exclude dev dependencies while we work on removing lerna

139b3391a0

packages/artifact/RELEASES.md

@@ -1,10 +1,5 @@
 # @actions/artifact Releases
 
-### 2.1.10
-
-- Fixed a regression with symlinks not being automatically resolved [#1830](https://github.com/actions/toolkit/pull/1830)
-- Fixed a regression with chunk timeout [#1786](https://github.com/actions/toolkit/pull/1786)
-
 ### 2.1.9
 
 - Fixed artifact upload chunk timeout logic [#1774](https://github.com/actions/toolkit/pull/1774)

packages/artifact/__tests__/upload-artifact.test.ts

@@ -27,14 +27,9 @@ jest.mock('@azure/storage-blob', () => ({
 const fixtures = {
   uploadDirectory: path.join(__dirname, '_temp', 'plz-upload'),
   files: [
-    {name: 'file1.txt', content: 'test 1 file content'},
-    {name: 'file2.txt', content: 'test 2 file content'},
-    {name: 'file3.txt', content: 'test 3 file content'},
-    {
-      name: 'from_symlink.txt',
-      content: 'from a symlink',
-      symlink: '../symlinked.txt'
-    }
+    ['file1.txt', 'test 1 file content'],
+    ['file2.txt', 'test 2 file content'],
+    ['file3.txt', 'test 3 file content']
   ],
   backendIDs: {
     workflowRunBackendId: '67dbcc20-e851-4452-a7c3-2cc0d2e0ec67',
@@ -59,23 +54,8 @@ describe('upload-artifact', () => {
       fs.mkdirSync(fixtures.uploadDirectory, {recursive: true})
     }
 
-    for (const file of fixtures.files) {
-      if (file.symlink) {
-        const symlinkPath = path.join(fixtures.uploadDirectory, file.symlink)
-        fs.writeFileSync(symlinkPath, file.content)
-        if (!fs.existsSync(path.join(fixtures.uploadDirectory, file.name))) {
-          fs.symlinkSync(
-            symlinkPath,
-            path.join(fixtures.uploadDirectory, file.name),
-            'file'
-          )
-        }
-      } else {
-        fs.writeFileSync(
-          path.join(fixtures.uploadDirectory, file.name),
-          file.content
-        )
-      }
+    for (const [file, content] of fixtures.files) {
+      fs.writeFileSync(path.join(fixtures.uploadDirectory, file), content)
     }
   })
 
@@ -91,9 +71,8 @@ describe('upload-artifact', () => {
       .spyOn(uploadZipSpecification, 'getUploadZipSpecification')
       .mockReturnValue(
         fixtures.files.map(file => ({
-          sourcePath: path.join(fixtures.uploadDirectory, file.name),
-          destinationPath: file.name,
-          stats: new fs.Stats()
+          sourcePath: path.join(fixtures.uploadDirectory, file[0]),
+          destinationPath: file[0]
         }))
       )
     jest.spyOn(config, 'getRuntimeToken').mockReturnValue(fixtures.runtimeToken)
@@ -206,10 +185,6 @@ describe('upload-artifact', () => {
   })
 
   it('should successfully upload an artifact', async () => {
-    jest
-      .spyOn(uploadZipSpecification, 'getUploadZipSpecification')
-      .mockRestore()
-
     jest
       .spyOn(ArtifactServiceClientJSON.prototype, 'CreateArtifact')
       .mockReturnValue(
@@ -253,10 +228,8 @@ describe('upload-artifact', () => {
 
     const {id, size} = await uploadArtifact(
       fixtures.inputs.artifactName,
-      fixtures.files.map(file =>
-        path.join(fixtures.uploadDirectory, file.name)
-      ),
-      fixtures.uploadDirectory
+      fixtures.inputs.files,
+      fixtures.inputs.rootDirectory
     )
 
     expect(id).toBe(1)

packages/artifact/__tests__/upload-zip-specification.test.ts

@@ -305,22 +305,4 @@ describe('Search', () => {
       }
     }
   })
-
-  it('Upload Specification - Includes symlinks', async () => {
-    const targetPath = path.join(root, 'link-dir', 'symlink-me.txt')
-    await fs.mkdir(path.dirname(targetPath), {recursive: true})
-    await fs.writeFile(targetPath, 'symlink file content')
-
-    const uploadPath = path.join(root, 'upload-dir', 'symlink.txt')
-    await fs.mkdir(path.dirname(uploadPath), {recursive: true})
-    await fs.symlink(targetPath, uploadPath, 'file')
-
-    const specifications = getUploadZipSpecification([uploadPath], root)
-    expect(specifications.length).toEqual(1)
-    expect(specifications[0].sourcePath).toEqual(uploadPath)
-    expect(specifications[0].destinationPath).toEqual(
-      path.join('/upload-dir', 'symlink.txt')
-    )
-    expect(specifications[0].stats.isSymbolicLink()).toBe(true)
-  })
 })

packages/artifact/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@actions/artifact",
-  "version": "2.1.10",
+  "version": "2.1.9",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@actions/artifact",
-      "version": "2.1.10",
+      "version": "2.1.9",
       "license": "MIT",
       "dependencies": {
         "@actions/core": "^1.10.0",
@@ -1315,9 +1315,9 @@
       }
     },
     "node_modules/path-to-regexp": {
-      "version": "6.3.0",
-      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-6.3.0.tgz",
-      "integrity": "sha512-Yhpw4T9C6hPpgPeA28us07OJeqZ5EzQTkbfwuhsUg0c237RomFoETJgmp2sa3F/41gfLE6G5cqcYwznmeEeOlQ=="
+      "version": "6.2.1",
+      "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-6.2.1.tgz",
+      "integrity": "sha512-JLyh7xT1kizaEvcaXOQwOc2/Yhw6KZOvPf1S8401UyLk86CU79LN3vl7ztXGm/pZ+YjoyAJ4rxmHwbkBXJX+yw=="
     },
     "node_modules/prettier": {
       "version": "2.8.8",

packages/artifact/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actions/artifact",
-  "version": "2.1.10",
+  "version": "2.1.9",
   "preview": true,
   "description": "Actions artifact lib",
   "keywords": [

packages/artifact/src/internal/upload/upload-zip-specification.ts

@@ -13,12 +13,6 @@ export interface UploadZipSpecification {
    * The destination path in a zip for a file
    */
   destinationPath: string
-
-  /**
-   * Information about the file
-   * https://nodejs.org/api/fs.html#class-fsstats
-   */
-  stats: fs.Stats
 }
 
 /**
@@ -81,11 +75,10 @@ export function getUploadZipSpecification(
           - file3.txt
   */
   for (let file of filesToZip) {
-    const stats = fs.lstatSync(file, {throwIfNoEntry: false})
-    if (!stats) {
+    if (!fs.existsSync(file)) {
       throw new Error(`File ${file} does not exist`)
     }
-    if (!stats.isDirectory()) {
+    if (!fs.statSync(file).isDirectory()) {
       // Normalize and resolve, this allows for either absolute or relative paths to be used
       file = normalize(file)
       file = resolve(file)
@@ -101,8 +94,7 @@ export function getUploadZipSpecification(
 
       specification.push({
         sourcePath: file,
-        destinationPath: uploadPath,
-        stats
+        destinationPath: uploadPath
       })
     } else {
       // Empty directory
@@ -111,8 +103,7 @@ export function getUploadZipSpecification(
 
       specification.push({
         sourcePath: null,
-        destinationPath: directoryPath,
-        stats
+        destinationPath: directoryPath
       })
     }
   }

packages/artifact/src/internal/upload/zip.ts

@@ -1,5 +1,4 @@
 import * as stream from 'stream'
-import {readlink} from 'fs/promises'
 import * as archiver from 'archiver'
 import * as core from '@actions/core'
 import {UploadZipSpecification} from './upload-zip-specification'
@@ -43,14 +42,8 @@ export async function createZipUploadStream(
 
   for (const file of uploadSpecification) {
     if (file.sourcePath !== null) {
-      // Check if symlink and resolve the source path
-      let sourcePath = file.sourcePath
-      if (file.stats.isSymbolicLink()) {
-        sourcePath = await readlink(file.sourcePath)
-      }
-
-      // Add the file to the zip
-      zip.file(sourcePath, {
+      // Add a normal file to the zip
+      zip.file(file.sourcePath, {
         name: file.destinationPath
       })
     } else {

packages/attest/RELEASES.md

@@ -1,16 +1,10 @@
 # @actions/attest Releases
 
-### 1.4.2
-
-- Fix bug in `buildSLSAProvenancePredicate`/`attestProvenance` when generating provenance statement for enterprise account using customized OIDC issuer value [#1823](https://github.com/actions/toolkit/pull/1823)
-### 1.4.1
-
-- Bump @actions/http-client from 2.2.1 to 2.2.3 [#1805](https://github.com/actions/toolkit/pull/1805)
-
 ### 1.4.0
 
 - Add new `headers` parameter to the `attest` and `attestProvenance` functions [#1790](https://github.com/actions/toolkit/pull/1790)
 - Update `buildSLSAProvenancePredicate`/`attestProvenance` to automatically derive default OIDC issuer URL from current execution context [#1796](https://github.com/actions/toolkit/pull/1796)
+
 ### 1.3.1
 
 - Fix bug with proxy support when retrieving JWKS for OIDC issuer [#1776](https://github.com/actions/toolkit/pull/1776)

packages/attest/__tests__/oidc.test.ts

@@ -68,55 +68,6 @@ describe('getIDTokenClaims', () => {
     })
   })
 
-  describe('when ID token is valid (w/ enterprise slug)', () => {
-    const claims = {
-      iss: `${issuer}/foo-bar`,
-      aud: audience,
-      ref: 'ref',
-      sha: 'sha',
-      repository: 'repo',
-      event_name: 'push',
-      job_workflow_ref: 'job_workflow_ref',
-      workflow_ref: 'workflow',
-      repository_id: '1',
-      repository_owner_id: '1',
-      runner_environment: 'github-hosted',
-      run_id: '1',
-      run_attempt: '1'
-    }
-
-    beforeEach(async () => {
-      const jwt = await new jose.SignJWT(claims)
-        .setProtectedHeader({alg: 'PS256'})
-        .sign(key.privateKey)
-
-      nock(issuer).get(tokenPath).query({audience}).reply(200, {value: jwt})
-    })
-
-    it('returns the ID token claims', async () => {
-      const result = await getIDTokenClaims(issuer)
-      expect(result).toEqual(claims)
-    })
-  })
-
-  describe('when ID token is missing the "iss" claim', () => {
-    const claims = {
-      aud: audience
-    }
-
-    beforeEach(async () => {
-      const jwt = await new jose.SignJWT(claims)
-        .setProtectedHeader({alg: 'PS256'})
-        .sign(key.privateKey)
-
-      nock(issuer).get(tokenPath).query({audience}).reply(200, {value: jwt})
-    })
-
-    it('throws an error', async () => {
-      await expect(getIDTokenClaims(issuer)).rejects.toThrow(/missing "iss"/i)
-    })
-  })
-
   describe('when ID token is missing required claims', () => {
     const claims = {
       iss: issuer,
@@ -148,9 +99,7 @@ describe('getIDTokenClaims', () => {
     })
 
     it('throws an error', async () => {
-      await expect(getIDTokenClaims(issuer)).rejects.toThrow(
-        /unexpected "iss"/i
-      )
+      await expect(getIDTokenClaims(issuer)).rejects.toThrow(/unexpected "iss"/)
     })
   })
 

packages/attest/package-lock.json

@@ -1,17 +1,17 @@
 {
   "name": "@actions/attest",
-  "version": "1.4.2",
+  "version": "1.4.0",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {
     "": {
       "name": "@actions/attest",
-      "version": "1.4.2",
+      "version": "1.4.0",
       "license": "MIT",
       "dependencies": {
         "@actions/core": "^1.10.1",
         "@actions/github": "^6.0.0",
-        "@actions/http-client": "^2.2.3",
+        "@actions/http-client": "^2.2.1",
         "@octokit/plugin-retry": "^6.0.1",
         "@sigstore/bundle": "^2.3.2",
         "@sigstore/sign": "^2.3.2",
@@ -46,9 +46,9 @@
       }
     },
     "node_modules/@actions/http-client": {
-      "version": "2.2.3",
-      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-2.2.3.tgz",
-      "integrity": "sha512-mx8hyJi/hjFvbPokCg4uRd4ZX78t+YyRPtnKWwIl+RzNaVuFpQHfmlGVfsKEJN8LwTCvL+DfVgAM04XaHkm6bA==",
+      "version": "2.2.1",
+      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-2.2.1.tgz",
+      "integrity": "sha512-KhC/cZsq7f8I4LfZSJKgCvEwfkE8o1538VoBeoGzokVLLnbFDEAdFD3UhoMklxo2un9NJVBdANOresx7vTHlHw==",
       "dependencies": {
         "tunnel": "^0.0.6",
         "undici": "^5.25.4"
@@ -1767,9 +1767,9 @@
       }
     },
     "@actions/http-client": {
-      "version": "2.2.3",
-      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-2.2.3.tgz",
-      "integrity": "sha512-mx8hyJi/hjFvbPokCg4uRd4ZX78t+YyRPtnKWwIl+RzNaVuFpQHfmlGVfsKEJN8LwTCvL+DfVgAM04XaHkm6bA==",
+      "version": "2.2.1",
+      "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-2.2.1.tgz",
+      "integrity": "sha512-KhC/cZsq7f8I4LfZSJKgCvEwfkE8o1538VoBeoGzokVLLnbFDEAdFD3UhoMklxo2un9NJVBdANOresx7vTHlHw==",
       "requires": {
         "tunnel": "^0.0.6",
         "undici": "^5.25.4"

packages/attest/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actions/attest",
-  "version": "1.4.2",
+  "version": "1.4.0",
   "description": "Actions attestation lib",
   "keywords": [
     "github",
@@ -44,7 +44,7 @@
   "dependencies": {
     "@actions/core": "^1.10.1",
     "@actions/github": "^6.0.0",
-    "@actions/http-client": "^2.2.3",
+    "@actions/http-client": "^2.2.1",
     "@octokit/plugin-retry": "^6.0.1",
     "@sigstore/bundle": "^2.3.2",
     "@sigstore/sign": "^2.3.2",

packages/attest/src/oidc.ts

@@ -49,19 +49,10 @@ const decodeOIDCToken = async (
   // Verify and decode token
   const jwks = jose.createLocalJWKSet(await getJWKS(issuer))
   const {payload} = await jose.jwtVerify(token, jwks, {
-    audience: OIDC_AUDIENCE
+    audience: OIDC_AUDIENCE,
+    issuer
   })
 
-  if (!payload.iss) {
-    throw new Error('Missing "iss" claim')
-  }
-
-  // Check that the issuer STARTS WITH the expected issuer URL to account for
-  // the fact that the value may include an enterprise-specific slug
-  if (!payload.iss.startsWith(issuer)) {
-    throw new Error(`Unexpected "iss" claim: ${payload.iss}`)
-  }
-
   return payload
 }