Fix audit issues

packages/cache/RELEASES.md

@@ -91,3 +91,6 @@
 
 ### 3.0.6
 - Added `@azure/abort-controller` to dependencies to fix compatibility issue with ESM [#1208](https://github.com/actions/toolkit/issues/1208)
+
+### 3.1.0-beta.1
+- Update actions/cache on windows to use gnu tar and zstd by default and fallback to bsdtar and zstd if gnu tar is not available. ([issue](https://github.com/actions/cache/issues/984))

packages/cache/__tests__/restoreCache.test.ts

@@ -161,81 +161,6 @@ test('restore with gzip compressed cache found', async () => {
   expect(getCompressionMock).toHaveBeenCalledTimes(1)
 })
 
-test('restore with zstd as default but gzip compressed cache found on windows', async () => {
-  if (process.platform === 'win32') {
-    const paths = ['node_modules']
-    const key = 'node-test'
-
-    const cacheEntry: ArtifactCacheEntry = {
-      cacheKey: key,
-      scope: 'refs/heads/main',
-      archiveLocation: 'www.actionscache.test/download'
-    }
-    const getCacheMock = jest.spyOn(cacheHttpClient, 'getCacheEntry')
-    getCacheMock
-      .mockImplementationOnce(async () => {
-        throw new Error('Cache not found.')
-      })
-      .mockImplementationOnce(async () => {
-        return Promise.resolve(cacheEntry)
-      })
-
-    const tempPath = '/foo/bar'
-
-    const createTempDirectoryMock = jest.spyOn(
-      cacheUtils,
-      'createTempDirectory'
-    )
-    createTempDirectoryMock.mockImplementation(async () => {
-      return Promise.resolve(tempPath)
-    })
-
-    const archivePath = path.join(tempPath, CacheFilename.Gzip)
-    const downloadCacheMock = jest.spyOn(cacheHttpClient, 'downloadCache')
-
-    const fileSize = 142
-    const getArchiveFileSizeInBytesMock = jest
-      .spyOn(cacheUtils, 'getArchiveFileSizeInBytes')
-      .mockReturnValue(fileSize)
-
-    const extractTarMock = jest.spyOn(tar, 'extractTar')
-    const unlinkFileMock = jest.spyOn(cacheUtils, 'unlinkFile')
-
-    const compression = CompressionMethod.Zstd
-    const getCompressionMock = jest
-      .spyOn(cacheUtils, 'getCompressionMethod')
-      .mockReturnValue(Promise.resolve(compression))
-
-    const cacheKey = await restoreCache(paths, key)
-
-    expect(cacheKey).toBe(key)
-    expect(getCacheMock).toHaveBeenNthCalledWith(1, [key], paths, {
-      compressionMethod: compression
-    })
-    expect(getCacheMock).toHaveBeenNthCalledWith(2, [key], paths, {
-      compressionMethod: CompressionMethod.Gzip
-    })
-    expect(createTempDirectoryMock).toHaveBeenCalledTimes(1)
-    expect(downloadCacheMock).toHaveBeenCalledWith(
-      cacheEntry.archiveLocation,
-      archivePath,
-      undefined
-    )
-    expect(getArchiveFileSizeInBytesMock).toHaveBeenCalledWith(archivePath)
-
-    expect(extractTarMock).toHaveBeenCalledTimes(1)
-    expect(extractTarMock).toHaveBeenCalledWith(
-      archivePath,
-      CompressionMethod.Gzip
-    )
-
-    expect(unlinkFileMock).toHaveBeenCalledTimes(1)
-    expect(unlinkFileMock).toHaveBeenCalledWith(archivePath)
-
-    expect(getCompressionMock).toHaveBeenCalledTimes(1)
-  }
-})
-
 test('restore with zstd compressed cache found', async () => {
   const paths = ['node_modules']
   const key = 'node-test'

packages/cache/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@actions/cache",
-  "version": "3.0.6",
+  "version": "3.1.0-beta.1",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {
     "": {
       "name": "@actions/cache",
-      "version": "3.0.6",
+      "version": "3.1.0-beta.1",
       "license": "MIT",
       "dependencies": {
         "@actions/core": "^1.10.0",
@@ -457,9 +457,9 @@
       }
     },
     "node_modules/minimatch": {
-      "version": "3.0.4",
+      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.0.4.tgz",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-      "integrity": "sha512-yJHVQEhyqPLUTgt9B83PXu6W3rx4MvvHvSUvToogpwoGDOUQ+yDrR0HRot+yOCdCO7u4hX3pWft6kWBBcqh0UA==",
+      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
       "dependencies": {
         "brace-expansion": "^1.1.7"
       },
@@ -998,9 +998,9 @@
       }
     },
     "minimatch": {
-      "version": "3.0.4",
+      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.0.4.tgz",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
-      "integrity": "sha512-yJHVQEhyqPLUTgt9B83PXu6W3rx4MvvHvSUvToogpwoGDOUQ+yDrR0HRot+yOCdCO7u4hX3pWft6kWBBcqh0UA==",
+      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
       "requires": {
         "brace-expansion": "^1.1.7"
       }

packages/cache/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actions/cache",
-  "version": "3.0.6",
+  "version": "3.1.0-beta.1",
   "preview": true,
   "description": "Actions cache lib",
   "keywords": [

packages/cache/src/cache.ts

@@ -4,8 +4,6 @@ import * as utils from './internal/cacheUtils'
 import * as cacheHttpClient from './internal/cacheHttpClient'
 import {createTar, extractTar, listTar} from './internal/tar'
 import {DownloadOptions, UploadOptions} from './options'
-import {CompressionMethod} from './internal/constants'
-import {ArtifactCacheEntry} from './internal/contracts'
 
 export class ValidationError extends Error {
   constructor(message: string) {
@@ -87,38 +85,19 @@ export async function restoreCache(
     checkKey(key)
   }
 
-  let cacheEntry: ArtifactCacheEntry | null
+  const compressionMethod = await utils.getCompressionMethod()
-  let compressionMethod = await utils.getCompressionMethod()
   let archivePath = ''
   try {
-    try {
+    // path are needed to compute version
-      // path are needed to compute version
+    const cacheEntry = await cacheHttpClient.getCacheEntry(keys, paths, {
-      cacheEntry = await cacheHttpClient.getCacheEntry(keys, paths, {
+      compressionMethod
-        compressionMethod
+    })
-      })
-    } catch (error) {
-      // This is to support the old cache entry created
-      // by the old version of the cache action on windows.
-      if (
-        process.platform === 'win32' &&
-        compressionMethod !== CompressionMethod.Gzip
-      ) {
-        compressionMethod = CompressionMethod.Gzip
-        cacheEntry = await cacheHttpClient.getCacheEntry(keys, paths, {
-          compressionMethod
-        })
-        if (!cacheEntry?.archiveLocation) {
-          throw error
-        }
-      } else {
-        throw error
-      }
-    }
 
     if (!cacheEntry?.archiveLocation) {
       // Cache not found
       return undefined
     }
+
     archivePath = path.join(
       await utils.createTempDirectory(),
       utils.getCacheFileName(compressionMethod)