Fix json5 vuln

Update title with hint
Remove allow-list from audit
2023-01-03 13:37:01 +01:00 · 2023-01-03 13:36:38 +01:00 · 2023-01-03 13:34:55 +01:00 · 2023-01-03 13:33:43 +01:00 · 2023-01-03 11:58:29 +01:00 · 2022-12-27 16:00:28 +05:30
8 changed files with 62 additions and 66 deletions
@@ -31,9 +31,8 @@ jobs:
    - name: Bootstrap
      run: npm run bootstrap

-    - name: audit tools
-      # `|| npm audit` to pretty-print the output if vulnerabilies are found after filtering.
-      run: npm audit --audit-level=moderate --json | scripts/audit-allow-list || npm audit --audit-level=moderate
+    - name: audit tools (without allow-list)
+      run: npm audit --audit-level=moderate

    - name: audit packages
      run: npm run audit-all
@@ -40,7 +40,7 @@ jobs:
      run: npm run build

    - name: npm test
-      run: npm test
+      run: npm test -- --runInBand
      env:
        GITHUB_TOKEN: ${{ github.token }}

@@ -4964,12 +4964,6 @@
      "integrity": "sha512-8+KAKzEvSUdeo+kmqnKrqgeE+LcA0tjYWFY7RPProVYwnqDjukzO+3b6dLD56rYX5TdWejnEOLJYOIeh4CXKuA==",
      "dev": true
    },
-    "node_modules/@types/json5": {
-      "version": "0.0.29",
-      "resolved": "https://registry.npmjs.org/@types/json5/-/json5-0.0.29.tgz",
-      "integrity": "sha1-7ihweulOEdK4J7y+UnC86n8+ce4=",
-      "dev": true
-    },
    "node_modules/@types/minimatch": {
      "version": "3.0.5",
      "resolved": "https://registry.npmjs.org/@types/minimatch/-/minimatch-3.0.5.tgz",
@@ -12123,13 +12117,10 @@
      "dev": true
    },
    "node_modules/json5": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.0.tgz",
-      "integrity": "sha512-f+8cldu7X/y7RAJurMEJmdoKXGB/X550w2Nr3tTbezL6RwEE/iMcm+tZnXeoZtKuOq6ft8+CqzEkrIgx1fPoQA==",
+      "version": "2.2.3",
+      "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz",
+      "integrity": "sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==",
      "dev": true,
-      "dependencies": {
-        "minimist": "^1.2.5"
-      },
      "bin": {
        "json5": "lib/cli.js"
      },
@@ -16161,29 +16152,16 @@
      }
    },
    "node_modules/tsconfig-paths": {
-      "version": "3.9.0",
-      "resolved": "https://registry.npmjs.org/tsconfig-paths/-/tsconfig-paths-3.9.0.tgz",
-      "integrity": "sha512-dRcuzokWhajtZWkQsDVKbWyY+jgcLC5sqJhg2PSgf4ZkH2aHPvaOY8YWGhmjb68b5qqTfasSsDO9k7RUiEmZAw==",
+      "version": "3.10.1",
+      "resolved": "https://registry.npmjs.org/tsconfig-paths/-/tsconfig-paths-3.10.1.tgz",
+      "integrity": "sha512-rETidPDgCpltxF7MjBZlAFPUHv5aHH2MymyPvh+vEyWAED4Eb/WeMbsnD/JDr4OKPOA1TssDHgIcpTN5Kh0p6Q==",
      "dev": true,
      "dependencies": {
-        "@types/json5": "^0.0.29",
-        "json5": "^1.0.1",
+        "json5": "^2.2.0",
        "minimist": "^1.2.0",
        "strip-bom": "^3.0.0"
      }
    },
-    "node_modules/tsconfig-paths/node_modules/json5": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/json5/-/json5-1.0.1.tgz",
-      "integrity": "sha512-aKS4WQjPenRxiQsC93MNfjx+nbF4PAdYzmd/1JIj8HYzqfbu86beTuNgXDzPknWk0n0uARlyewZo4s++ES36Ow==",
-      "dev": true,
-      "dependencies": {
-        "minimist": "^1.2.0"
-      },
-      "bin": {
-        "json5": "lib/cli.js"
-      }
-    },
    "node_modules/tslib": {
      "version": "1.9.3",
      "resolved": "https://registry.npmjs.org/tslib/-/tslib-1.9.3.tgz",
@@ -20852,12 +20830,6 @@
      "integrity": "sha512-8+KAKzEvSUdeo+kmqnKrqgeE+LcA0tjYWFY7RPProVYwnqDjukzO+3b6dLD56rYX5TdWejnEOLJYOIeh4CXKuA==",
      "dev": true
    },
-    "@types/json5": {
-      "version": "0.0.29",
-      "resolved": "https://registry.npmjs.org/@types/json5/-/json5-0.0.29.tgz",
-      "integrity": "sha1-7ihweulOEdK4J7y+UnC86n8+ce4=",
-      "dev": true
-    },
    "@types/minimatch": {
      "version": "3.0.5",
      "resolved": "https://registry.npmjs.org/@types/minimatch/-/minimatch-3.0.5.tgz",
@@ -26283,13 +26255,10 @@
      "dev": true
    },
    "json5": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.0.tgz",
-      "integrity": "sha512-f+8cldu7X/y7RAJurMEJmdoKXGB/X550w2Nr3tTbezL6RwEE/iMcm+tZnXeoZtKuOq6ft8+CqzEkrIgx1fPoQA==",
-      "dev": true,
-      "requires": {
-        "minimist": "^1.2.5"
-      }
+      "version": "2.2.3",
+      "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz",
+      "integrity": "sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==",
+      "dev": true
    },
    "jsonc-parser": {
      "version": "3.2.0",
@@ -29331,26 +29300,14 @@
      }
    },
    "tsconfig-paths": {
-      "version": "3.9.0",
-      "resolved": "https://registry.npmjs.org/tsconfig-paths/-/tsconfig-paths-3.9.0.tgz",
-      "integrity": "sha512-dRcuzokWhajtZWkQsDVKbWyY+jgcLC5sqJhg2PSgf4ZkH2aHPvaOY8YWGhmjb68b5qqTfasSsDO9k7RUiEmZAw==",
+      "version": "3.10.1",
+      "resolved": "https://registry.npmjs.org/tsconfig-paths/-/tsconfig-paths-3.10.1.tgz",
+      "integrity": "sha512-rETidPDgCpltxF7MjBZlAFPUHv5aHH2MymyPvh+vEyWAED4Eb/WeMbsnD/JDr4OKPOA1TssDHgIcpTN5Kh0p6Q==",
      "dev": true,
      "requires": {
-        "@types/json5": "^0.0.29",
-        "json5": "^1.0.1",
+        "json5": "^2.2.0",
        "minimist": "^1.2.0",
        "strip-bom": "^3.0.0"
-      },
-      "dependencies": {
-        "json5": {
-          "version": "1.0.1",
-          "resolved": "https://registry.npmjs.org/json5/-/json5-1.0.1.tgz",
-          "integrity": "sha512-aKS4WQjPenRxiQsC93MNfjx+nbF4PAdYzmd/1JIj8HYzqfbu86beTuNgXDzPknWk0n0uARlyewZo4s++ES36Ow==",
-          "dev": true,
-          "requires": {
-            "minimist": "^1.2.0"
-          }
-        }
      }
    },
    "tslib": {
@@ -1,12 +1,12 @@
 {
  "name": "@actions/cache",
-  "version": "3.0.6",
+  "version": "3.1.1",
  "lockfileVersion": 2,
  "requires": true,
  "packages": {
    "": {
      "name": "@actions/cache",
-      "version": "3.0.6",
+      "version": "3.1.1",
      "license": "MIT",
      "dependencies": {
        "@actions/core": "^1.10.0",
@@ -1,6 +1,6 @@
 {
  "name": "@actions/cache",
-  "version": "3.0.6",
+  "version": "3.1.1",
  "preview": true,
  "description": "Actions cache lib",
  "keywords": [
@@ -17,7 +17,8 @@ import {
  CommitCacheRequest,
  ReserveCacheRequest,
  ReserveCacheResponse,
-  ITypedResponseWithError
+  ITypedResponseWithError,
+  ArtifactCacheList
 } from './contracts'
 import {downloadCacheHttpClient, downloadCacheStorageSDK} from './downloadUtils'
 import {
@@ -104,6 +105,10 @@ export async function getCacheEntry(
    httpClient.getJson<ArtifactCacheEntry>(getCacheApiUrl(resource))
  )
  if (response.statusCode === 204) {
+    // List cache for primary key only if cache miss occurs
+    if (core.isDebug()) {
+      await printCachesListForDiagnostics(keys[0], httpClient, version)
+    }
    return null
  }
  if (!isSuccessStatusCode(response.statusCode)) {
@@ -122,6 +127,31 @@ export async function getCacheEntry(
  return cacheResult
 }

+async function printCachesListForDiagnostics(
+  key: string,
+  httpClient: HttpClient,
+  version: string
+): Promise<void> {
+  const resource = `caches?key=${encodeURIComponent(key)}`
+  const response = await retryTypedResponse('listCache', async () =>
+    httpClient.getJson<ArtifactCacheList>(getCacheApiUrl(resource))
+  )
+  if (response.statusCode === 200) {
+    const cacheListResult = response.result
+    const totalCount = cacheListResult?.totalCount
+    if (totalCount && totalCount > 0) {
+      core.debug(
+        `No matching cache found for cache key '${key}', version '${version} and scope ${process.env['GITHUB_REF']}. There exist one or more cache(s) with similar key but they have different version or scope. See more info on cache matching here: https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows#matching-a-cache-key \nOther caches with similar key:`
+      )
+      for (const cacheEntry of cacheListResult?.artifactCaches || []) {
+        core.debug(
+          `Cache Key: ${cacheEntry?.cacheKey}, Cache Version: ${cacheEntry?.cacheVersion}, Cache Scope: ${cacheEntry?.scope}, Cache Created: ${cacheEntry?.creationTime}`
+        )
+      }
+    }
+  }
+}
+
 export async function downloadCache(
  archiveLocation: string,
  archivePath: string,
@@ -9,10 +9,16 @@ export interface ITypedResponseWithError<T> extends TypedResponse<T> {
 export interface ArtifactCacheEntry {
  cacheKey?: string
  scope?: string
+  cacheVersion?: string
  creationTime?: string
  archiveLocation?: string
 }

+export interface ArtifactCacheList {
+  totalCount: number
+  artifactCaches?: ArtifactCacheEntry[]
+}
+
 export interface CommitCacheRequest {
  size: number
 }
@@ -1,5 +1,9 @@
 #!/usr/bin/env node

+// NEEDS TO BE UPDATED TO WORK ON NODE 16 BECAUSE NPM AUDIT --JSON OUTPUT CHANGED
+// THE AUDIT WORKFLOW IS ONLY RUN ON PRS, BUT IT CAN BE IGNORED AND A RELEASE CAN BE CREATED NONETHELESS
+// @fhammerl @rentziass
+
 /*
 This script takes the output of npm audit --json from stdin
 and writes a filtered version to stdout.
Author	SHA1	Message	Date
Ferenc Hammerl	4ea08312c6	Fix json5 vuln	2023-01-03 13:37:01 +01:00
Ferenc Hammerl	5e9bcaca7c	Update title with hint	2023-01-03 13:36:38 +01:00
Ferenc Hammerl	af2d2ff198	Remove allow-list from audit Releases can be made or PRs can be merged even if the workflow is failing	2023-01-03 13:34:55 +01:00
Ferenc Hammerl	3d46598e70	Add disabling explanation in audit-allow-list	2023-01-03 13:33:43 +01:00
Ferenc Hammerl	894a0490f9	Merge branch 'main' of https://github.com/actions/toolkit into fhammerl/node-v16-and-toolkit-fixes	2023-01-03 11:58:29 +01:00
Sampark Sharma	86fe4abd8e	Revert "Cache package release for compression change in windows" (#1289 ) * Revert "Cache package release for compression change in windows (#1281)" This reverts commit `b228732644`. * Update release version to patch	2022-12-27 16:00:28 +05:30
Sampark Sharma	b228732644	Cache package release for compression change in windows (#1281 ) * bsd + zstd fallback implementation * bsd + zstd fallback implementation * Fix tar operations * Add -v option for testing * Fix order of args for tar * Add GNUtar as default on windows * Fix test * Fix tar tests * Fix lint issues * Fix windows gnutar test case * Temporarily remove thhe condition that prevents zstd usage on windows unless with GNUtar * Address some comments and correct compression commands * Add windows bsdtar test * Fix windows test * Fix test * Separate args * Fix old tests * Add new tests * Fix tests * Fix lint test * Refactor code * Address review comments * Fix test * Fix tar test * Add await to async function calls * Fix test * Update for beta release * Fix audit issues * Add fallback to gzip compression if cache not found * Fix test * Add test * Address review comments * Revert Address review comments * Release 3.1.0-beta.2 cache package * Fix issues * Reconfigure catch block * Add debug logging for gzip fall back * Fix test * Add end to end test for cache using bsd on windows and address review comments * Fix test * Fix test * Fix tests * Add better comments * Update packages/cache/src/internal/cacheHttpClient.ts Co-authored-by: Bishal Prasad <bishal-pdmsft@github.com> * Address review comments * Update for new beta cache package release * Address bugbash issues * Fix tests * Release new actions/cache minor version Co-authored-by: Lovepreet Singh <pdotl@github.com> Co-authored-by: Bishal Prasad <bishal-pdmsft@github.com>	2022-12-22 20:47:35 +05:30
Sampark Sharma	2a4f3544ad	Merge pull request #1234 from actions/phantsure/version-logging Add logs for cache version on miss	2022-12-22 11:48:58 +05:30
Sampark Sharma	c23fe4b81f	FIx test	2022-12-21 10:30:22 +00:00
Sampark Sharma	034d154f88	Merge branch 'phantsure/version-logging' of https://github.com/actions/toolkit into phantsure/version-logging	2022-12-21 10:27:13 +00:00
Sampark Sharma	ccfa36f304	Address review comments	2022-12-21 10:24:52 +00:00
Ferenc Hammerl	2afea665ed	Try sequential jest tests	2022-12-20 16:32:59 +01:00
Sampark Sharma	e96dc8a69a	Update packages/cache/src/internal/cacheHttpClient.ts Co-authored-by: Bishal Prasad <bishal-pdmsft@github.com>	2022-12-16 18:17:37 +05:30
Sampark Sharma	b8c50aa82d	Fix response code	2022-12-16 05:55:53 +00:00
Sampark Sharma	24685611e2	Add current scope from github ref	2022-12-16 05:54:48 +00:00
Sampark Sharma	e559a15ca6	Fix test	2022-12-13 11:36:10 +00:00
Sampark Sharma	816c1b3760	Fix tests	2022-12-13 11:25:40 +00:00
Sampark Sharma	b9d1dd898e	Address review comments	2022-11-15 11:04:24 +00:00
Sampark Sharma	aaac0e6c98	Address review comments	2022-11-15 10:32:24 +00:00
Sampark Sharma	a735d9bcd4	Add logs for cache version on miss	2022-11-14 06:31:26 +00:00