Support for generating multi-subject attestations [#1864](https://github.com/actions/toolkit/pull/1865)
 - Fix bug in `buildSLSAProvenancePredicate` related to `workflow_ref` OIDC token claims containing the "@" symbol in the tag name [#1863](https://github.com/actions/toolkit/pull/1863)
 
-## 1.4.2
+### 1.4.2
 
 - Fix bug in `buildSLSAProvenancePredicate`/`attestProvenance` when generating provenance statement for enterprise account using customized OIDC issuer value [#1823](https://github.com/actions/toolkit/pull/1823)
 
-## 1.4.1
+### 1.4.1
 
 - Bump @actions/http-client from 2.2.1 to 2.2.3 [#1805](https://github.com/actions/toolkit/pull/1805)
 
-## 1.4.0
+### 1.4.0
 
 - Add new `headers` parameter to the `attest` and `attestProvenance` functions [#1790](https://github.com/actions/toolkit/pull/1790)
 - Update `buildSLSAProvenancePredicate`/`attestProvenance` to automatically derive default OIDC issuer URL from current execution context [#1796](https://github.com/actions/toolkit/pull/1796)
-
+### 1.3.1
-## 1.3.1
 
 - Fix bug with proxy support when retrieving JWKS for OIDC issuer [#1776](https://github.com/actions/toolkit/pull/1776)
 
-## 1.3.0
+### 1.3.0
 
 - Dynamic construction of Sigstore API URLs [#1735](https://github.com/actions/toolkit/pull/1735)
 - Switch to new GH provenance build type [#1745](https://github.com/actions/toolkit/pull/1745)
@@ -62,21 +54,21 @@
 - Bump @sigstore/bundle from 2.3.0 to 2.3.2 [#1738](https://github.com/actions/toolkit/pull/1738)
 - Bump @sigstore/sign from 2.3.0 to 2.3.2 [#1738](https://github.com/actions/toolkit/pull/1738)
 
-## 1.2.1
+### 1.2.1
 
 - Retry request on attestation persistence failure [#1725](https://github.com/actions/toolkit/pull/1725)
 
-## 1.2.0
+### 1.2.0
 
 - Generate attestations using the v0.3 Sigstore bundle format [#1701](https://github.com/actions/toolkit/pull/1701)
 - Bump @sigstore/bundle from 2.2.0 to 2.3.0 [#1701](https://github.com/actions/toolkit/pull/1701)
 - Bump @sigstore/sign from 2.2.3 to 2.3.0 [#1701](https://github.com/actions/toolkit/pull/1701)
 - Remove dependency on make-fetch-happen [#1714](https://github.com/actions/toolkit/pull/1714)
 
-## 1.1.0
+### 1.1.0
 
 - Updates the `attestProvenance` function to retrieve a token from the GitHub OIDC provider and use the token claims to populate the provenance statement [#1693](https://github.com/actions/toolkit/pull/1693)
 
-## 1.0.0
+### 1.0.0
 
 - Initial release

packages/attest/package-lock.json

@@ -1,18 +1,18 @@
 {
   "name": "@actions/attest",
-  "version": "3.0.0",
+  "version": "2.2.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@actions/attest",
-      "version": "3.0.0",
+      "version": "2.2.1",
       "license": "MIT",
       "dependencies": {
-        "@actions/core": "^3.0.0",
+        "@actions/core": "^2.0.2",
-        "@actions/github": "^9.0.0",
+        "@actions/github": "^7.0.0",
-        "@actions/http-client": "^4.0.0",
+        "@actions/http-client": "^3.0.2",
-        "@octokit/plugin-retry": "^8.0.3",
+        "@octokit/plugin-retry": "^6.0.1",
         "@sigstore/bundle": "^3.1.0",
         "@sigstore/sign": "^3.1.0",
         "jose": "^5.10.0"
@@ -26,40 +26,52 @@
       }
     },
     "node_modules/@actions/core": {
-      "version": "3.0.0",
+      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/@actions/core/-/core-3.0.0.tgz",
+      "resolved": "https://registry.npmjs.org/@actions/core/-/core-2.0.2.tgz",
-      "integrity": "sha512-zYt6cz+ivnTmiT/ksRVriMBOiuoUpDCJJlZ5KPl2/FRdvwU3f7MPh9qftvbkXJThragzUZieit2nyHUyw53Seg==",
+      "integrity": "sha512-Ast1V7yHbGAhplAsuVlnb/5J8Mtr/Zl6byPPL+Qjq3lmfIgWF1ak1iYfF/079cRERiuTALTXkSuEUdZeDCfGtA==",
       "license": "MIT",
       "dependencies": {
-        "@actions/exec": "^3.0.0",
+        "@actions/exec": "^2.0.0",
-        "@actions/http-client": "^4.0.0"
+        "@actions/http-client": "^3.0.1"
       }
     },
     "node_modules/@actions/exec": {
-      "version": "3.0.0",
+      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/@actions/exec/-/exec-3.0.0.tgz",
+      "resolved": "https://registry.npmjs.org/@actions/exec/-/exec-2.0.0.tgz",
-      "integrity": "sha512-6xH/puSoNBXb72VPlZVm7vQ+svQpFyA96qdDBvhB8eNZOE8LtPf9L4oAsfzK/crCL8YZ+19fKYVnM63Sl+Xzlw==",
+      "integrity": "sha512-k8ngrX2voJ/RIN6r9xB82NVqKpnMRtxDoiO+g3olkIUpQNqjArXrCQceduQZCQj3P3xm32pChRLqRrtXTlqhIw==",
       "license": "MIT",
       "dependencies": {
-        "@actions/io": "^3.0.2"
+        "@actions/io": "^2.0.0"
       }
     },
     "node_modules/@actions/github": {
-      "version": "9.0.0",
+      "version": "7.0.0",
-      "resolved": "https://registry.npmjs.org/@actions/github/-/github-9.0.0.tgz",
+      "resolved": "https://registry.npmjs.org/@actions/github/-/github-7.0.0.tgz",
-      "integrity": "sha512-yJ0RoswsAaKcvkmpCE4XxBRiy/whH2SdTBHWzs0gi4wkqTDhXMChjSdqBz/F4AeiDlP28rQqL33iHb+kjAMX6w==",
+      "integrity": "sha512-PyGODO938aoBTZd/IfN/+e+Pd5hUcVpyf+thm4CPESLeqhdSkq5QwMTGX9v84XHE1ifmHWBQ60KB8kIgm96opw==",
       "license": "MIT",
       "dependencies": {
-        "@actions/http-client": "^3.0.2",
+        "@actions/http-client": "^3.0.1",
-        "@octokit/core": "^7.0.6",
+        "@octokit/core": "^5.0.1",
-        "@octokit/plugin-paginate-rest": "^14.0.0",
+        "@octokit/plugin-paginate-rest": "^9.2.2",
-        "@octokit/plugin-rest-endpoint-methods": "^17.0.0",
+        "@octokit/plugin-rest-endpoint-methods": "^10.4.0",
-        "@octokit/request": "^10.0.7",
+        "@octokit/request": "^8.4.1",
-        "@octokit/request-error": "^7.1.0",
+        "@octokit/request-error": "^5.1.1",
-        "undici": "^6.23.0"
+        "undici": "^5.28.5"
       }
     },
-    "node_modules/@actions/github/node_modules/@actions/http-client": {
+    "node_modules/@actions/github/node_modules/undici": {
+      "version": "5.29.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-5.29.0.tgz",
+      "integrity": "sha512-raqeBD6NQK4SkWhQzeYKd1KmIG6dllBOTt55Rmkt4HtI9mwdWtJljnrXjAFUBLTSN67HWrOIZ3EPF4kjUw80Bg==",
+      "license": "MIT",
+      "dependencies": {
+        "@fastify/busboy": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=14.0"
+      }
+    },
+    "node_modules/@actions/http-client": {
       "version": "3.0.2",
       "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-3.0.2.tgz",
       "integrity": "sha512-JP38FYYpyqvUsz+Igqlc/JG6YO9PaKuvqjM3iGvaLqFnJ7TFmcLyy2IDrY0bI0qCQug8E9K+elv5ZNfw62ZJzA==",
@@ -69,31 +81,21 @@
         "undici": "^6.23.0"
       }
     },
-    "node_modules/@actions/github/node_modules/@actions/http-client/node_modules/undici": {
+    "node_modules/@actions/io": {
-      "version": "6.23.0",
+      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-6.23.0.tgz",
+      "resolved": "https://registry.npmjs.org/@actions/io/-/io-2.0.0.tgz",
-      "integrity": "sha512-VfQPToRA5FZs/qJxLIinmU59u0r7LXqoJkCzinq3ckNJp3vKEh7jTWN589YQ5+aoAC/TGRLyJLCPKcLQbM8r9g==",
+      "integrity": "sha512-Jv33IN09XLO+0HS79aaODsvIRyduiF7NY/F6LYeK5oeUmrsz7aFdRphQjFoESF4jS7lMauDOttKALcpapVDIAg==",
+      "license": "MIT"
+    },
+    "node_modules/@fastify/busboy": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/@fastify/busboy/-/busboy-2.1.1.tgz",
+      "integrity": "sha512-vBZP4NlzfOlerQTnba4aqZoMhE/a9HY7HRqoOPaETQcSQuWEIyZMHGfVu6w9wGtGK5fED5qRs2DteVCjOH60sA==",
       "license": "MIT",
       "engines": {
-        "node": ">=18.17"
+        "node": ">=14"
       }
     },
-    "node_modules/@actions/http-client": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-4.0.0.tgz",
-      "integrity": "sha512-QuwPsgVMsD6qaPD57GLZi9sqzAZCtiJT8kVBCDpLtxhL5MydQ4gS+DrejtZZPdIYyB1e95uCK9Luyds7ybHI3g==",
-      "license": "MIT",
-      "dependencies": {
-        "tunnel": "^0.0.6",
-        "undici": "^6.23.0"
-      }
-    },
-    "node_modules/@actions/io": {
-      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/@actions/io/-/io-3.0.2.tgz",
-      "integrity": "sha512-nRBchcMM+QK1pdjO7/idu86rbJI5YHUKCvKs0KxnSYbVe3F51UfGxuZX4Qy/fWlp6l7gWFwIkrOzN+oUK03kfw==",
-      "license": "MIT"
-    },
     "node_modules/@isaacs/cliui": {
       "version": "8.0.2",
       "resolved": "https://registry.npmjs.org/@isaacs/cliui/-/cliui-8.0.2.tgz",
@@ -165,147 +167,238 @@
       }
     },
     "node_modules/@octokit/auth-token": {
-      "version": "6.0.0",
+      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/auth-token/-/auth-token-6.0.0.tgz",
+      "resolved": "https://registry.npmjs.org/@octokit/auth-token/-/auth-token-4.0.0.tgz",
-      "integrity": "sha512-P4YJBPdPSpWTQ1NU4XYdvHvXJJDxM6YwpS0FZHRgP7YFkdVxsWcpWGy/NVqlAA7PcPCnMacXlRm1y2PFZRWL/w==",
+      "integrity": "sha512-tY/msAuJo6ARbK6SPIxZrPBms3xPbfwBrulZe0Wtr/DIY9lje2HeV1uoebShn6mx7SjCHif6EjMvoREj+gZ+SA==",
       "license": "MIT",
       "engines": {
-        "node": ">= 20"
+        "node": ">= 18"
       }
     },
     "node_modules/@octokit/core": {
-      "version": "7.0.6",
+      "version": "5.2.2",
-      "resolved": "https://registry.npmjs.org/@octokit/core/-/core-7.0.6.tgz",
+      "resolved": "https://registry.npmjs.org/@octokit/core/-/core-5.2.2.tgz",
-      "integrity": "sha512-DhGl4xMVFGVIyMwswXeyzdL4uXD5OGILGX5N8Y+f6W7LhC1Ze2poSNrkF/fedpVDHEEZ+PHFW0vL14I+mm8K3Q==",
+      "integrity": "sha512-/g2d4sW9nUDJOMz3mabVQvOGhVa4e/BN/Um7yca9Bb2XTzPPnfTWHWQg+IsEYO7M3Vx+EXvaM/I2pJWIMun1bg==",
       "license": "MIT",
       "dependencies": {
-        "@octokit/auth-token": "^6.0.0",
+        "@octokit/auth-token": "^4.0.0",
-        "@octokit/graphql": "^9.0.3",
+        "@octokit/graphql": "^7.1.0",
-        "@octokit/request": "^10.0.6",
+        "@octokit/request": "^8.4.1",
-        "@octokit/request-error": "^7.0.2",
+        "@octokit/request-error": "^5.1.1",
-        "@octokit/types": "^16.0.0",
+        "@octokit/types": "^13.0.0",
-        "before-after-hook": "^4.0.0",
+        "before-after-hook": "^2.2.0",
-        "universal-user-agent": "^7.0.0"
+        "universal-user-agent": "^6.0.0"
       },
       "engines": {
-        "node": ">= 20"
+        "node": ">= 18"
+      }
+    },
+    "node_modules/@octokit/core/node_modules/@octokit/openapi-types": {
+      "version": "24.2.0",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-24.2.0.tgz",
+      "integrity": "sha512-9sIH3nSUttelJSXUrmGzl7QUBFul0/mB8HRYl3fOlgHbIWG+WnYDXU3v/2zMtAvuzZ/ed00Ei6on975FhBfzrg==",
+      "license": "MIT"
+    },
+    "node_modules/@octokit/core/node_modules/@octokit/types": {
+      "version": "13.10.0",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.10.0.tgz",
+      "integrity": "sha512-ifLaO34EbbPj0Xgro4G5lP5asESjwHracYJvVaPIyXMuiuXLlhic3S47cBdTb+jfODkTE5YtGCLt3Ay3+J97sA==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/openapi-types": "^24.2.0"
       }
     },
     "node_modules/@octokit/endpoint": {
-      "version": "11.0.2",
+      "version": "9.0.6",
-      "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-11.0.2.tgz",
+      "resolved": "https://registry.npmjs.org/@octokit/endpoint/-/endpoint-9.0.6.tgz",
-      "integrity": "sha512-4zCpzP1fWc7QlqunZ5bSEjxc6yLAlRTnDwKtgXfcI/FxxGoqedDG8V2+xJ60bV2kODqcGB+nATdtap/XYq2NZQ==",
+      "integrity": "sha512-H1fNTMA57HbkFESSt3Y9+FBICv+0jFceJFPWDePYlR/iMGrwM5ph+Dd4XRQs+8X+PUFURLQgX9ChPfhJ/1uNQw==",
       "license": "MIT",
       "dependencies": {
-        "@octokit/types": "^16.0.0",
+        "@octokit/types": "^13.1.0",
-        "universal-user-agent": "^7.0.2"
+        "universal-user-agent": "^6.0.0"
       },
       "engines": {
-        "node": ">= 20"
+        "node": ">= 18"
+      }
+    },
+    "node_modules/@octokit/endpoint/node_modules/@octokit/openapi-types": {
+      "version": "24.2.0",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-24.2.0.tgz",
+      "integrity": "sha512-9sIH3nSUttelJSXUrmGzl7QUBFul0/mB8HRYl3fOlgHbIWG+WnYDXU3v/2zMtAvuzZ/ed00Ei6on975FhBfzrg==",
+      "license": "MIT"
+    },
+    "node_modules/@octokit/endpoint/node_modules/@octokit/types": {
+      "version": "13.10.0",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.10.0.tgz",
+      "integrity": "sha512-ifLaO34EbbPj0Xgro4G5lP5asESjwHracYJvVaPIyXMuiuXLlhic3S47cBdTb+jfODkTE5YtGCLt3Ay3+J97sA==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/openapi-types": "^24.2.0"
       }
     },
     "node_modules/@octokit/graphql": {
-      "version": "9.0.3",
+      "version": "7.1.1",
-      "resolved": "https://registry.npmjs.org/@octokit/graphql/-/graphql-9.0.3.tgz",
+      "resolved": "https://registry.npmjs.org/@octokit/graphql/-/graphql-7.1.1.tgz",
-      "integrity": "sha512-grAEuupr/C1rALFnXTv6ZQhFuL1D8G5y8CN04RgrO4FIPMrtm+mcZzFG7dcBm+nq+1ppNixu+Jd78aeJOYxlGA==",
+      "integrity": "sha512-3mkDltSfcDUoa176nlGoA32RGjeWjl3K7F/BwHwRMJUW/IteSa4bnSV8p2ThNkcIcZU2umkZWxwETSSCJf2Q7g==",
       "license": "MIT",
       "dependencies": {
-        "@octokit/request": "^10.0.6",
+        "@octokit/request": "^8.4.1",
-        "@octokit/types": "^16.0.0",
+        "@octokit/types": "^13.0.0",
-        "universal-user-agent": "^7.0.0"
+        "universal-user-agent": "^6.0.0"
       },
       "engines": {
-        "node": ">= 20"
+        "node": ">= 18"
+      }
+    },
+    "node_modules/@octokit/graphql/node_modules/@octokit/openapi-types": {
+      "version": "24.2.0",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-24.2.0.tgz",
+      "integrity": "sha512-9sIH3nSUttelJSXUrmGzl7QUBFul0/mB8HRYl3fOlgHbIWG+WnYDXU3v/2zMtAvuzZ/ed00Ei6on975FhBfzrg==",
+      "license": "MIT"
+    },
+    "node_modules/@octokit/graphql/node_modules/@octokit/types": {
+      "version": "13.10.0",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.10.0.tgz",
+      "integrity": "sha512-ifLaO34EbbPj0Xgro4G5lP5asESjwHracYJvVaPIyXMuiuXLlhic3S47cBdTb+jfODkTE5YtGCLt3Ay3+J97sA==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/openapi-types": "^24.2.0"
       }
     },
     "node_modules/@octokit/openapi-types": {
-      "version": "27.0.0",
+      "version": "20.0.0",
-      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-27.0.0.tgz",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-20.0.0.tgz",
-      "integrity": "sha512-whrdktVs1h6gtR+09+QsNk2+FO+49j6ga1c55YZudfEG+oKJVvJLQi3zkOm5JjiUXAagWK2tI2kTGKJ2Ys7MGA==",
+      "integrity": "sha512-EtqRBEjp1dL/15V7WiX5LJMIxxkdiGJnabzYx5Apx4FkQIFgAfKumXeYAqqJCj1s+BMX4cPFIFC4OLCR6stlnA==",
       "license": "MIT"
     },
     "node_modules/@octokit/plugin-paginate-rest": {
-      "version": "14.0.0",
+      "version": "9.2.2",
-      "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-14.0.0.tgz",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-paginate-rest/-/plugin-paginate-rest-9.2.2.tgz",
-      "integrity": "sha512-fNVRE7ufJiAA3XUrha2omTA39M6IXIc6GIZLvlbsm8QOQCYvpq/LkMNGyFlB1d8hTDzsAXa3OKtybdMAYsV/fw==",
+      "integrity": "sha512-u3KYkGF7GcZnSD/3UP0S7K5XUFT2FkOQdcfXZGZQPGv3lm4F2Xbf71lvjldr8c1H3nNbF+33cLEkWYbokGWqiQ==",
       "license": "MIT",
       "dependencies": {
-        "@octokit/types": "^16.0.0"
+        "@octokit/types": "^12.6.0"
       },
       "engines": {
-        "node": ">= 20"
+        "node": ">= 18"
       },
       "peerDependencies": {
-        "@octokit/core": ">=6"
+        "@octokit/core": "5"
       }
     },
     "node_modules/@octokit/plugin-rest-endpoint-methods": {
-      "version": "17.0.0",
+      "version": "10.4.1",
-      "resolved": "https://registry.npmjs.org/@octokit/plugin-rest-endpoint-methods/-/plugin-rest-endpoint-methods-17.0.0.tgz",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-rest-endpoint-methods/-/plugin-rest-endpoint-methods-10.4.1.tgz",
-      "integrity": "sha512-B5yCyIlOJFPqUUeiD0cnBJwWJO8lkJs5d8+ze9QDP6SvfiXSz1BF+91+0MeI1d2yxgOhU/O+CvtiZ9jSkHhFAw==",
+      "integrity": "sha512-xV1b+ceKV9KytQe3zCVqjg+8GTGfDYwaT1ATU5isiUyVtlVAO3HNdzpS4sr4GBx4hxQ46s7ITtZrAsxG22+rVg==",
       "license": "MIT",
       "dependencies": {
-        "@octokit/types": "^16.0.0"
+        "@octokit/types": "^12.6.0"
       },
       "engines": {
-        "node": ">= 20"
+        "node": ">= 18"
       },
       "peerDependencies": {
-        "@octokit/core": ">=6"
+        "@octokit/core": "5"
       }
     },
     "node_modules/@octokit/plugin-retry": {
-      "version": "8.0.3",
+      "version": "6.1.0",
-      "resolved": "https://registry.npmjs.org/@octokit/plugin-retry/-/plugin-retry-8.0.3.tgz",
+      "resolved": "https://registry.npmjs.org/@octokit/plugin-retry/-/plugin-retry-6.1.0.tgz",
-      "integrity": "sha512-vKGx1i3MC0za53IzYBSBXcrhmd+daQDzuZfYDd52X5S0M2otf3kVZTVP8bLA3EkU0lTvd1WEC2OlNNa4G+dohA==",
+      "integrity": "sha512-WrO3bvq4E1Xh1r2mT9w6SDFg01gFmP81nIG77+p/MqW1JeXXgL++6umim3t6x0Zj5pZm3rXAN+0HEjmmdhIRig==",
       "license": "MIT",
       "dependencies": {
-        "@octokit/request-error": "^7.0.2",
+        "@octokit/request-error": "^5.0.0",
-        "@octokit/types": "^16.0.0",
+        "@octokit/types": "^13.0.0",
         "bottleneck": "^2.15.3"
       },
       "engines": {
-        "node": ">= 20"
+        "node": ">= 18"
       },
       "peerDependencies": {
-        "@octokit/core": ">=7"
+        "@octokit/core": "5"
+      }
+    },
+    "node_modules/@octokit/plugin-retry/node_modules/@octokit/openapi-types": {
+      "version": "24.2.0",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-24.2.0.tgz",
+      "integrity": "sha512-9sIH3nSUttelJSXUrmGzl7QUBFul0/mB8HRYl3fOlgHbIWG+WnYDXU3v/2zMtAvuzZ/ed00Ei6on975FhBfzrg==",
+      "license": "MIT"
+    },
+    "node_modules/@octokit/plugin-retry/node_modules/@octokit/types": {
+      "version": "13.10.0",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.10.0.tgz",
+      "integrity": "sha512-ifLaO34EbbPj0Xgro4G5lP5asESjwHracYJvVaPIyXMuiuXLlhic3S47cBdTb+jfODkTE5YtGCLt3Ay3+J97sA==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/openapi-types": "^24.2.0"
       }
     },
     "node_modules/@octokit/request": {
-      "version": "10.0.7",
+      "version": "8.4.1",
-      "resolved": "https://registry.npmjs.org/@octokit/request/-/request-10.0.7.tgz",
+      "resolved": "https://registry.npmjs.org/@octokit/request/-/request-8.4.1.tgz",
-      "integrity": "sha512-v93h0i1yu4idj8qFPZwjehoJx4j3Ntn+JhXsdJrG9pYaX6j/XRz2RmasMUHtNgQD39nrv/VwTWSqK0RNXR8upA==",
+      "integrity": "sha512-qnB2+SY3hkCmBxZsR/MPCybNmbJe4KAlfWErXq+rBKkQJlbjdJeS85VI9r8UqeLYLvnAenU8Q1okM/0MBsAGXw==",
       "license": "MIT",
       "dependencies": {
-        "@octokit/endpoint": "^11.0.2",
+        "@octokit/endpoint": "^9.0.6",
-        "@octokit/request-error": "^7.0.2",
+        "@octokit/request-error": "^5.1.1",
-        "@octokit/types": "^16.0.0",
+        "@octokit/types": "^13.1.0",
-        "fast-content-type-parse": "^3.0.0",
+        "universal-user-agent": "^6.0.0"
-        "universal-user-agent": "^7.0.2"
       },
       "engines": {
-        "node": ">= 20"
+        "node": ">= 18"
       }
     },
     "node_modules/@octokit/request-error": {
-      "version": "7.1.0",
+      "version": "5.1.1",
-      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-7.1.0.tgz",
+      "resolved": "https://registry.npmjs.org/@octokit/request-error/-/request-error-5.1.1.tgz",
-      "integrity": "sha512-KMQIfq5sOPpkQYajXHwnhjCC0slzCNScLHs9JafXc4RAJI+9f+jNDlBNaIMTvazOPLgb4BnlhGJOTbnN0wIjPw==",
+      "integrity": "sha512-v9iyEQJH6ZntoENr9/yXxjuezh4My67CBSu9r6Ve/05Iu5gNgnisNWOsoJHTP6k0Rr0+HQIpnH+kyammu90q/g==",
       "license": "MIT",
       "dependencies": {
-        "@octokit/types": "^16.0.0"
+        "@octokit/types": "^13.1.0",
+        "deprecation": "^2.0.0",
+        "once": "^1.4.0"
       },
       "engines": {
-        "node": ">= 20"
+        "node": ">= 18"
+      }
+    },
+    "node_modules/@octokit/request-error/node_modules/@octokit/openapi-types": {
+      "version": "24.2.0",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-24.2.0.tgz",
+      "integrity": "sha512-9sIH3nSUttelJSXUrmGzl7QUBFul0/mB8HRYl3fOlgHbIWG+WnYDXU3v/2zMtAvuzZ/ed00Ei6on975FhBfzrg==",
+      "license": "MIT"
+    },
+    "node_modules/@octokit/request-error/node_modules/@octokit/types": {
+      "version": "13.10.0",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.10.0.tgz",
+      "integrity": "sha512-ifLaO34EbbPj0Xgro4G5lP5asESjwHracYJvVaPIyXMuiuXLlhic3S47cBdTb+jfODkTE5YtGCLt3Ay3+J97sA==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/openapi-types": "^24.2.0"
+      }
+    },
+    "node_modules/@octokit/request/node_modules/@octokit/openapi-types": {
+      "version": "24.2.0",
+      "resolved": "https://registry.npmjs.org/@octokit/openapi-types/-/openapi-types-24.2.0.tgz",
+      "integrity": "sha512-9sIH3nSUttelJSXUrmGzl7QUBFul0/mB8HRYl3fOlgHbIWG+WnYDXU3v/2zMtAvuzZ/ed00Ei6on975FhBfzrg==",
+      "license": "MIT"
+    },
+    "node_modules/@octokit/request/node_modules/@octokit/types": {
+      "version": "13.10.0",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-13.10.0.tgz",
+      "integrity": "sha512-ifLaO34EbbPj0Xgro4G5lP5asESjwHracYJvVaPIyXMuiuXLlhic3S47cBdTb+jfODkTE5YtGCLt3Ay3+J97sA==",
+      "license": "MIT",
+      "dependencies": {
+        "@octokit/openapi-types": "^24.2.0"
       }
     },
     "node_modules/@octokit/types": {
-      "version": "16.0.0",
+      "version": "12.6.0",
-      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-16.0.0.tgz",
+      "resolved": "https://registry.npmjs.org/@octokit/types/-/types-12.6.0.tgz",
-      "integrity": "sha512-sKq+9r1Mm4efXW1FCk7hFSeJo4QKreL/tTbR0rz/qx/r1Oa2VV83LTA/H/MuCOX7uCIJmQVRKBcbmWoySjAnSg==",
+      "integrity": "sha512-1rhSOfRa6H9w4YwK0yrf5faDaDTb+yLyBUKOCV4xtCDB5VmIPqd/v9yr9o6SAzOAlRxMiRiCic6JVM1/kunVkw==",
       "license": "MIT",
       "dependencies": {
-        "@octokit/openapi-types": "^27.0.0"
+        "@octokit/openapi-types": "^20.0.0"
       }
     },
     "node_modules/@peculiar/asn1-cms": {
@@ -666,9 +759,9 @@
       "license": "MIT"
     },
     "node_modules/before-after-hook": {
-      "version": "4.0.0",
+      "version": "2.2.3",
-      "resolved": "https://registry.npmjs.org/before-after-hook/-/before-after-hook-4.0.0.tgz",
+      "resolved": "https://registry.npmjs.org/before-after-hook/-/before-after-hook-2.2.3.tgz",
-      "integrity": "sha512-q6tR3RPqIB1pMiTRMFcZwuG5T8vwp+vUvEG0vuI6B+Rikh5BfPp2fQ82c925FOs+b0lcFQ8CFrL+KbilfZFhOQ==",
+      "integrity": "sha512-NzUnlZexiaH/46WDhANlyR2bXRopNg4F/zuSA3OpZnllCUgRaOF2znDioDWrmbNVsuZk6l9pMquQB38cfBZwkQ==",
       "license": "Apache-2.0"
     },
     "node_modules/bottleneck": {
@@ -787,6 +880,12 @@
         }
       }
     },
+    "node_modules/deprecation": {
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/deprecation/-/deprecation-2.3.1.tgz",
+      "integrity": "sha512-xmHIy4F3scKVwMsQ4WnVaS8bHOx0DmVwRywosKhaILI0ywMDWPtBSku2HNxRvF7jtwDRsoEwYQSfbxj8b7RlJQ==",
+      "license": "ISC"
+    },
     "node_modules/eastasianwidth": {
       "version": "0.2.0",
       "resolved": "https://registry.npmjs.org/eastasianwidth/-/eastasianwidth-0.2.0.tgz",
@@ -815,22 +914,6 @@
       "integrity": "sha512-2bmlRpNKBxT/CRmPOlyISQpNj+qSeYvcym/uT0Jx2bMOlKLtSy1ZmLuVxSEKKyor/N5yhvp/ZiG1oE3DEYMSFA==",
       "license": "MIT"
     },
-    "node_modules/fast-content-type-parse": {
-      "version": "3.0.0",
-      "resolved": "https://registry.npmjs.org/fast-content-type-parse/-/fast-content-type-parse-3.0.0.tgz",
-      "integrity": "sha512-ZvLdcY8P+N8mGQJahJV5G4U88CSvT1rP8ApL6uETe88MBXrBHAkZlSEySdUlyztF7ccb+Znos3TFqaepHxdhBg==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/fastify"
-        },
-        {
-          "type": "opencollective",
-          "url": "https://opencollective.com/fastify"
-        }
-      ],
-      "license": "MIT"
-    },
     "node_modules/foreground-child": {
       "version": "3.3.1",
       "resolved": "https://registry.npmjs.org/foreground-child/-/foreground-child-3.3.1.tgz",
@@ -1201,6 +1284,15 @@
         "node": ">= 10.13"
       }
     },
+    "node_modules/once": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
+      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
+      "license": "ISC",
+      "dependencies": {
+        "wrappy": "1"
+      }
+    },
     "node_modules/p-map": {
       "version": "7.0.3",
       "resolved": "https://registry.npmjs.org/p-map/-/p-map-7.0.3.tgz",
@@ -1529,9 +1621,9 @@
       }
     },
     "node_modules/tar": {
-      "version": "7.5.7",
+      "version": "7.5.6",
-      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.7.tgz",
+      "resolved": "https://registry.npmjs.org/tar/-/tar-7.5.6.tgz",
-      "integrity": "sha512-fov56fJiRuThVFXD6o6/Q354S7pnWMJIVlDBYijsTNx6jKSE4pvrDTs6lUnmGvNyfJwFQQwWy3owKz1ucIhveQ==",
+      "integrity": "sha512-xqUeu2JAIJpXyvskvU3uvQW8PAmHrtXp2KDuMJwQqW8Sqq0CaZBAQ+dKS3RBXVhU4wC5NjAdKrmh84241gO9cA==",
       "license": "BlueOak-1.0.0",
       "dependencies": {
         "@isaacs/fs-minipass": "^4.0.0",
@@ -1621,9 +1713,9 @@
       }
     },
     "node_modules/universal-user-agent": {
-      "version": "7.0.3",
+      "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-7.0.3.tgz",
+      "resolved": "https://registry.npmjs.org/universal-user-agent/-/universal-user-agent-6.0.1.tgz",
-      "integrity": "sha512-TmnEAEAsBJVZM/AADELsK76llnwcf9vMKuPz8JflO1frO8Lchitr0fNaN9d+Ap0BjKtqWqd/J17qeDnXh8CL2A==",
+      "integrity": "sha512-yCzhz6FN2wU1NiiQRogkTQszlQSlpWaw8SvVegAc+bDxbzHgh1vX8uIe8OYyMH6DwH+sdTJsgMl36+mSMdRJIQ==",
       "license": "ISC"
     },
     "node_modules/webcrypto-core": {
@@ -1746,6 +1838,12 @@
         "node": ">=8"
       }
     },
+    "node_modules/wrappy": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
+      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==",
+      "license": "ISC"
+    },
     "node_modules/yallist": {
       "version": "5.0.0",
       "resolved": "https://registry.npmjs.org/yallist/-/yallist-5.0.0.tgz",

packages/attest/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actions/attest",
-  "version": "3.0.0",
+  "version": "2.2.1",
   "description": "Actions attestation lib",
   "keywords": [
     "github",
@@ -9,15 +9,8 @@
   ],
   "homepage": "https://github.com/actions/toolkit/tree/main/packages/attest",
   "license": "MIT",
-  "type": "module",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./lib/index.d.ts",
-      "import": "./lib/index.js"
-    }
-  },
   "directories": {
     "lib": "lib",
     "test": "__tests__"
@@ -49,12 +42,17 @@
     "undici": "^6.23.0"
   },
   "dependencies": {
-    "@actions/core": "^3.0.0",
+    "@actions/core": "^2.0.2",
-    "@actions/github": "^9.0.0",
+    "@actions/github": "^7.0.0",
-    "@actions/http-client": "^4.0.0",
+    "@actions/http-client": "^3.0.2",
-    "@octokit/plugin-retry": "^8.0.3",
+    "@octokit/plugin-retry": "^6.0.1",
     "@sigstore/bundle": "^3.1.0",
     "@sigstore/sign": "^3.1.0",
     "jose": "^5.10.0"
+  },
+  "overrides": {
+    "@octokit/plugin-retry": {
+      "@octokit/core": "^5.2.0"
+    }
   }
 }

packages/attest/src/attest.ts

@@ -1,12 +1,12 @@
 import {bundleToJSON} from '@sigstore/bundle'
 import {X509Certificate} from 'crypto'
-import {SigstoreInstance, signingEndpoints} from './endpoints.js'
+import {SigstoreInstance, signingEndpoints} from './endpoints'
-import {buildIntotoStatement} from './intoto.js'
+import {buildIntotoStatement} from './intoto'
-import {Payload, signPayload} from './sign.js'
+import {Payload, signPayload} from './sign'
-import {writeAttestation} from './store.js'
+import {writeAttestation} from './store'
 
 import type {Bundle} from '@sigstore/sign'
-import type {Attestation, Predicate, Subject} from './shared.types.js'
+import type {Attestation, Predicate, Subject} from './shared.types'
 
 const INTOTO_PAYLOAD_TYPE = 'application/vnd.in-toto+json'
 

packages/attest/src/index.ts

@@ -1,15 +1,10 @@
-export {
+export {createStorageRecord} from './artifactMetadata'
-  createStorageRecord,
+export {AttestOptions, attest} from './attest'
-  ArtifactOptions,
-  PackageRegistryOptions
-} from './artifactMetadata.js'
-export {AttestOptions, attest} from './attest.js'
 export {
   AttestProvenanceOptions,
   attestProvenance,
   buildSLSAProvenancePredicate
-} from './provenance.js'
+} from './provenance'
 
 export type {SerializedBundle} from '@sigstore/bundle'
-export type {Attestation, Predicate, Subject} from './shared.types.js'
+export type {Attestation, Predicate, Subject} from './shared.types'
-export type {SigstoreInstance} from './endpoints.js'

packages/attest/src/intoto.ts

@@ -1,4 +1,4 @@
-import {Predicate, Subject} from './shared.types.js'
+import {Predicate, Subject} from './shared.types'
 
 const INTOTO_STATEMENT_V1_TYPE = 'https://in-toto.io/Statement/v1'
 

packages/attest/src/provenance.ts

@@ -1,6 +1,6 @@
-import {attest, AttestOptions} from './attest.js'
+import {attest, AttestOptions} from './attest'
-import {getIDTokenClaims} from './oidc.js'
+import {getIDTokenClaims} from './oidc'
-import type {Attestation, Predicate} from './shared.types.js'
+import type {Attestation, Predicate} from './shared.types'
 
 const SLSA_PREDICATE_V1_TYPE = 'https://slsa.dev/provenance/v1'
 const GITHUB_BUILD_TYPE = 'https://actions.github.io/buildtypes/workflow/v1'

packages/attest/tsconfig.json

@@ -4,9 +4,7 @@
     "baseUrl": "./",
     "outDir": "./lib",
     "declaration": true,
-    "rootDir": "./src",
+    "rootDir": "./src"
-    "module": "node16",
-    "moduleResolution": "node16"
   },
   "include": [
     "./src"

packages/cache/RELEASES.md

@@ -1,28 +1,23 @@
 # @actions/cache Releases
 
-## 6.0.0
+### 5.0.5
-
-- **Breaking change**: Package is now ESM-only
-  - CommonJS consumers must use dynamic `import()` instead of `require()`
-
-## 5.0.5
 
 - Bump `@actions/glob` to `0.5.1`
 
-## 5.0.4
+### 5.0.4
 
 - Bump `@actions/http-client` to `3.0.2`
 
-## 5.0.3
+### 5.0.3
 
 Prevent retries for rate limited cache operations [2243](https://github.com/actions/toolkit/pull/2243).
 
-## 5.0.1
+### 5.0.1
 
 - Fix Node.js 24 punycode deprecation warning by updating `@azure/storage-blob` from `^12.13.0` to `^12.29.1` [#2213](https://github.com/actions/toolkit/pull/2213)
 - Newer storage-blob uses `@azure/core-rest-pipeline` instead of deprecated `@azure/core-http`, which eliminates the transitive dependency on `node-fetch@2` → `whatwg-url@5` → `[email protected]` that used the deprecated punycode module
 
-## 5.0.0
+### 5.0.0
 
 - Remove `@azure/ms-rest-js` dependency [#2197](https://github.com/actions/toolkit/pull/2197)
   - The `TransferProgressEvent` type is now imported from `@azure/core-rest-pipeline` instead of `@azure/ms-rest-js`
@@ -34,15 +29,15 @@ Prevent retries for rate limited cache operations [2243](https://github.com/acti
 - Add support for Node.js 24 [#2110](https://github.com/actions/toolkit/pull/2110)
 - Add `node-fetch` override to resolve audit vulnerabilities [#2110](https://github.com/actions/toolkit/pull/2110)
 
-## 4.1.0
+### 4.1.0
 
 - Remove client side 10GiB cache size limit check & update twirp client [#2118](https://github.com/actions/toolkit/pull/2118)
 
-## 4.0.5
+### 4.0.5
 
 - Reintroduce @protobuf-ts/runtime-rpc as a runtime dependency [#2113](https://github.com/actions/toolkit/pull/2113)
 
-## 4.0.4
+### 4.0.4
 
 ⚠️ Faulty patch release. Upgrade to 4.0.5 instead.
 
@@ -51,23 +46,23 @@ Prevent retries for rate limited cache operations [2243](https://github.com/acti
 - Enhanced server error handling: 5xx HTTP errors are now logged as errors instead of warnings [#2099](https://github.com/actions/toolkit/pull/2099)
 - Fixed cache hit logging to properly distinguish between exact key matches and restore key matches [#2101](https://github.com/actions/toolkit/pull/2101)
 
-## 4.0.3
+### 4.0.3
 
 - Added masking for Shared Access Signature (SAS) cache entry URLs [#1982](https://github.com/actions/toolkit/pull/1982)
 - Improved debugging by logging both the cache version alongside the keys requested when a cache restore fails [#1994](https://github.com/actions/toolkit/pull/1994)
 
-## 4.0.2
+### 4.0.2
 
 - Wrap create failures in ReserveCacheError [#1966](https://github.com/actions/toolkit/pull/1966)
 
-## 4.0.1
+### 4.0.1
 
 - Remove runtime dependency on `twirp-ts` [#1947](https://github.com/actions/toolkit/pull/1947)
 - Cache miss as debug, not warning annotation [#1954](https://github.com/actions/toolkit/pull/1954)
 
-## 4.0.0
+### 4.0.0
 
-### Important changes
+#### Important changes
 
 The cache backend service has been rewritten from the ground up for improved performance and reliability. The [@actions/cache](https://github.com/actions/toolkit/tree/main/packages/cache) package now integrates with the new cache service (v2) APIs.
 
@@ -81,182 +76,182 @@ Upgrading to the recommended version should not break or require any changes to
 
 Read more about the change & access the migration guide: [reference to the announcement](https://github.com/actions/toolkit/discussions/1890).
 
-### Minor changes
+#### Minor changes
 
 - Update `@actions/core` to `1.11.0`
 - Update `semver` `6.3.1`
 - Add `twirp-ts` `2.5.0` to dependencies
 
-## 3.3.0
+### 3.3.0
 
 - Update `@actions/core` to `1.11.1`
 - Remove dependency on `uuid` package [#1824](https://github.com/actions/toolkit/pull/1824), [#1842](https://github.com/actions/toolkit/pull/1842)
 
-## 3.2.4
+### 3.2.4
 
 - Updated `isGhes` check to include `.ghe.com` and `.ghe.localhost` as accepted hosts
 
-## 3.2.3
+### 3.2.3
 
 - Fixed a bug that mutated path arguments to `getCacheVersion` [#1378](https://github.com/actions/toolkit/pull/1378)
 
-## 3.2.2
+### 3.2.2
 
 - Add new default cache download method to improve performance and reduce hangs [#1484](https://github.com/actions/toolkit/pull/1484)
 
-## 3.2.1
+### 3.2.1
 
 - Updated @azure/storage-blob to `v12.13.0`
 
-## 3.2.0
+### 3.2.0
 
 - Add `lookupOnly` to cache restore `DownloadOptions`.
 
-## 3.1.4
+### 3.1.4
 
 - Fix zstd not being used due to `zstd --version` output change in zstd 1.5.4 release. See [#1353](https://github.com/actions/toolkit/pull/1353).
 
-## 3.1.3
+### 3.1.3
 
 - Fix to prevent from setting MYSYS environement variable globally [#1329](https://github.com/actions/toolkit/pull/1329).
 
-## 3.1.2
+### 3.1.2
 
 - Fix issue with symlink restoration on windows.
 
-## 3.1.1
+### 3.1.1
 
 - Reverted changes in 3.1.0 to fix issue with symlink restoration on windows.
 - Added support for verbose logging about cache version during cache miss.
 
-## 3.1.0
+### 3.1.0
 
 - Update actions/cache on windows to use gnu tar and zstd by default
 - Update actions/cache on windows to fallback to bsdtar and zstd if gnu tar is not available.
 - Added support for fallback to gzip to restore old caches on windows.
 
-## 3.1.0-beta.3
+### 3.1.0-beta.3
 
 - Bug Fixes for fallback to gzip to restore old caches on windows and bsdtar if gnutar is not available.
 
-## 3.1.0-beta.2
+### 3.1.0-beta.2
 
 - Added support for fallback to gzip to restore old caches on windows.
 
-## 3.0.6
+### 3.0.6
 
 - Added `@azure/abort-controller` to dependencies to fix compatibility issue with ESM [#1208](https://github.com/actions/toolkit/issues/1208)
 
-## 3.0.5
+### 3.0.5
 
 - Update `@actions/cache` to use `@actions/core@^1.10.0`
 
-## 3.0.4
+### 3.0.4
 
 - Fix zstd not working for windows on gnu tar in issues [#888](https://github.com/actions/cache/issues/888) and [#891](https://github.com/actions/cache/issues/891).
 - Allowing users to provide a custom timeout as input for aborting download of a cache segment using an environment variable `SEGMENT_DOWNLOAD_TIMEOUT_MINS`. Default is 60 minutes.
 
-## 3.0.3
+### 3.0.3
 
 - Bug fixes for download stuck issue [#810](https://github.com/actions/cache/issues/810).
 
-## 3.0.2
+### 3.0.2
 
 - Added 1 hour timeout for the download stuck issue [#810](https://github.com/actions/cache/issues/810).
 
-## 3.0.1
+### 3.0.1
 
 - Fix [#833](https://github.com/actions/cache/issues/833) - cache doesn't work with github workspace directory.
 - Fix [#809](https://github.com/actions/cache/issues/809) `zstd -d: no such file or directory` error on AWS self-hosted runners.
 
-## 3.0.0
+### 3.0.0
 
 - Updated actions/cache to suppress Actions cache server error and log warning for those error  [#1122](https://github.com/actions/toolkit/pull/1122)
 
-## 2.0.6
+### 2.0.6
 
 - Fix `Tar failed with error: The process '/usr/bin/tar' failed with exit code 1` issue when temp directory where tar is getting created is actually the subdirectory of the path mentioned by the user for caching. ([issue](https://github.com/actions/cache/issues/689))
 
-## 2.0.5
+### 2.0.5
 
 - Fix to avoid saving empty cache when no files are available for caching. ([issue](https://github.com/actions/cache/issues/624))
 
-## 2.0.4
+### 2.0.4
 
 - Update to v2.0.1 of `@actions/http-client` [#1087](https://github.com/actions/toolkit/pull/1087)
 
-## 2.0.3
+### 2.0.3
 
 - Update to v2.0.0 of `@actions/http-client`
 
-## 2.0.0
+### 2.0.0
 
 - Added support to check if Actions cache service feature is available or not [#1028](https://github.com/actions/toolkit/pull/1028)
 
-## 1.0.11
+### 1.0.11
 
 - Fix file downloads > 2GB([issue](https://github.com/actions/cache/issues/773))
 
-## 1.0.10
+### 1.0.10
 
 - Update `lockfileVersion` to `v2` in `package-lock.json [#1022](https://github.com/actions/toolkit/pull/1022)
 
-## 1.0.9
+### 1.0.9
 
 - Use @azure/ms-rest-js v2.6.0
 - Use @azure/storage-blob v12.8.0
 
-## 1.0.8
+### 1.0.8
 
 - Increase the allowed artifact cache size from 5GB to 10GB ([issue](https://github.com/actions/cache/discussions/497))
 
-## 1.0.7
+### 1.0.7
 
 - Fixes permissions issue extracting archives with GNU tar on macOS ([issue](https://github.com/actions/cache/issues/527))
 
-## 1.0.6
+### 1.0.6
 
 - Make caching more verbose [#650](https://github.com/actions/toolkit/pull/650)
 - Use GNU tar on macOS if available [#701](https://github.com/actions/toolkit/pull/701)
 
-## 1.0.5
+### 1.0.5
 
 - Fix to ensure Windows cache paths get resolved correctly
 
-## 1.0.4
+### 1.0.4
 
 - Use @actions/core v1.2.6
 - Fixes uploadChunk to throw an error if any unsuccessful response code is received
 
-## 1.0.3
+### 1.0.3
 
 - Use http-client v1.0.9
 - Fixes error handling so retries are not attempted on non-retryable errors (409 Conflict, for example)
 - Adds 5 second delay between retry attempts
 
-## 1.0.2
+### 1.0.2
 
 - Use posix archive format to add support for some tools
 
-## 1.0.1
+### 1.0.1
 
 - Fix bug in downloading large files (> 2 GBs) with the Azure SDK
 
-## 1.0.0
+### 1.0.0
 
 - Downloads Azure-hosted caches using the Azure SDK for speed and reliability
 - Displays download progress
 - Includes changes that break compatibility with earlier versions, including:
   - `retry`, `retryTypedResponse`, and `retryHttpClientResponse` moved from `cacheHttpClient` to `requestUtils`
 
-## 0.2.1
+### 0.2.1
 
 - Fix to await async function getCompressionMethod
   
-## 0.2.0
+### 0.2.0
 
 - Fixes issues with the zstd compression algorithm on Windows and Ubuntu 16.04 [#469](https://github.com/actions/toolkit/pull/469)
   
-## 0.1.0
+### 0.1.0
 
 - Initial release

packages/cache/__tests__/__fixtures__/action.yml

@@ -1,5 +1,5 @@
 name: 'Set env variables'
 description: 'Sets certain env variables so that e2e restore and save cache can be tested in a shell'
 runs:
-  using: 'node20'
+  using: 'node12'
   main: 'index.js'

packages/cache/__tests__/__fixtures__/index.js

@@ -1,9 +1,8 @@
 // Certain env variables are not set by default in a shell context and are only available in a node context from a running action
 // In order to be able to restore and save cache e2e in a shell when running CI tests, we need these env variables set
-import fs from 'fs'
+const fs = require('fs');
-import os from 'os'
+const os = require('os');
-
+const filePath = process.env[`GITHUB_ENV`]
-const filePath = process.env['GITHUB_ENV']
 fs.appendFileSync(filePath, `ACTIONS_CACHE_SERVICE_V2=true${os.EOL}`, {
     encoding: 'utf8'
 })

packages/cache/__tests__/restore-cache.mjs

@@ -1,45 +0,0 @@
-#!/usr/bin/env node
-// Helper script to restore cache for e2e testing
-import * as cache from '../lib/cache.js'
-
-const [prefix, runId, useAzureSdk] = process.argv.slice(2)
-
-if (!prefix || !runId) {
-  console.error('Usage: restore-cache.mjs <prefix> <runId> [useAzureSdk]')
-  process.exit(1)
-}
-
-const key = `test-${prefix}-${runId}`
-const paths = ['test-cache', '~/test-cache']
-const options = {useAzureSdk: useAzureSdk !== 'false'}
-
-console.log(`Restoring cache with key: ${key}`)
-console.log(`Paths: ${paths.join(', ')}`)
-console.log(`Using Azure SDK: ${options.useAzureSdk}`)
-
-const maxRetries = 3
-const retryDelayMs = 5000
-
-for (let attempt = 1; attempt <= maxRetries; attempt++) {
-  try {
-    console.log(`Attempt ${attempt} of ${maxRetries}`)
-    const restoredKey = await cache.restoreCache(paths, key, [], options)
-
-    if (restoredKey) {
-      console.log(`Cache restored with key: ${restoredKey}`)
-      process.exit(0)
-    } else {
-      console.log('Cache not found on this attempt')
-    }
-  } catch (error) {
-    console.error(`Error on attempt ${attempt}:`, error.message)
-  }
-
-  if (attempt < maxRetries) {
-    console.log(`Waiting ${retryDelayMs / 1000}s before retry...`)
-    await new Promise(resolve => setTimeout(resolve, retryDelayMs))
-  }
-}
-
-console.error(`Failed to restore cache after ${maxRetries} attempts`)
-process.exit(1)

packages/cache/__tests__/save-cache.mjs

@@ -1,24 +0,0 @@
-#!/usr/bin/env node
-// Helper script to save cache for e2e testing
-import * as cache from '../lib/cache.js'
-
-const [prefix, runId] = process.argv.slice(2)
-
-if (!prefix || !runId) {
-  console.error('Usage: save-cache.mjs <prefix> <runId>')
-  process.exit(1)
-}
-
-const key = `test-${prefix}-${runId}`
-const paths = ['test-cache', '~/test-cache']
-
-console.log(`Saving cache with key: ${key}`)
-console.log(`Paths: ${paths.join(', ')}`)
-
-try {
-  const cacheId = await cache.saveCache(paths, key)
-  console.log(`Cache saved with ID: ${cacheId}`)
-} catch (error) {
-  console.error('Error saving cache:', error)
-  process.exit(1)
-}

packages/cache/package-lock.json

@@ -1,86 +1,96 @@
 {
   "name": "@actions/cache",
-  "version": "6.0.0",
+  "version": "5.0.5",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@actions/cache",
-      "version": "6.0.0",
+      "version": "5.0.5",
       "license": "MIT",
       "dependencies": {
-        "@actions/core": "^3.0.0",
+        "@actions/core": "^2.0.0",
-        "@actions/exec": "^3.0.0",
+        "@actions/exec": "^2.0.0",
-        "@actions/glob": "^0.6.1",
+        "@actions/glob": "^0.5.1",
-        "@actions/http-client": "^4.0.0",
+        "@actions/http-client": "^3.0.2",
-        "@actions/io": "^3.0.0",
+        "@actions/io": "^2.0.0",
+        "@azure/abort-controller": "^1.1.0",
         "@azure/core-rest-pipeline": "^1.22.0",
-        "@azure/storage-blob": "^12.30.0",
+        "@azure/storage-blob": "^12.29.1",
         "@protobuf-ts/runtime-rpc": "^2.11.1",
-        "semver": "^7.7.3"
+        "semver": "^6.3.1"
       },
       "devDependencies": {
         "@protobuf-ts/plugin": "^2.9.4",
-        "@types/node": "^25.1.0",
+        "@types/node": "^24.1.0",
-        "@types/semver": "^7.7.1",
+        "@types/semver": "^6.0.0",
         "typescript": "^5.2.2"
       }
     },
     "node_modules/@actions/core": {
-      "version": "3.0.0",
+      "version": "2.0.3",
-      "resolved": "https://registry.npmjs.org/@actions/core/-/core-3.0.0.tgz",
+      "resolved": "https://registry.npmjs.org/@actions/core/-/core-2.0.3.tgz",
-      "integrity": "sha512-zYt6cz+ivnTmiT/ksRVriMBOiuoUpDCJJlZ5KPl2/FRdvwU3f7MPh9qftvbkXJThragzUZieit2nyHUyw53Seg==",
+      "integrity": "sha512-Od9Thc3T1mQJYddvVPM4QGiLUewdh+3txmDYHHxoNdkqysR1MbCT+rFOtNUxYAz+7+6RIsqipVahY2GJqGPyxA==",
       "license": "MIT",
       "dependencies": {
-        "@actions/exec": "^3.0.0",
+        "@actions/exec": "^2.0.0",
-        "@actions/http-client": "^4.0.0"
+        "@actions/http-client": "^3.0.2"
       }
     },
     "node_modules/@actions/exec": {
-      "version": "3.0.0",
+      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/@actions/exec/-/exec-3.0.0.tgz",
+      "resolved": "https://registry.npmjs.org/@actions/exec/-/exec-2.0.0.tgz",
-      "integrity": "sha512-6xH/puSoNBXb72VPlZVm7vQ+svQpFyA96qdDBvhB8eNZOE8LtPf9L4oAsfzK/crCL8YZ+19fKYVnM63Sl+Xzlw==",
+      "integrity": "sha512-k8ngrX2voJ/RIN6r9xB82NVqKpnMRtxDoiO+g3olkIUpQNqjArXrCQceduQZCQj3P3xm32pChRLqRrtXTlqhIw==",
       "license": "MIT",
       "dependencies": {
-        "@actions/io": "^3.0.2"
+        "@actions/io": "^2.0.0"
       }
     },
     "node_modules/@actions/glob": {
-      "version": "0.6.1",
+      "version": "0.5.1",
-      "resolved": "https://registry.npmjs.org/@actions/glob/-/glob-0.6.1.tgz",
+      "resolved": "https://registry.npmjs.org/@actions/glob/-/glob-0.5.1.tgz",
-      "integrity": "sha512-K4+2Ac5ILcf2ySdJCha+Pop9NcKjxqCL4xL4zI50dgB2PbXgC0+AcP011xfH4Of6b4QEJJg8dyZYv7zl4byTsw==",
+      "integrity": "sha512-+dv/t2aKQdKp9WWSp+1yIXVJzH5Q38M0Mta26pzIbeec14EcIleMB7UU6N7sNgbEuYfyuVGpE5pOKjl6j1WXkA==",
       "license": "MIT",
       "dependencies": {
-        "@actions/core": "^3.0.0",
+        "@actions/core": "^2.0.3",
         "minimatch": "^3.0.4"
       }
     },
     "node_modules/@actions/http-client": {
-      "version": "4.0.0",
+      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-4.0.0.tgz",
+      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-3.0.2.tgz",
-      "integrity": "sha512-QuwPsgVMsD6qaPD57GLZi9sqzAZCtiJT8kVBCDpLtxhL5MydQ4gS+DrejtZZPdIYyB1e95uCK9Luyds7ybHI3g==",
+      "integrity": "sha512-JP38FYYpyqvUsz+Igqlc/JG6YO9PaKuvqjM3iGvaLqFnJ7TFmcLyy2IDrY0bI0qCQug8E9K+elv5ZNfw62ZJzA==",
       "license": "MIT",
       "dependencies": {
         "tunnel": "^0.0.6",
         "undici": "^6.23.0"
       }
     },
+    "node_modules/@actions/http-client/node_modules/undici": {
+      "version": "6.23.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.23.0.tgz",
+      "integrity": "sha512-VfQPToRA5FZs/qJxLIinmU59u0r7LXqoJkCzinq3ckNJp3vKEh7jTWN589YQ5+aoAC/TGRLyJLCPKcLQbM8r9g==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18.17"
+      }
+    },
     "node_modules/@actions/io": {
-      "version": "3.0.2",
+      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/@actions/io/-/io-3.0.2.tgz",
+      "resolved": "https://registry.npmjs.org/@actions/io/-/io-2.0.0.tgz",
-      "integrity": "sha512-nRBchcMM+QK1pdjO7/idu86rbJI5YHUKCvKs0KxnSYbVe3F51UfGxuZX4Qy/fWlp6l7gWFwIkrOzN+oUK03kfw==",
+      "integrity": "sha512-Jv33IN09XLO+0HS79aaODsvIRyduiF7NY/F6LYeK5oeUmrsz7aFdRphQjFoESF4jS7lMauDOttKALcpapVDIAg==",
       "license": "MIT"
     },
     "node_modules/@azure/abort-controller": {
-      "version": "2.1.2",
+      "version": "1.1.0",
-      "resolved": "https://registry.npmjs.org/@azure/abort-controller/-/abort-controller-2.1.2.tgz",
+      "resolved": "https://registry.npmjs.org/@azure/abort-controller/-/abort-controller-1.1.0.tgz",
-      "integrity": "sha512-nBrLsEWm4J2u5LpAPjxADTlq3trDgVZZXHNKabeXZtpq3d3AbN/KGO82R87rdDz5/lYB024rtEf10/q0urNgsA==",
+      "integrity": "sha512-TrRLIoSQVzfAJX9H1JeFjzAoDGcoK1IYX1UImfceTZpsyYfWr09Ss1aHW1y5TrrR3iq6RZLBwJ3E24uwPhwahw==",
       "license": "MIT",
       "dependencies": {
-        "tslib": "^2.6.2"
+        "tslib": "^2.2.0"
       },
       "engines": {
-        "node": ">=18.0.0"
+        "node": ">=12.0.0"
       }
     },
     "node_modules/@azure/core-auth": {
@@ -97,6 +107,18 @@
         "node": ">=20.0.0"
       }
     },
+    "node_modules/@azure/core-auth/node_modules/@azure/abort-controller": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/@azure/abort-controller/-/abort-controller-2.1.2.tgz",
+      "integrity": "sha512-nBrLsEWm4J2u5LpAPjxADTlq3trDgVZZXHNKabeXZtpq3d3AbN/KGO82R87rdDz5/lYB024rtEf10/q0urNgsA==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
     "node_modules/@azure/core-client": {
       "version": "1.10.1",
       "resolved": "https://registry.npmjs.org/@azure/core-client/-/core-client-1.10.1.tgz",
@@ -115,6 +137,18 @@
         "node": ">=20.0.0"
       }
     },
+    "node_modules/@azure/core-client/node_modules/@azure/abort-controller": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/@azure/abort-controller/-/abort-controller-2.1.2.tgz",
+      "integrity": "sha512-nBrLsEWm4J2u5LpAPjxADTlq3trDgVZZXHNKabeXZtpq3d3AbN/KGO82R87rdDz5/lYB024rtEf10/q0urNgsA==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
     "node_modules/@azure/core-http-compat": {
       "version": "2.3.1",
       "resolved": "https://registry.npmjs.org/@azure/core-http-compat/-/core-http-compat-2.3.1.tgz",
@@ -129,6 +163,18 @@
         "node": ">=20.0.0"
       }
     },
+    "node_modules/@azure/core-http-compat/node_modules/@azure/abort-controller": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/@azure/abort-controller/-/abort-controller-2.1.2.tgz",
+      "integrity": "sha512-nBrLsEWm4J2u5LpAPjxADTlq3trDgVZZXHNKabeXZtpq3d3AbN/KGO82R87rdDz5/lYB024rtEf10/q0urNgsA==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
     "node_modules/@azure/core-lro": {
       "version": "2.7.2",
       "resolved": "https://registry.npmjs.org/@azure/core-lro/-/core-lro-2.7.2.tgz",
@@ -144,6 +190,18 @@
         "node": ">=18.0.0"
       }
     },
+    "node_modules/@azure/core-lro/node_modules/@azure/abort-controller": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/@azure/abort-controller/-/abort-controller-2.1.2.tgz",
+      "integrity": "sha512-nBrLsEWm4J2u5LpAPjxADTlq3trDgVZZXHNKabeXZtpq3d3AbN/KGO82R87rdDz5/lYB024rtEf10/q0urNgsA==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
     "node_modules/@azure/core-paging": {
       "version": "1.6.2",
       "resolved": "https://registry.npmjs.org/@azure/core-paging/-/core-paging-1.6.2.tgz",
@@ -174,6 +232,18 @@
         "node": ">=20.0.0"
       }
     },
+    "node_modules/@azure/core-rest-pipeline/node_modules/@azure/abort-controller": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/@azure/abort-controller/-/abort-controller-2.1.2.tgz",
+      "integrity": "sha512-nBrLsEWm4J2u5LpAPjxADTlq3trDgVZZXHNKabeXZtpq3d3AbN/KGO82R87rdDz5/lYB024rtEf10/q0urNgsA==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
     "node_modules/@azure/core-tracing": {
       "version": "1.3.1",
       "resolved": "https://registry.npmjs.org/@azure/core-tracing/-/core-tracing-1.3.1.tgz",
@@ -200,6 +270,18 @@
         "node": ">=20.0.0"
       }
     },
+    "node_modules/@azure/core-util/node_modules/@azure/abort-controller": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/@azure/abort-controller/-/abort-controller-2.1.2.tgz",
+      "integrity": "sha512-nBrLsEWm4J2u5LpAPjxADTlq3trDgVZZXHNKabeXZtpq3d3AbN/KGO82R87rdDz5/lYB024rtEf10/q0urNgsA==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
     "node_modules/@azure/core-xml": {
       "version": "1.5.0",
       "resolved": "https://registry.npmjs.org/@azure/core-xml/-/core-xml-1.5.0.tgz",
@@ -227,9 +309,9 @@
       }
     },
     "node_modules/@azure/storage-blob": {
-      "version": "12.30.0",
+      "version": "12.29.1",
-      "resolved": "https://registry.npmjs.org/@azure/storage-blob/-/storage-blob-12.30.0.tgz",
+      "resolved": "https://registry.npmjs.org/@azure/storage-blob/-/storage-blob-12.29.1.tgz",
-      "integrity": "sha512-peDCR8blSqhsAKDbpSP/o55S4sheNwSrblvCaHUZ5xUI73XA7ieUGGwrONgD/Fng0EoDe1VOa3fAQ7+WGB3Ocg==",
+      "integrity": "sha512-7ktyY0rfTM0vo7HvtK6E3UvYnI9qfd6Oz6z/+92VhGRveWng3kJwMKeUpqmW/NmwcDNbxHpSlldG+vsUnRFnBg==",
       "license": "MIT",
       "dependencies": {
         "@azure/abort-controller": "^2.1.2",
@@ -243,7 +325,7 @@
         "@azure/core-util": "^1.11.0",
         "@azure/core-xml": "^1.4.5",
         "@azure/logger": "^1.1.4",
-        "@azure/storage-common": "^12.2.0",
+        "@azure/storage-common": "^12.1.1",
         "events": "^3.0.0",
         "tslib": "^2.8.1"
       },
@@ -251,10 +333,22 @@
         "node": ">=20.0.0"
       }
     },
+    "node_modules/@azure/storage-blob/node_modules/@azure/abort-controller": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/@azure/abort-controller/-/abort-controller-2.1.2.tgz",
+      "integrity": "sha512-nBrLsEWm4J2u5LpAPjxADTlq3trDgVZZXHNKabeXZtpq3d3AbN/KGO82R87rdDz5/lYB024rtEf10/q0urNgsA==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
     "node_modules/@azure/storage-common": {
-      "version": "12.2.0",
+      "version": "12.1.1",
-      "resolved": "https://registry.npmjs.org/@azure/storage-common/-/storage-common-12.2.0.tgz",
+      "resolved": "https://registry.npmjs.org/@azure/storage-common/-/storage-common-12.1.1.tgz",
-      "integrity": "sha512-YZLxiJ3vBAAnFbG3TFuAMUlxZRexjQX5JDQxOkFGb6e2TpoxH3xyHI6idsMe/QrWtj41U/KoqBxlayzhS+LlwA==",
+      "integrity": "sha512-eIOH1pqFwI6UmVNnDQvmFeSg0XppuzDLFeUNO/Xht7ODAzRLgGDh7h550pSxoA+lPDxBl1+D2m/KG3jWzCUjTg==",
       "license": "MIT",
       "dependencies": {
         "@azure/abort-controller": "^2.1.2",
@@ -271,6 +365,18 @@
         "node": ">=20.0.0"
       }
     },
+    "node_modules/@azure/storage-common/node_modules/@azure/abort-controller": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/@azure/abort-controller/-/abort-controller-2.1.2.tgz",
+      "integrity": "sha512-nBrLsEWm4J2u5LpAPjxADTlq3trDgVZZXHNKabeXZtpq3d3AbN/KGO82R87rdDz5/lYB024rtEf10/q0urNgsA==",
+      "license": "MIT",
+      "dependencies": {
+        "tslib": "^2.6.2"
+      },
+      "engines": {
+        "node": ">=18.0.0"
+      }
+    },
     "node_modules/@bufbuild/protobuf": {
       "version": "2.10.1",
       "resolved": "https://registry.npmjs.org/@bufbuild/protobuf/-/protobuf-2.10.1.tgz",
@@ -363,9 +469,9 @@
       }
     },
     "node_modules/@types/node": {
-      "version": "25.1.0",
+      "version": "24.10.2",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-25.1.0.tgz",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-24.10.2.tgz",
-      "integrity": "sha512-t7frlewr6+cbx+9Ohpl0NOTKXZNV9xHRmNOvql47BFJKcEG1CxtxlPEEe+gR9uhVWM4DwhnvTF110mIL4yP9RA==",
+      "integrity": "sha512-WOhQTZ4G8xZ1tjJTvKOpyEVSGgOTvJAfDK3FNFgELyaTpzhdgHVHeqW8V+UJvzF5BT+/B54T/1S2K6gd9c7bbA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -373,9 +479,9 @@
       }
     },
     "node_modules/@types/semver": {
-      "version": "7.7.1",
+      "version": "6.2.7",
-      "resolved": "https://registry.npmjs.org/@types/semver/-/semver-7.7.1.tgz",
+      "resolved": "https://registry.npmjs.org/@types/semver/-/semver-6.2.7.tgz",
-      "integrity": "sha512-FmgJfu+MOcQ370SD0ev7EI8TlCAfKYU+B4m5T3yXc1CiRN94g/SZPtsCkk506aUDtlMnFZvasDwHHUcZUEaYuA==",
+      "integrity": "sha512-blctEWbzUFzQx799RZjzzIdBJOXmE37YYEyDtKkx5Dg+V7o/zyyAxLPiI98A2jdTtDgxZleMdfV+7p8WbRJ1OQ==",
       "dev": true,
       "license": "MIT"
     },
@@ -526,15 +632,12 @@
       "license": "MIT"
     },
     "node_modules/semver": {
-      "version": "7.7.3",
+      "version": "6.3.1",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.7.3.tgz",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz",
-      "integrity": "sha512-SdsKMrI9TdgjdweUSR9MweHA4EJ8YxHn8DFaDisvhVlUOe4BF1tLD7GAj0lIqWVl+dPb/rExr0Btby5loQm20Q==",
+      "integrity": "sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==",
       "license": "ISC",
       "bin": {
         "semver": "bin/semver.js"
-      },
-      "engines": {
-        "node": ">=10"
       }
     },
     "node_modules/strnum": {
@@ -578,15 +681,6 @@
         "node": ">=14.17"
       }
     },
-    "node_modules/undici": {
-      "version": "6.23.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-6.23.0.tgz",
-      "integrity": "sha512-VfQPToRA5FZs/qJxLIinmU59u0r7LXqoJkCzinq3ckNJp3vKEh7jTWN589YQ5+aoAC/TGRLyJLCPKcLQbM8r9g==",
-      "license": "MIT",
-      "engines": {
-        "node": ">=18.17"
-      }
-    },
     "node_modules/undici-types": {
       "version": "7.16.0",
       "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.16.0.tgz",

packages/cache/package.json

@@ -1,6 +1,7 @@
 {
   "name": "@actions/cache",
-  "version": "6.0.0",
+  "version": "5.0.5",
+  "preview": true,
   "description": "Actions cache lib",
   "keywords": [
     "github",
@@ -9,15 +10,8 @@
   ],
   "homepage": "https://github.com/actions/toolkit/tree/main/packages/cache",
   "license": "MIT",
-  "type": "module",
   "main": "lib/cache.js",
   "types": "lib/cache.d.ts",
-  "exports": {
-    ".": {
-      "types": "./lib/cache.d.ts",
-      "import": "./lib/cache.js"
-    }
-  },
   "directories": {
     "lib": "lib",
     "test": "__tests__"
@@ -37,26 +31,27 @@
   "scripts": {
     "audit-moderate": "npm install && npm audit --json --audit-level=moderate > audit.json",
     "test": "echo \"Error: run tests from root\" && exit 1",
-    "tsc": "tsc && cp src/internal/shared/package-version.cjs lib/internal/shared/"
+    "tsc": "tsc"
   },
   "bugs": {
     "url": "https://github.com/actions/toolkit/issues"
   },
   "dependencies": {
-    "@actions/core": "^3.0.0",
+    "@actions/core": "^2.0.0",
-    "@actions/exec": "^3.0.0",
+    "@actions/exec": "^2.0.0",
-    "@actions/glob": "^0.6.1",
+    "@actions/glob": "^0.5.1",
-    "@actions/http-client": "^4.0.0",
-    "@actions/io": "^3.0.0",
-    "@azure/core-rest-pipeline": "^1.22.0",
-    "@azure/storage-blob": "^12.30.0",
     "@protobuf-ts/runtime-rpc": "^2.11.1",
-    "semver": "^7.7.3"
+    "@actions/http-client": "^3.0.2",
+    "@actions/io": "^2.0.0",
+    "@azure/abort-controller": "^1.1.0",
+    "@azure/core-rest-pipeline": "^1.22.0",
+    "@azure/storage-blob": "^12.29.1",
+    "semver": "^6.3.1"
   },
   "devDependencies": {
+    "@types/node": "^24.1.0",
+    "@types/semver": "^6.0.0",
     "@protobuf-ts/plugin": "^2.9.4",
-    "@types/node": "^25.1.0",
-    "@types/semver": "^7.7.1",
     "typescript": "^5.2.2"
   },
   "overrides": {

packages/cache/src/cache.ts

@@ -1,20 +1,18 @@
 import * as core from '@actions/core'
 import * as path from 'path'
-import * as utils from './internal/cacheUtils.js'
+import * as utils from './internal/cacheUtils'
-import * as cacheHttpClient from './internal/cacheHttpClient.js'
+import * as cacheHttpClient from './internal/cacheHttpClient'
-import * as cacheTwirpClient from './internal/shared/cacheTwirpClient.js'
+import * as cacheTwirpClient from './internal/shared/cacheTwirpClient'
-import {getCacheServiceVersion, isGhes} from './internal/config.js'
+import {getCacheServiceVersion, isGhes} from './internal/config'
-import {DownloadOptions, UploadOptions} from './options.js'
+import {DownloadOptions, UploadOptions} from './options'
-import {createTar, extractTar, listTar} from './internal/tar.js'
+import {createTar, extractTar, listTar} from './internal/tar'
 import {
   CreateCacheEntryRequest,
   FinalizeCacheEntryUploadRequest,
   FinalizeCacheEntryUploadResponse,
   GetCacheEntryDownloadURLRequest
-} from './generated/results/api/v1/cache.js'
+} from './generated/results/api/v1/cache'
 import {HttpClientError} from '@actions/http-client'
-
-export type {DownloadOptions, UploadOptions}
 export class ValidationError extends Error {
   constructor(message: string) {
     super(message)

packages/cache/src/generated/results/api/v1/cache.ts

@@ -12,7 +12,7 @@ import type { PartialMessage } from "@protobuf-ts/runtime";
 import { reflectionMergePartial } from "@protobuf-ts/runtime";
 import { MESSAGE_TYPE } from "@protobuf-ts/runtime";
 import { MessageType } from "@protobuf-ts/runtime";
-import { CacheMetadata } from "../../entities/v1/cachemetadata.js";
+import { CacheMetadata } from "../../entities/v1/cachemetadata";
 /**
  * @generated from protobuf message github.actions.results.api.v1.CreateCacheEntryRequest
  */

packages/cache/src/generated/results/api/v1/cache.twirp-client.ts

@@ -5,7 +5,7 @@ import {
     FinalizeCacheEntryUploadResponse,
     GetCacheEntryDownloadURLRequest,
     GetCacheEntryDownloadURLResponse,
-  } from "./cache.js";
+  } from "./cache";
   
   //==================================//
   //          Client Code             //

packages/cache/src/generated/results/entities/v1/cachemetadata.ts

@@ -11,7 +11,7 @@ import type { PartialMessage } from "@protobuf-ts/runtime";
 import { reflectionMergePartial } from "@protobuf-ts/runtime";
 import { MESSAGE_TYPE } from "@protobuf-ts/runtime";
 import { MessageType } from "@protobuf-ts/runtime";
-import { CacheScope } from "./cachescope.js";
+import { CacheScope } from "./cachescope";
 /**
  * @generated from protobuf message github.actions.results.entities.v1.CacheMetadata
  */

packages/cache/src/internal/cacheHttpClient.ts

@@ -7,8 +7,8 @@ import {
 } from '@actions/http-client/lib/interfaces'
 import * as fs from 'fs'
 import {URL} from 'url'
-import * as utils from './cacheUtils.js'
+import * as utils from './cacheUtils'
-import {uploadCacheArchiveSDK} from './uploadUtils.js'
+import {uploadCacheArchiveSDK} from './uploadUtils'
 import {
   ArtifactCacheEntry,
   InternalCacheOptions,
@@ -17,25 +17,25 @@ import {
   ReserveCacheResponse,
   ITypedResponseWithError,
   ArtifactCacheList
-} from './contracts.js'
+} from './contracts'
 import {
   downloadCacheHttpClient,
   downloadCacheHttpClientConcurrent,
   downloadCacheStorageSDK
-} from './downloadUtils.js'
+} from './downloadUtils'
 import {
   DownloadOptions,
   UploadOptions,
   getDownloadOptions,
   getUploadOptions
-} from '../options.js'
+} from '../options'
 import {
   isSuccessStatusCode,
   retryHttpClientResponse,
   retryTypedResponse
-} from './requestUtils.js'
+} from './requestUtils'
-import {getCacheServiceURL} from './config.js'
+import {getCacheServiceURL} from './config'
-import {getUserAgentString} from './shared/user-agent.js'
+import {getUserAgentString} from './shared/user-agent'
 
 function getCacheApiUrl(resource: string): string {
   const baseUrl: string = getCacheServiceURL()

packages/cache/src/internal/cacheUtils.ts

@@ -11,7 +11,7 @@ import {
   CacheFilename,
   CompressionMethod,
   GnuTarPathOnWindows
-} from './constants.js'
+} from './constants'
 
 const versionSalt = '1.0'
 

packages/cache/src/internal/contracts.d.ts

@@ -1,4 +1,4 @@
-import {CompressionMethod} from './constants.js'
+import {CompressionMethod} from './constants'
 import {TypedResponse} from '@actions/http-client/lib/interfaces'
 import {HttpClientError} from '@actions/http-client'
 

packages/cache/src/internal/downloadUtils.ts

@@ -7,10 +7,12 @@ import * as fs from 'fs'
 import * as stream from 'stream'
 import * as util from 'util'
 
-import * as utils from './cacheUtils.js'
+import * as utils from './cacheUtils'
-import {SocketTimeout} from './constants.js'
+import {SocketTimeout} from './constants'
-import {DownloadOptions} from '../options.js'
+import {DownloadOptions} from '../options'
-import {retryHttpClientResponse} from './requestUtils.js'
+import {retryHttpClientResponse} from './requestUtils'
+
+import {AbortController} from '@azure/abort-controller'
 
 /**
  * Pipes the body of a HTTP response to a stream

packages/cache/src/internal/requestUtils.ts

@@ -4,8 +4,8 @@ import {
   HttpClientError,
   HttpClientResponse
 } from '@actions/http-client'
-import {DefaultRetryDelay, DefaultRetryAttempts} from './constants.js'
+import {DefaultRetryDelay, DefaultRetryAttempts} from './constants'
-import {ITypedResponseWithError} from './contracts.js'
+import {ITypedResponseWithError} from './contracts'
 
 export function isSuccessStatusCode(statusCode?: number): boolean {
   if (!statusCode) {

packages/cache/src/internal/shared/cacheTwirpClient.ts

@@ -1,12 +1,12 @@
 import {info, debug, warning} from '@actions/core'
-import {getUserAgentString} from './user-agent.js'
+import {getUserAgentString} from './user-agent'
-import {NetworkError, RateLimitError, UsageError} from './errors.js'
+import {NetworkError, RateLimitError, UsageError} from './errors'
-import {getCacheServiceURL} from '../config.js'
+import {getCacheServiceURL} from '../config'
-import {getRuntimeToken} from '../cacheUtils.js'
+import {getRuntimeToken} from '../cacheUtils'
 import {BearerCredentialHandler} from '@actions/http-client/lib/auth'
 import {HttpClient, HttpClientResponse, HttpCodes} from '@actions/http-client'
-import {CacheServiceClientJSON} from '../../generated/results/api/v1/cache.twirp-client.js'
+import {CacheServiceClientJSON} from '../../generated/results/api/v1/cache.twirp-client'
-import {maskSecretUrls} from './util.js'
+import {maskSecretUrls} from './util'
 
 // The twirp http client must implement this interface
 interface Rpc {

packages/cache/src/internal/shared/package-version.cjs

@@ -1,7 +0,0 @@
-// This file exists as a CommonJS module to read the version from package.json.
-// In an ESM package, using `require()` directly in .ts files requires disabling
-// ESLint rules and doesn't work reliably across all Node.js versions.
-// By keeping this as a .cjs file, we can use require() naturally and export
-// the version for the ESM modules to import.
-const packageJson = require('../../../package.json')
-module.exports = { version: packageJson.version }

packages/cache/src/internal/shared/user-agent.ts

@@ -1,8 +1,9 @@
-import {version} from './package-version.cjs'
+// eslint-disable-next-line @typescript-eslint/no-var-requires, @typescript-eslint/no-require-imports
+const packageJson = require('../../../package.json')
 
 /**
  * Ensure that this User Agent String is used in all HTTP calls so that we can monitor telemetry between different versions of this package
  */
 export function getUserAgentString(): string {
-  return `@actions/cache-${version}`
+  return `@actions/cache-${packageJson.version}`
 }

packages/cache/src/internal/tar.ts

@@ -2,15 +2,15 @@ import {exec} from '@actions/exec'
 import * as io from '@actions/io'
 import {existsSync, writeFileSync} from 'fs'
 import * as path from 'path'
-import * as utils from './cacheUtils.js'
+import * as utils from './cacheUtils'
-import {ArchiveTool} from './contracts.js'
+import {ArchiveTool} from './contracts'
 import {
   CompressionMethod,
   SystemTarPathOnWindows,
   ArchiveToolType,
   TarFilename,
   ManifestFilename
-} from './constants.js'
+} from './constants'
 
 const IS_WINDOWS = process.platform === 'win32'
 

packages/cache/src/internal/uploadUtils.ts

@@ -6,8 +6,8 @@ import {
   BlockBlobParallelUploadOptions
 } from '@azure/storage-blob'
 import {TransferProgressEvent} from '@azure/core-rest-pipeline'
-import {InvalidResponseError} from './shared/errors.js'
+import {InvalidResponseError} from './shared/errors'
-import {UploadOptions} from '../options.js'
+import {UploadOptions} from '../options'
 
 /**
  * Class for tracking the upload state and displaying stats.

packages/cache/tsconfig.json

@@ -4,8 +4,6 @@
     "baseUrl": "./",
     "outDir": "./lib",
     "rootDir": "./src",
-    "module": "node16",
-    "moduleResolution": "node16",
     "lib": [
       "es6",
       "dom"

packages/glob/RELEASES.md

@@ -1,9 +1,5 @@
 # @actions/glob Releases
 
-## 0.6.1
-
-- Fix a bad import for `minimatch`
-
 ## 0.6.0
 
 - **Breaking change**: Package is now ESM-only

packages/glob/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@actions/glob",
-  "version": "0.6.1",
+  "version": "0.6.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@actions/glob",
-      "version": "0.6.1",
+      "version": "0.6.0",
       "license": "MIT",
       "dependencies": {
         "@actions/core": "^3.0.0",

packages/glob/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actions/glob",
-  "version": "0.6.1",
+  "version": "0.6.0",
   "preview": true,
   "description": "Actions glob lib",
   "keywords": [

packages/glob/src/internal-pattern.ts

@@ -2,14 +2,10 @@ import * as os from 'os'
 import * as path from 'path'
 import * as pathHelper from './internal-path-helper.js'
 import assert from 'assert'
-import minimatch from 'minimatch'
+import {Minimatch, IMinimatch, IOptions as IMinimatchOptions} from 'minimatch'
 import {MatchKind} from './internal-match-kind.js'
 import {Path} from './internal-path.js'
 
-type IMinimatch = minimatch.IMinimatch
-type IMinimatchOptions = minimatch.IOptions
-const {Minimatch} = minimatch
-
 const IS_WINDOWS = process.platform === 'win32'
 
 export class Pattern {