updating release info

Revert "Add GNUtar as default in windows"

packages/cache/src/internal/cacheHttpClient.ts

@@ -17,8 +17,7 @@ import {
   CommitCacheRequest,
   ReserveCacheRequest,
   ReserveCacheResponse,
-  ITypedResponseWithError,
-  ArtifactCacheList
+  ITypedResponseWithError
 } from './contracts'
 import {downloadCacheHttpClient, downloadCacheStorageSDK} from './downloadUtils'
 import {
@@ -105,10 +104,6 @@ export async function getCacheEntry(
     httpClient.getJson<ArtifactCacheEntry>(getCacheApiUrl(resource))
   )
   if (response.statusCode === 204) {
-    // List cache for primary key only if cache miss occurs
-    if (core.isDebug()) {
-      await printCachesListForDiagnostics(keys[0], httpClient, version)
-    }
     return null
   }
   if (!isSuccessStatusCode(response.statusCode)) {
@@ -127,31 +122,6 @@ export async function getCacheEntry(
   return cacheResult
 }
 
-async function printCachesListForDiagnostics(
-  key: string,
-  httpClient: HttpClient,
-  version: string
-): Promise<void> {
-  const resource = `caches?key=${encodeURIComponent(key)}`
-  const response = await retryTypedResponse('listCache', async () =>
-    httpClient.getJson<ArtifactCacheList>(getCacheApiUrl(resource))
-  )
-  if (response.statusCode === 200) {
-    const cacheListResult = response.result
-    const totalCount = cacheListResult?.totalCount
-    if (totalCount && totalCount > 0) {
-      core.debug(
-        `No matching cache found for cache key '${key}', version '${version} and scope ${process.env['GITHUB_REF']}. There exist one or more cache(s) with similar key but they have different version or scope. See more info on cache matching here: https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows#matching-a-cache-key \nOther caches with similar key:`
-      )
-      for (const cacheEntry of cacheListResult?.artifactCaches || []) {
-        core.debug(
-          `Cache Key: ${cacheEntry?.cacheKey}, Cache Version: ${cacheEntry?.cacheVersion}, Cache Scope: ${cacheEntry?.scope}, Cache Created: ${cacheEntry?.creationTime}`
-        )
-      }
-    }
-  }
-}
-
 export async function downloadCache(
   archiveLocation: string,
   archivePath: string,

packages/cache/src/internal/contracts.d.ts

@@ -9,16 +9,10 @@ export interface ITypedResponseWithError<T> extends TypedResponse<T> {
 export interface ArtifactCacheEntry {
   cacheKey?: string
   scope?: string
-  cacheVersion?: string
   creationTime?: string
   archiveLocation?: string
 }
 
-export interface ArtifactCacheList {
-  totalCount: number
-  artifactCaches?: ArtifactCacheEntry[]
-}
-
 export interface CommitCacheRequest {
   size: number
 }

packages/io/RELEASES.md

@@ -1,5 +1,7 @@
 # @actions/io Releases
 
+### 1.1.3
+- [Fixed a security bug where we used child_proccess.exec instead of execFile for windows](https://github.com/actions/toolkit/pull/1255)
 ### 1.1.2
 - Update `lockfileVersion` to `v2` in `package-lock.json [#1020](https://github.com/actions/toolkit/pull/1020) 
 

packages/io/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actions/io",
-  "version": "1.1.2",
+  "version": "1.1.3",
   "description": "Actions io lib",
   "keywords": [
     "github",

packages/io/src/io.ts

@@ -4,7 +4,6 @@ import * as path from 'path'
 import {promisify} from 'util'
 import * as ioUtil from './io-util'
 
-const exec = promisify(childProcess.exec)
 const execFile = promisify(childProcess.execFile)
 
 /**
@@ -129,11 +128,11 @@ export async function rmRF(inputPath: string): Promise<void> {
     try {
       const cmdPath = ioUtil.getCmdPath()
       if (await ioUtil.isDirectory(inputPath, true)) {
-        await exec(`${cmdPath} /s /c "rd /s /q "%inputPath%""`, {
+        await execFile(`${cmdPath} /s /c "rd /s /q "%inputPath%""`, {
           env: {inputPath}
         })
       } else {
-        await exec(`${cmdPath} /s /c "del /f /a "%inputPath%""`, {
+        await execFile(`${cmdPath} /s /c "del /f /a "%inputPath%""`, {
           env: {inputPath}
         })
       }