increasing cache limit size to 10gb

* OIDC Client for actions/core

Co-authored-by: Sourav Chanduka <[email protected]>
Co-authored-by: Sourav Chanduka <[email protected]>
Co-authored-by: Tingluo Huang <[email protected]>

packages/artifact/package-lock.json

@@ -4,11 +4,6 @@
   "lockfileVersion": 1,
   "requires": true,
   "dependencies": {
-    "@actions/core": {
-      "version": "1.2.6",
-      "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.2.6.tgz",
-      "integrity": "sha512-ZQYitnqiyBc3D+k7LsgSBmMDVkOVidaagDG7j3fOym77jNunWRuYx7VSHa9GNfFZh+zh61xsCjRj4JxMZlDqTA=="
-    },
     "@actions/http-client": {
       "version": "1.0.11",
       "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-1.0.11.tgz",

packages/cache/__tests__/saveCache.test.ts

@@ -46,7 +46,7 @@ test('save with large cache outputs should fail', async () => {
 
   const createTarMock = jest.spyOn(tar, 'createTar')
 
-  const cacheSize = 6 * 1024 * 1024 * 1024 //~6GB, over the 5GB limit
+  const cacheSize = 11 * 1024 * 1024 * 1024 //~11GB, over the 10GB limit
   jest
     .spyOn(cacheUtils, 'getArchiveFileSizeInBytes')
     .mockReturnValueOnce(cacheSize)
@@ -56,7 +56,7 @@ test('save with large cache outputs should fail', async () => {
     .mockReturnValueOnce(Promise.resolve(compression))
 
   await expect(saveCache([filePath], primaryKey)).rejects.toThrowError(
-    'Cache size of ~6144 MB (6442450944 B) is over the 5GB limit, not saving cache.'
+    'Cache size of ~11264 MB (11811160064 B) is over the 10GB limit, not saving cache.'
   )
 
   const archiveFolder = '/foo/bar'

packages/cache/package-lock.json

@@ -9,14 +9,6 @@
       "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.2.6.tgz",
       "integrity": "sha512-ZQYitnqiyBc3D+k7LsgSBmMDVkOVidaagDG7j3fOym77jNunWRuYx7VSHa9GNfFZh+zh61xsCjRj4JxMZlDqTA=="
     },
-    "@actions/exec": {
-      "version": "1.0.4",
-      "resolved": "https://registry.npmjs.org/@actions/exec/-/exec-1.0.4.tgz",
-      "integrity": "sha512-4DPChWow9yc9W3WqEbUj8Nr86xkpyE29ZzWjXucHItclLbEW6jr80Zx4nqv18QL6KK65+cifiQZXvnqgTV6oHw==",
-      "requires": {
-        "@actions/io": "^1.0.1"
-      }
-    },
     "@actions/glob": {
       "version": "0.1.0",
       "resolved": "https://registry.npmjs.org/@actions/glob/-/glob-0.1.0.tgz",
@@ -4205,11 +4197,6 @@
         }
       }
     },
-    "@actions/io": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/@actions/io/-/io-1.0.2.tgz",
-      "integrity": "sha512-J8KuFqVPr3p6U8W93DOXlXW6zFvrQAJANdS+vw0YhusLIq+bszW8zmK2Fh1C2kDPX8FMvwIl1OUcFgvJoXLbAg=="
-    },
     "@azure/abort-controller": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/@azure/abort-controller/-/abort-controller-1.0.1.tgz",

packages/cache/src/cache.ts

@@ -172,14 +172,14 @@ export async function saveCache(
       await listTar(archivePath, compressionMethod)
     }
 
-    const fileSizeLimit = 5 * 1024 * 1024 * 1024 // 5GB per repo limit
+    const fileSizeLimit = 10 * 1024 * 1024 * 1024 // 5GB per repo limit
     const archiveFileSize = utils.getArchiveFileSizeInBytes(archivePath)
     core.debug(`File Size: ${archiveFileSize}`)
     if (archiveFileSize > fileSizeLimit) {
       throw new Error(
         `Cache size of ~${Math.round(
           archiveFileSize / (1024 * 1024)
-        )} MB (${archiveFileSize} B) is over the 5GB limit, not saving cache.`
+        )} MB (${archiveFileSize} B) is over the 10GB limit, not saving cache.`
       )
     }
 

packages/core/README.md

@@ -142,6 +142,11 @@ export interface AnnotationProperties {
    */
   title?: string
 
+  /**
+   * The name of the file for which the annotation should be created.
+   */
+  file?: string
+
   /**
    * The start line for the annotation.
    */
@@ -257,3 +262,51 @@ var pid = core.getState("pidToKill");
 
 process.kill(pid);
 ```
+
+#### OIDC Token
+
+You can use these methods to interact with the GitHub OIDC provider and get a JWT ID token which would help to get access token from third party cloud providers.
+
+**Method Name**: getIDToken()
+
+**Inputs**
+
+audience : optional
+
+**Outputs**
+
+A [JWT](https://jwt.io/) ID Token
+
+In action's `main.ts`:
+```js
+const core = require('@actions/core');
+async function getIDTokenAction(): Promise<void> {
+  
+   const audience = core.getInput('audience', {required: false})
+   
+   const id_token1 = await core.getIDToken()            // ID Token with default audience
+   const id_token2 = await core.getIDToken(audience)    // ID token with custom audience
+   
+   // this id_token can be used to get access token from third party cloud providers
+}
+getIDTokenAction()
+```
+
+In action's `actions.yml`:
+
+```yaml
+name: 'GetIDToken'
+description: 'Get ID token from Github OIDC provider'
+inputs:
+  audience:  
+    description: 'Audience for which the ID token is intended for'
+    required: false
+outputs:
+  id_token1: 
+    description: 'ID token obtained from OIDC provider'
+  id_token2: 
+    description: 'ID token obtained from OIDC provider'
+runs:
+  using: 'node12'
+  main: 'dist/index.js'
+```

packages/core/RELEASES.md

@@ -1,5 +1,9 @@
 # @actions/core Releases
 
+### 1.6.0
+- [Added OIDC Client function `getIDToken`](https://github.com/actions/toolkit/pull/919)
+- [Added `file` parameter to `AnnotationProperties`](https://github.com/actions/toolkit/pull/896) 
+
 ### 1.5.0
 - [Added support for notice annotations and more annotation fields](https://github.com/actions/toolkit/pull/855)
 

packages/core/__tests__/core.test.ts

@@ -2,6 +2,7 @@ import * as fs from 'fs'
 import * as os from 'os'
 import * as path from 'path'
 import * as core from '../src/core'
+import {HttpClient} from '@actions/http-client'
 import {toCommandProperties} from '../src/utils'
 
 /* eslint-disable @typescript-eslint/unbound-method */
@@ -274,13 +275,14 @@ describe('@actions/core', () => {
     const message = 'this is my error message'
     core.error(new Error(message), {
       title: 'A title',
+      file: 'root/test.txt',
       startColumn: 1,
       endColumn: 2,
       startLine: 5,
       endLine: 5
     })
     assertWriteCalls([
-      `::error title=A title,line=5,endLine=5,col=1,endColumn=2::Error: ${message}${os.EOL}`
+      `::error title=A title,file=root/test.txt,line=5,endLine=5,col=1,endColumn=2::Error: ${message}${os.EOL}`
     ])
   })
 
@@ -304,25 +306,59 @@ describe('@actions/core', () => {
     const message = 'this is my error message'
     core.warning(new Error(message), {
       title: 'A title',
+      file: 'root/test.txt',
       startColumn: 1,
       endColumn: 2,
       startLine: 5,
       endLine: 5
     })
     assertWriteCalls([
-      `::warning title=A title,line=5,endLine=5,col=1,endColumn=2::Error: ${message}${os.EOL}`
+      `::warning title=A title,file=root/test.txt,line=5,endLine=5,col=1,endColumn=2::Error: ${message}${os.EOL}`
+    ])
+  })
+
+  it('notice sets the correct message', () => {
+    core.notice('Notice')
+    assertWriteCalls([`::notice::Notice${os.EOL}`])
+  })
+
+  it('notice escapes the message', () => {
+    core.notice('\r\nnotice\n')
+    assertWriteCalls([`::notice::%0D%0Anotice%0A${os.EOL}`])
+  })
+
+  it('notice handles an error object', () => {
+    const message = 'this is my error message'
+    core.notice(new Error(message))
+    assertWriteCalls([`::notice::Error: ${message}${os.EOL}`])
+  })
+
+  it('notice handles parameters correctly', () => {
+    const message = 'this is my error message'
+    core.notice(new Error(message), {
+      title: 'A title',
+      file: 'root/test.txt',
+      startColumn: 1,
+      endColumn: 2,
+      startLine: 5,
+      endLine: 5
+    })
+    assertWriteCalls([
+      `::notice title=A title,file=root/test.txt,line=5,endLine=5,col=1,endColumn=2::Error: ${message}${os.EOL}`
     ])
   })
 
   it('annotations map field names correctly', () => {
     const commandProperties = toCommandProperties({
       title: 'A title',
+      file: 'root/test.txt',
       startColumn: 1,
       endColumn: 2,
       startLine: 5,
       endLine: 5
     })
     expect(commandProperties.title).toBe('A title')
+    expect(commandProperties.file).toBe('root/test.txt')
     expect(commandProperties.col).toBe(1)
     expect(commandProperties.endColumn).toBe(2)
     expect(commandProperties.line).toBe(5)
@@ -434,3 +470,20 @@ function verifyFileCommand(command: string, expectedContents: string): void {
     fs.unlinkSync(filePath)
   }
 }
+
+function getTokenEndPoint(): string {
+  return 'https://vstoken.actions.githubusercontent.com/.well-known/openid-configuration'
+}
+
+describe('oidc-client-tests', () => {
+  it('Get Http Client', async () => {
+    const http = new HttpClient('actions/oidc-client')
+    expect(http).toBeDefined()
+  })
+
+  it('HTTP get request to get token endpoint', async () => {
+    const http = new HttpClient('actions/oidc-client')
+    const res = await http.get(getTokenEndPoint())
+    expect(res.message.statusCode).toBe(200)
+  })
+})

packages/core/package-lock.json

@@ -1,14 +1,27 @@
 {
   "name": "@actions/core",
-  "version": "1.4.0",
+  "version": "1.6.0",
   "lockfileVersion": 1,
   "requires": true,
   "dependencies": {
+    "@actions/http-client": {
+      "version": "1.0.11",
+      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-1.0.11.tgz",
+      "integrity": "sha512-VRYHGQV1rqnROJqdMvGUbY/Kn8vriQe/F9HR2AlYHzmKuM/p3kjNuXhmdBfcVgsvRWTz5C5XW5xvndZrVBuAYg==",
+      "requires": {
+        "tunnel": "0.0.6"
+      }
+    },
     "@types/node": {
       "version": "12.0.2",
       "resolved": "https://registry.npmjs.org/@types/node/-/node-12.0.2.tgz",
       "integrity": "sha512-5tabW/i+9mhrfEOUcLDu2xBPsHJ+X5Orqy9FKpale3SjDA17j5AEpYq5vfy3oAeAHGcvANRCO3NV3d2D6q3NiA==",
       "dev": true
+    },
+    "tunnel": {
+      "version": "0.0.6",
+      "resolved": "https://registry.npmjs.org/tunnel/-/tunnel-0.0.6.tgz",
+      "integrity": "sha512-1h/Lnq9yajKY2PEbBadPXj3VxsDDu844OnaAo52UVmIzIvwwtBPIuNvkjuzBlTWpfJyUbG3ez0KSBibQkj4ojg=="
     }
   }
 }

packages/core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actions/core",
-  "version": "1.5.0",
+  "version": "1.6.0",
   "description": "Actions core lib",
   "keywords": [
     "github",
@@ -35,6 +35,9 @@
   "bugs": {
     "url": "https://github.com/actions/toolkit/issues"
   },
+  "dependencies": {
+    "@actions/http-client": "^1.0.11"
+  },
   "devDependencies": {
     "@types/node": "^12.0.2"
   }

packages/core/src/core.ts

@@ -5,6 +5,8 @@ import {toCommandProperties, toCommandValue} from './utils'
 import * as os from 'os'
 import * as path from 'path'
 
+import {OidcClient} from './oidc-utils'
+
 /**
  * Interface for getInput options
  */
@@ -41,6 +43,11 @@ export interface AnnotationProperties {
    */
   title?: string
 
+  /**
+   * The path of the file for which the annotation should be created.
+   */
+  file?: string
+
   /**
    * The start line for the annotation.
    */
@@ -348,3 +355,7 @@ export function saveState(name: string, value: any): void {
 export function getState(name: string): string {
   return process.env[`STATE_${name}`] || ''
 }
+
+export async function getIDToken(aud?: string): Promise<string> {
+  return await OidcClient.getIDToken(aud)
+}

packages/core/src/oidc-utils.ts

@@ -0,0 +1,84 @@
+/* eslint-disable @typescript-eslint/no-extraneous-class */
+import * as actions_http_client from '@actions/http-client'
+import {IRequestOptions} from '@actions/http-client/interfaces'
+import {HttpClient} from '@actions/http-client'
+import {BearerCredentialHandler} from '@actions/http-client/auth'
+import {debug, setSecret} from './core'
+interface TokenResponse {
+  value?: string
+}
+
+export class OidcClient {
+  private static createHttpClient(
+    allowRetry = true,
+    maxRetry = 10
+  ): actions_http_client.HttpClient {
+    const requestOptions: IRequestOptions = {
+      allowRetries: allowRetry,
+      maxRetries: maxRetry
+    }
+
+    return new HttpClient(
+      'actions/oidc-client',
+      [new BearerCredentialHandler(OidcClient.getRequestToken())],
+      requestOptions
+    )
+  }
+
+  private static getRequestToken(): string {
+    const token = process.env['ACTIONS_ID_TOKEN_REQUEST_TOKEN']
+    if (!token) {
+      throw new Error(
+        'Unable to get ACTIONS_ID_TOKEN_REQUEST_TOKEN env variable'
+      )
+    }
+    return token
+  }
+
+  private static getIDTokenUrl(): string {
+    const runtimeUrl = process.env['ACTIONS_ID_TOKEN_REQUEST_URL']
+    if (!runtimeUrl) {
+      throw new Error('Unable to get ACTIONS_ID_TOKEN_REQUEST_URL env variable')
+    }
+    return runtimeUrl
+  }
+
+  private static async getCall(id_token_url: string): Promise<string> {
+    const httpclient = OidcClient.createHttpClient()
+
+    const res = await httpclient
+      .getJson<TokenResponse>(id_token_url)
+      .catch(error => {
+        throw new Error(
+          `Failed to get ID Token. \n 
+        Error Code : ${error.statusCode}\n 
+        Error Message: ${error.result.message}`
+        )
+      })
+
+    const id_token = res.result?.value
+    if (!id_token) {
+      throw new Error('Response json body do not have ID Token field')
+    }
+    return id_token
+  }
+
+  static async getIDToken(audience?: string): Promise<string> {
+    try {
+      // New ID Token is requested from action service
+      let id_token_url: string = OidcClient.getIDTokenUrl()
+      if (audience) {
+        const encodedAudience = encodeURIComponent(audience)
+        id_token_url = `${id_token_url}&audience=${encodedAudience}`
+      }
+
+      debug(`ID token url is ${id_token_url}`)
+
+      const id_token = await OidcClient.getCall(id_token_url)
+      setSecret(id_token)
+      return id_token
+    } catch (error) {
+      throw new Error(`Error message: ${error.message}`)
+    }
+  }
+}

packages/core/src/utils.ts

@@ -32,6 +32,7 @@ export function toCommandProperties(
 
   return {
     title: annotationProperties.title,
+    file: annotationProperties.file,
     line: annotationProperties.startLine,
     endLine: annotationProperties.endLine,
     col: annotationProperties.startColumn,

packages/glob/package-lock.json

@@ -4,11 +4,6 @@
 	"lockfileVersion": 1,
 	"requires": true,
 	"dependencies": {
-		"@actions/core": {
-			"version": "1.2.6",
-			"resolved": "https://registry.npmjs.org/@actions/core/-/core-1.2.6.tgz",
-			"integrity": "sha512-ZQYitnqiyBc3D+k7LsgSBmMDVkOVidaagDG7j3fOym77jNunWRuYx7VSHa9GNfFZh+zh61xsCjRj4JxMZlDqTA=="
-		},
 		"balanced-match": {
 			"version": "1.0.0",
 			"resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.0.tgz",

packages/tool-cache/package-lock.json

@@ -4,19 +4,6 @@
 	"lockfileVersion": 1,
 	"requires": true,
 	"dependencies": {
-		"@actions/core": {
-			"version": "1.2.6",
-			"resolved": "https://registry.npmjs.org/@actions/core/-/core-1.2.6.tgz",
-			"integrity": "sha512-ZQYitnqiyBc3D+k7LsgSBmMDVkOVidaagDG7j3fOym77jNunWRuYx7VSHa9GNfFZh+zh61xsCjRj4JxMZlDqTA=="
-		},
-		"@actions/exec": {
-			"version": "1.0.3",
-			"resolved": "https://registry.npmjs.org/@actions/exec/-/exec-1.0.3.tgz",
-			"integrity": "sha512-TogJGnueOmM7ntCi0ASTUj4LapRRtDfj57Ja4IhPmg2fls28uVOPbAn8N+JifaOumN2UG3oEO/Ixek2A4NcYSA==",
-			"requires": {
-				"@actions/io": "^1.0.1"
-			}
-		},
 		"@actions/http-client": {
 			"version": "1.0.8",
 			"resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-1.0.8.tgz",
@@ -25,11 +12,6 @@
 				"tunnel": "0.0.6"
 			}
 		},
-		"@actions/io": {
-			"version": "1.1.1",
-			"resolved": "https://registry.npmjs.org/@actions/io/-/io-1.1.1.tgz",
-			"integrity": "sha512-Qi4JoKXjmE0O67wAOH6y0n26QXhMKMFo7GD/4IXNVcrtLjUlGjGuVys6pQgwF3ArfGTQu0XpqaNr0YhED2RaRA=="
-		},
 		"@types/nock": {
 			"version": "10.0.3",
 			"resolved": "https://registry.npmjs.org/@types/nock/-/nock-10.0.3.tgz",