npm audit fix

allow localhost hostnames for artifact checks
Merge pull request #1759 from actions/bdehamer/rekor-409
2024-07-03 17:03:40 +00:00 · 2024-07-03 16:55:53 +00:00 · 2024-06-12 12:25:06 -07:00 · 2024-06-12 11:57:18 -07:00 · 2024-06-12 11:45:37 -07:00 · 2024-06-05 14:54:34 -07:00
26 changed files with 758 additions and 848 deletions
@@ -5175,12 +5175,12 @@
      }
    },
    "node_modules/braces": {
-      "version": "3.0.2",
-      "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.2.tgz",
-      "integrity": "sha512-b8um+L1RzM3WDSzvhm6gIz1yfTbBt6YTlcEKAvsmqCZZFw46z626lVj9j1yEPW33H5H+lBQpZMP1k8l+78Ha0A==",
+      "version": "3.0.3",
+      "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.3.tgz",
+      "integrity": "sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==",
      "dev": true,
      "dependencies": {
-        "fill-range": "^7.0.1"
+        "fill-range": "^7.1.1"
      },
      "engines": {
        "node": ">=8"
@@ -6400,9 +6400,9 @@
      "dev": true
    },
    "node_modules/ejs": {
-      "version": "3.1.9",
-      "resolved": "https://registry.npmjs.org/ejs/-/ejs-3.1.9.tgz",
-      "integrity": "sha512-rC+QVNMJWv+MtPgkt0y+0rVEIdbtxVADApW9JXrUVlzHetgcyczP/E7DJmWJ4fJCZF2cPcBk0laWO9ZHMG3DmQ==",
+      "version": "3.1.10",
+      "resolved": "https://registry.npmjs.org/ejs/-/ejs-3.1.10.tgz",
+      "integrity": "sha512-UeJmFfOrAQS8OJWPZ4qtgHyWExa088/MtK5UEyoJGFH67cDEXkZSviOiKRCZ4Xij0zxI3JECgYs3oKx+AizQBA==",
      "dev": true,
      "dependencies": {
        "jake": "^10.8.5"
@@ -7457,9 +7457,9 @@
      }
    },
    "node_modules/fill-range": {
-      "version": "7.0.1",
-      "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.0.1.tgz",
-      "integrity": "sha512-qOo9F+dMUmC2Lcb4BbVvnKJxTPjCm+RRpe4gDuGrzkL7mEVl/djYSu2OdQ2Pa302N4oqkSg9ir6jaLWJ2USVpQ==",
+      "version": "7.1.1",
+      "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.1.1.tgz",
+      "integrity": "sha512-YsGpe3WHLK8ZYi4tWDg2Jy3ebRz2rXowDxnld4bkQB00cc/1Zw9AWnC0i9ztDJitivtQvaI9KaLyKrc+hBW0yg==",
      "dev": true,
      "dependencies": {
        "to-regex-range": "^5.0.1"
@@ -9015,24 +9015,6 @@
        "node": ">=8"
      }
    },
-    "node_modules/jackspeak": {
-      "version": "2.3.6",
-      "resolved": "https://registry.npmjs.org/jackspeak/-/jackspeak-2.3.6.tgz",
-      "integrity": "sha512-N3yCS/NegsOBokc8GAdM8UcmfsKiSS8cipheD/nivzr700H+nsMOxJjQnvwOcRYVuFkdH0wGUvW2WbXGmrZGbQ==",
-      "dev": true,
-      "dependencies": {
-        "@isaacs/cliui": "^8.0.2"
-      },
-      "engines": {
-        "node": ">=14"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      },
-      "optionalDependencies": {
-        "@pkgjs/parseargs": "^0.11.0"
-      }
-    },
    "node_modules/jake": {
      "version": "10.8.7",
      "resolved": "https://registry.npmjs.org/jake/-/jake-10.8.7.tgz",
@@ -33,4 +33,4 @@
    "ts-jest": "^29.1.1",
    "typescript": "^5.2.2"
  }
-}
+}
@@ -1,5 +1,13 @@
 # @actions/artifact Releases

+### 2.1.8
+
+- Allows `*.localhost` domains for hostname checks for local development.
+
+### 2.1.7
+
+- Update unzip-stream dependency and reverted to using `unzip.Extract()`
+
 ### 2.1.6

 - Will retry on invalid request responses.
@@ -20,6 +20,11 @@ describe('isGhes', () => {
    expect(config.isGhes()).toBe(false)
  })

+  it('should return false when the request domain ends with .localhost', () => {
+    process.env.GITHUB_SERVER_URL = 'https://github.localhost'
+    expect(config.isGhes()).toBe(false)
+  })
+
  it('should return false when the request domain is specific to an enterprise', () => {
    process.env.GITHUB_SERVER_URL = 'https://my-enterprise.github.com'
    expect(config.isGhes()).toBe(true)
@@ -200,14 +200,12 @@ describe('download-artifact', () => {
        }
      )

-      await expect(
-        downloadArtifactPublic(
-          fixtures.artifactID,
-          fixtures.repositoryOwner,
-          fixtures.repositoryName,
-          fixtures.token
-        )
-      ).rejects.toBeInstanceOf(Error)
+      const response = await downloadArtifactPublic(
+        fixtures.artifactID,
+        fixtures.repositoryOwner,
+        fixtures.repositoryName,
+        fixtures.token
+      )

      expect(downloadArtifactMock).toHaveBeenCalledWith({
        owner: fixtures.repositoryOwner,
@@ -223,6 +221,16 @@ describe('download-artifact', () => {
      expect(mockGetArtifactMalicious).toHaveBeenCalledWith(
        fixtures.blobStorageUrl
      )
+
+      // ensure path traversal was not possible
+      expect(
+        fs.existsSync(path.join(fixtures.workspaceDir, 'x/etc/hosts'))
+      ).toBe(true)
+      expect(
+        fs.existsSync(path.join(fixtures.workspaceDir, 'y/etc/hosts'))
+      ).toBe(true)
+
+      expect(response.downloadPath).toBe(fixtures.workspaceDir)
    })

    it('should successfully download an artifact to user defined path', async () => {
@@ -7,21 +7,14 @@ import {Timestamp, ArtifactServiceClientJSON} from '../src/generated'
 import * as blobUpload from '../src/internal/upload/blob-upload'
 import {uploadArtifact} from '../src/internal/upload/upload-artifact'
 import {noopLogs} from './common'
-import {
-  FilesNotFoundError,
-  InvalidResponseError
-} from '../src/internal/shared/errors'
-class NodeJSError extends Error {
-  code: string
+import {FilesNotFoundError} from '../src/internal/shared/errors'
+import {BlockBlobClient} from '@azure/storage-blob'
+import * as fs from 'fs'
+import * as path from 'path'

-  constructor(message?: string, code?: string) {
-    super(message) // Pass the message to the Error constructor
-    this.code = code || ''
-  }
-}
 describe('upload-artifact', () => {
  beforeEach(() => {
-    // noopLogs()
+    noopLogs()
  })

  afterEach(() => {
@@ -362,101 +355,93 @@ describe('upload-artifact', () => {
    expect(uploadResp).rejects.toThrow()
  })

-  describe('should respond with non-successful callback on different zipstream lifecycle methods', () => {
-    beforeEach(() => {
-      noopLogs()
-    })
+  it('should throw an error uploading blob chunks get delayed', async () => {
+    const mockDate = new Date('2020-01-01')
+    const dirPath = path.join(__dirname, `plz-upload`)
+    if (!fs.existsSync(dirPath)) {
+      fs.mkdirSync(dirPath, {recursive: true})
+    }

-    afterEach(() => {
-      jest.restoreAllMocks()
-    })
+    fs.writeFileSync(path.join(dirPath, 'file1.txt'), 'test file content')
+    fs.writeFileSync(path.join(dirPath, 'file2.txt'), 'test file content')

-    it('should handle ENOENT error', async () => {
-      const mockDate = new Date('2020-01-01')
-      jest
-        .spyOn(uploadZipSpecification, 'validateRootDirectory')
-        .mockReturnValue()
-      jest
-        .spyOn(uploadZipSpecification, 'getUploadZipSpecification')
-        .mockReturnValue([
-          {
-            sourcePath: '/home/user/files/plz-upload/file1.txt',
-            destinationPath: 'file1.txt'
-          },
-          {
-            sourcePath: '/home/user/files/plz-upload/file2.txt',
-            destinationPath: 'file2.txt'
-          }
-        ])
+    fs.writeFileSync(path.join(dirPath, 'file3.txt'), 'test file content')

-      const mockZipStream = {
-        entry: jest.fn((source, data, callback) => {
-          const err = (new NodeJSError(
-            "ENOENT: no such file or directory, open '/home/user/files/plz-upload/file1.txt'"
-          ).code = 'ENOENT')
-          callback(null, err)
-        }),
-        pipe: jest.fn(),
-        on: jest.fn(),
-        finalize: jest.fn()
-      }
-
-      jest.mock('zip-stream', () => {
-        return {
-          default: jest.fn().mockImplementation(() => mockZipStream)
+    jest
+      .spyOn(uploadZipSpecification, 'validateRootDirectory')
+      .mockReturnValue()
+    jest
+      .spyOn(uploadZipSpecification, 'getUploadZipSpecification')
+      .mockReturnValue([
+        {
+          sourcePath: path.join(dirPath, 'file1.txt'),
+          destinationPath: 'file1.txt'
+        },
+        {
+          sourcePath: path.join(dirPath, 'file2.txt'),
+          destinationPath: 'file2.txt'
+        },
+        {
+          sourcePath: path.join(dirPath, 'file3.txt'),
+          destinationPath: 'dir/file3.txt'
        }
-      })
+      ])

-      jest
-        .spyOn(zip, 'createZipUploadStream')
-        .mockReturnValue(
-          Promise.reject(
-            new NodeJSError(
-              "ENOENT: no such file or directory, open '/home/user/files/plz-upload/file1.txt'"
-            )
-          )
-        )
-      jest.spyOn(util, 'getBackendIdsFromToken').mockReturnValue({
-        workflowRunBackendId: '1234',
-        workflowJobRunBackendId: '5678'
-      })
-      jest
-        .spyOn(retention, 'getExpiration')
-        .mockReturnValue(Timestamp.fromDate(mockDate))
-      jest
-        .spyOn(ArtifactServiceClientJSON.prototype, 'CreateArtifact')
-        .mockReturnValue(
-          Promise.resolve({
-            ok: true,
-            signedUploadUrl: 'https://signed-upload-url.com'
-          })
-        )
-      jest.spyOn(blobUpload, 'uploadZipToBlobStorage').mockReturnValue(
+    jest.spyOn(util, 'getBackendIdsFromToken').mockReturnValue({
+      workflowRunBackendId: '1234',
+      workflowJobRunBackendId: '5678'
+    })
+    jest
+      .spyOn(retention, 'getExpiration')
+      .mockReturnValue(Timestamp.fromDate(mockDate))
+    jest
+      .spyOn(ArtifactServiceClientJSON.prototype, 'CreateArtifact')
+      .mockReturnValue(
        Promise.resolve({
-          uploadSize: 1234,
-          sha256Hash: 'test-sha256-hash'
+          ok: true,
+          signedUploadUrl: 'https://signed-upload-url.com'
        })
      )
-      jest
-        .spyOn(ArtifactServiceClientJSON.prototype, 'FinalizeArtifact')
-        .mockReturnValue(Promise.resolve({ok: true, artifactId: '1'}))
+    jest
+      .spyOn(blobUpload, 'uploadZipToBlobStorage')
+      .mockReturnValue(Promise.reject(new Error('Upload progress stalled.')))

-      // ArtifactHttpClient mocks
-      jest.spyOn(config, 'getRuntimeToken').mockReturnValue('test-token')
-      jest
-        .spyOn(config, 'getResultsServiceUrl')
-        .mockReturnValue('https://test-url.com')
+    // ArtifactHttpClient mocks
+    jest.spyOn(config, 'getRuntimeToken').mockReturnValue('test-token')
+    jest
+      .spyOn(config, 'getResultsServiceUrl')
+      .mockReturnValue('https://test-url.com')

-      const uploadResp = uploadArtifact(
-        'test-artifact',
-        [
-          '/home/user/files/plz-upload/file1.txt',
-          '/home/user/files/plz-upload/file2.txt',
-          '/home/user/files/plz-upload/dir/file3.txt'
-        ],
-        '/home/user/files/plz-upload'
+    BlockBlobClient.prototype.uploadStream = jest
+      .fn()
+      .mockImplementation(
+        async (stream, bufferSize, maxConcurrency, options) => {
+          return new Promise<void>(resolve => {
+            // Call the onProgress callback with a progress event
+            options.onProgress({loadedBytes: 0})
+
+            // Wait for 31 seconds before resolving the promise
+            setTimeout(() => {
+              // Call the onProgress callback again to simulate progress
+              options.onProgress({loadedBytes: 100})
+
+              resolve()
+            }, 31000) // Delay longer than your timeout
+          })
+        }
      )
-      expect(uploadResp).rejects.toThrowError(InvalidResponseError)
-    })
+
+    jest.mock('fs')
+    const uploadResp = uploadArtifact(
+      'test-artifact',
+      [
+        '/home/user/files/plz-upload/file1.txt',
+        '/home/user/files/plz-upload/file2.txt',
+        '/home/user/files/plz-upload/dir/file3.txt'
+      ],
+      '/home/user/files/plz-upload'
+    )
+
+    expect(uploadResp).rejects.toThrow('Upload progress stalled.')
  })
 })
@@ -1,12 +1,12 @@
 {
  "name": "@actions/artifact",
-  "version": "2.1.5",
+  "version": "2.1.8",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "@actions/artifact",
-      "version": "2.1.5",
+      "version": "2.1.8",
      "license": "MIT",
      "dependencies": {
        "@actions/core": "^1.10.0",
@@ -18,15 +18,14 @@
        "@octokit/plugin-retry": "^3.0.9",
        "@octokit/request-error": "^5.0.0",
        "@protobuf-ts/plugin": "^2.2.3-alpha.1",
-        "archiver": "^5.3.1",
-        "async": "^3.2.5",
+        "archiver": "^7.0.1",
        "crypto": "^1.0.1",
        "jwt-decode": "^3.1.2",
        "twirp-ts": "^2.5.0",
-        "unzip-stream": "^0.3.1",
-        "zip-stream": "^6.0.1"
+        "unzip-stream": "^0.3.1"
      },
      "devDependencies": {
+        "@types/archiver": "^5.3.2",
        "@types/unzip-stream": "^0.3.4",
        "typedoc": "^0.25.4",
        "typedoc-plugin-markdown": "^3.17.1",
@@ -444,6 +443,15 @@
        "@protobuf-ts/runtime": "^2.9.1"
      }
    },
+    "node_modules/@types/archiver": {
+      "version": "5.3.2",
+      "resolved": "https://registry.npmjs.org/@types/archiver/-/archiver-5.3.2.tgz",
+      "integrity": "sha512-IctHreBuWE5dvBDz/0WeKtyVKVRs4h75IblxOACL92wU66v+HGAfEYAOyXkOFphvRJMhuXdI9huDXpX0FC6lCw==",
+      "dev": true,
+      "dependencies": {
+        "@types/readdir-glob": "*"
+      }
+    },
    "node_modules/@types/node": {
      "version": "20.4.9",
      "resolved": "https://registry.npmjs.org/@types/node/-/node-20.4.9.tgz",
@@ -471,6 +479,15 @@
        "node": ">= 6"
      }
    },
+    "node_modules/@types/readdir-glob": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/@types/readdir-glob/-/readdir-glob-1.1.1.tgz",
+      "integrity": "sha512-ImM6TmoF8bgOwvehGviEj3tRdRBbQujr1N+0ypaln/GWjaerOB26jb93vsRHmdMtvVQZQebOlqt2HROark87mQ==",
+      "dev": true,
+      "dependencies": {
+        "@types/node": "*"
+      }
+    },
    "node_modules/@types/tunnel": {
      "version": "0.0.3",
      "resolved": "https://registry.npmjs.org/@types/tunnel/-/tunnel-0.0.3.tgz",
@@ -604,69 +621,10 @@
        "url": "https://github.com/sponsors/isaacs"
      }
    },
-    "node_modules/archiver/node_modules/compress-commons": {
-      "version": "4.1.2",
-      "resolved": "https://registry.npmjs.org/compress-commons/-/compress-commons-4.1.2.tgz",
-      "integrity": "sha512-D3uMHtGc/fcO1Gt1/L7i1e33VOvD4A9hfQLP+6ewd+BvG/gQ84Yh4oftEhAdjSMgBgwGL+jsppT7JYNpo6MHHg==",
-      "dependencies": {
-        "buffer-crc32": "^0.2.13",
-        "crc32-stream": "^4.0.2",
-        "normalize-path": "^3.0.0",
-        "readable-stream": "^3.6.0"
-      },
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/archiver/node_modules/crc32-stream": {
-      "version": "4.0.3",
-      "resolved": "https://registry.npmjs.org/crc32-stream/-/crc32-stream-4.0.3.tgz",
-      "integrity": "sha512-NT7w2JVU7DFroFdYkeq8cywxrgjPHWkdX1wjpRQXPX5Asews3tA+Ght6lddQO5Mkumffp3X7GEqku3epj2toIw==",
-      "dependencies": {
-        "crc-32": "^1.2.0",
-        "readable-stream": "^3.4.0"
-      },
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/archiver/node_modules/zip-stream": {
-      "version": "4.1.1",
-      "resolved": "https://registry.npmjs.org/zip-stream/-/zip-stream-4.1.1.tgz",
-      "integrity": "sha512-9qv4rlDiopXg4E69k+vMHjNN63YFMe9sZMrdlvKnCjlCRWeCBswPPMPUfx+ipsAWq1LXHe70RcbaHdJJpS6hyQ==",
-      "dependencies": {
-        "archiver-utils": "^3.0.4",
-        "compress-commons": "^4.1.2",
-        "readable-stream": "^3.6.0"
-      },
-      "engines": {
-        "node": ">= 10"
-      }
-    },
-    "node_modules/archiver/node_modules/zip-stream/node_modules/archiver-utils": {
-      "version": "3.0.4",
-      "resolved": "https://registry.npmjs.org/archiver-utils/-/archiver-utils-3.0.4.tgz",
-      "integrity": "sha512-KVgf4XQVrTjhyWmx6cte4RxonPLR9onExufI1jhvw/MQ4BB6IsZD5gT8Lq+u/+pRkWna/6JoHpiQioaqFP5Rzw==",
-      "dependencies": {
-        "glob": "^7.2.3",
-        "graceful-fs": "^4.2.0",
-        "lazystream": "^1.0.0",
-        "lodash.defaults": "^4.2.0",
-        "lodash.difference": "^4.5.0",
-        "lodash.flatten": "^4.4.0",
-        "lodash.isplainobject": "^4.0.6",
-        "lodash.union": "^4.6.0",
-        "normalize-path": "^3.0.0",
-        "readable-stream": "^3.6.0"
-      },
-      "engines": {
-        "node": ">= 10"
-      }
-    },
    "node_modules/async": {
-      "version": "3.2.5",
-      "resolved": "https://registry.npmjs.org/async/-/async-3.2.5.tgz",
-      "integrity": "sha512-baNZyqaaLhyLVKm/DlvdW051MSgO6b8eVfIezl9E5PqWxFgzLm/wQntEW4zOytVburDEr0JlALEpdOFwvErLsg=="
+      "version": "3.2.4",
+      "resolved": "https://registry.npmjs.org/async/-/async-3.2.4.tgz",
+      "integrity": "sha512-iAB+JbDEGXhyIUavoDl9WP/Jj106Kz9DEn1DPgYw5ruDn0e3Wgi3sKFm55sASdGBNOQB8F59d9qQ7deqrHA8wQ=="
    },
    "node_modules/asynckit": {
      "version": "0.4.0",
@@ -848,44 +806,6 @@
        "node": ">= 14"
      }
    },
-    "node_modules/compress-commons/node_modules/buffer": {
-      "version": "6.0.3",
-      "resolved": "https://registry.npmjs.org/buffer/-/buffer-6.0.3.tgz",
-      "integrity": "sha512-FTiCpNxtwiZZHEZbcbTIcZjERVICn9yq/pDFkTl95/AxzD1naBctN7YO68riM/gLSDY7sdrMby8hofADYuuqOA==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/feross"
-        },
-        {
-          "type": "patreon",
-          "url": "https://www.patreon.com/feross"
-        },
-        {
-          "type": "consulting",
-          "url": "https://feross.org/support"
-        }
-      ],
-      "dependencies": {
-        "base64-js": "^1.3.1",
-        "ieee754": "^1.2.1"
-      }
-    },
-    "node_modules/compress-commons/node_modules/readable-stream": {
-      "version": "4.5.2",
-      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-4.5.2.tgz",
-      "integrity": "sha512-yjavECdqeZ3GLXNgRXgeQEdz9fvDDkNKyHnbHRFtOr7/LcfgBcmct7t/ET+HaCTqfh06OzoAxrkN/IfjJBVe+g==",
-      "dependencies": {
-        "abort-controller": "^3.0.0",
-        "buffer": "^6.0.3",
-        "events": "^3.3.0",
-        "process": "^0.11.10",
-        "string_decoder": "^1.3.0"
-      },
-      "engines": {
-        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
-      }
-    },
    "node_modules/concat-map": {
      "version": "0.0.1",
      "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
@@ -919,44 +839,6 @@
        "node": ">= 14"
      }
    },
-    "node_modules/crc32-stream/node_modules/buffer": {
-      "version": "6.0.3",
-      "resolved": "https://registry.npmjs.org/buffer/-/buffer-6.0.3.tgz",
-      "integrity": "sha512-FTiCpNxtwiZZHEZbcbTIcZjERVICn9yq/pDFkTl95/AxzD1naBctN7YO68riM/gLSDY7sdrMby8hofADYuuqOA==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/feross"
-        },
-        {
-          "type": "patreon",
-          "url": "https://www.patreon.com/feross"
-        },
-        {
-          "type": "consulting",
-          "url": "https://feross.org/support"
-        }
-      ],
-      "dependencies": {
-        "base64-js": "^1.3.1",
-        "ieee754": "^1.2.1"
-      }
-    },
-    "node_modules/crc32-stream/node_modules/readable-stream": {
-      "version": "4.5.2",
-      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-4.5.2.tgz",
-      "integrity": "sha512-yjavECdqeZ3GLXNgRXgeQEdz9fvDDkNKyHnbHRFtOr7/LcfgBcmct7t/ET+HaCTqfh06OzoAxrkN/IfjJBVe+g==",
-      "dependencies": {
-        "abort-controller": "^3.0.0",
-        "buffer": "^6.0.3",
-        "events": "^3.3.0",
-        "process": "^0.11.10",
-        "string_decoder": "^1.3.0"
-      },
-      "engines": {
-        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
-      }
-    },
    "node_modules/cross-spawn": {
      "version": "7.0.3",
      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.3.tgz",
@@ -1011,14 +893,6 @@
      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-9.2.2.tgz",
      "integrity": "sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg=="
    },
-    "node_modules/end-of-stream": {
-      "version": "1.4.4",
-      "resolved": "https://registry.npmjs.org/end-of-stream/-/end-of-stream-1.4.4.tgz",
-      "integrity": "sha512-+uw1inIHVPQoaVuHzRyXd21icM+cnt4CzD5rW+NC1wjOUSTOs+Te7FOv7AhN7vS9x/oIyhLP5PR1H+phQAHu5Q==",
-      "dependencies": {
-        "once": "^1.4.0"
-      }
-    },
    "node_modules/event-target-shim": {
      "version": "5.0.1",
      "resolved": "https://registry.npmjs.org/event-target-shim/-/event-target-shim-5.0.1.tgz",
@@ -1035,6 +909,11 @@
        "node": ">=0.8.x"
      }
    },
+    "node_modules/fast-fifo": {
+      "version": "1.3.2",
+      "resolved": "https://registry.npmjs.org/fast-fifo/-/fast-fifo-1.3.2.tgz",
+      "integrity": "sha512-/d9sfos4yxzpwkDkuN7k2SqFKtYNmCTzgfEpz82x34IM9/zc8KGxQoXg1liNC/izpRM/MBdt44Nmx41ZWqk+FQ=="
+    },
    "node_modules/foreground-child": {
      "version": "3.1.1",
      "resolved": "https://registry.npmjs.org/foreground-child/-/foreground-child-3.1.1.tgz",
@@ -1697,94 +1576,6 @@
        "node": ">=8"
      }
    },
-    "node_modules/tar-stream": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/tar-stream/-/tar-stream-2.2.0.tgz",
-      "integrity": "sha512-ujeqbceABgwMZxEJnk2HDY2DlnUZ+9oEcb1KzTVfYHio0UE6dG71n60d8D2I4qNvleWrrXpmjpt7vZeF1LnMZQ==",
-      "dependencies": {
-        "eastasianwidth": "^0.2.0",
-        "emoji-regex": "^9.2.2",
-        "strip-ansi": "^7.0.1"
-      },
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/sindresorhus"
-      }
-    },
-    "node_modules/string-width-cjs": {
-      "name": "string-width",
-      "version": "4.2.3",
-      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
-      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
-      "dependencies": {
-        "emoji-regex": "^8.0.0",
-        "is-fullwidth-code-point": "^3.0.0",
-        "strip-ansi": "^6.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/string-width-cjs/node_modules/ansi-regex": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
-      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/string-width-cjs/node_modules/emoji-regex": {
-      "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
-      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A=="
-    },
-    "node_modules/string-width-cjs/node_modules/strip-ansi": {
-      "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
-      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
-      "dependencies": {
-        "ansi-regex": "^5.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/strip-ansi": {
-      "version": "7.1.0",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.1.0.tgz",
-      "integrity": "sha512-iq6eVVI64nQQTRYq2KtEg2d2uU7LElhTJwsH4YzIHZshxlgZms/wIc4VoDQTlG/IvVIrBKG06CrZnp0qv7hkcQ==",
-      "dependencies": {
-        "ansi-regex": "^6.0.1"
-      },
-      "engines": {
-        "node": ">=12"
-      },
-      "funding": {
-        "url": "https://github.com/chalk/strip-ansi?sponsor=1"
-      }
-    },
-    "node_modules/strip-ansi-cjs": {
-      "name": "strip-ansi",
-      "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
-      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
-      "dependencies": {
-        "ansi-regex": "^5.0.1"
-      },
-      "engines": {
-        "node": ">=8"
-      }
-    },
-    "node_modules/strip-ansi-cjs/node_modules/ansi-regex": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
-      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
-      "engines": {
-        "node": ">=8"
-      }
-    },
    "node_modules/tar-stream": {
      "version": "3.1.7",
      "resolved": "https://registry.npmjs.org/tar-stream/-/tar-stream-3.1.7.tgz",
@@ -1947,9 +1738,9 @@
      "integrity": "sha512-isyNax3wXoKaulPDZWHQqbmIx1k2tb9fb3GGDBRxCscfYV2Ch7WxPArBsFEG8s/safwXTT7H4QGhaIkTp9447w=="
    },
    "node_modules/unzip-stream": {
-      "version": "0.3.1",
-      "resolved": "https://registry.npmjs.org/unzip-stream/-/unzip-stream-0.3.1.tgz",
-      "integrity": "sha512-RzaGXLNt+CW+T41h1zl6pGz3EaeVhYlK+rdAap+7DxW5kqsqePO8kRtWPaCiVqdhZc86EctSPVYNix30YOMzmw==",
+      "version": "0.3.4",
+      "resolved": "https://registry.npmjs.org/unzip-stream/-/unzip-stream-0.3.4.tgz",
+      "integrity": "sha512-PyofABPVv+d7fL7GOpusx7eRT9YETY2X04PhwbSipdj6bMxVCFJrr+nm0Mxqbf9hUiTin/UsnuFWBXlDZFy0Cw==",
      "dependencies": {
        "binary": "^0.3.0",
        "mkdirp": "^0.5.1"
@@ -2143,104 +1934,6 @@
      "engines": {
        "node": ">= 14"
      }
-    },
-    "node_modules/zip-stream/node_modules/archiver-utils": {
-      "version": "5.0.2",
-      "resolved": "https://registry.npmjs.org/archiver-utils/-/archiver-utils-5.0.2.tgz",
-      "integrity": "sha512-wuLJMmIBQYCsGZgYLTy5FIB2pF6Lfb6cXMSF8Qywwk3t20zWnAi7zLcQFdKQmIB8wyZpY5ER38x08GbwtR2cLA==",
-      "dependencies": {
-        "glob": "^10.0.0",
-        "graceful-fs": "^4.2.0",
-        "is-stream": "^2.0.1",
-        "lazystream": "^1.0.0",
-        "lodash": "^4.17.15",
-        "normalize-path": "^3.0.0",
-        "readable-stream": "^4.0.0"
-      },
-      "engines": {
-        "node": ">= 14"
-      }
-    },
-    "node_modules/zip-stream/node_modules/brace-expansion": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.1.tgz",
-      "integrity": "sha512-XnAIvQ8eM+kC6aULx6wuQiwVsnzsi9d3WxzV3FpWTGA19F621kwdbsAcFKXgKUHZWsy+mY6iL1sHTxWEFCytDA==",
-      "dependencies": {
-        "balanced-match": "^1.0.0"
-      }
-    },
-    "node_modules/zip-stream/node_modules/buffer": {
-      "version": "6.0.3",
-      "resolved": "https://registry.npmjs.org/buffer/-/buffer-6.0.3.tgz",
-      "integrity": "sha512-FTiCpNxtwiZZHEZbcbTIcZjERVICn9yq/pDFkTl95/AxzD1naBctN7YO68riM/gLSDY7sdrMby8hofADYuuqOA==",
-      "funding": [
-        {
-          "type": "github",
-          "url": "https://github.com/sponsors/feross"
-        },
-        {
-          "type": "patreon",
-          "url": "https://www.patreon.com/feross"
-        },
-        {
-          "type": "consulting",
-          "url": "https://feross.org/support"
-        }
-      ],
-      "dependencies": {
-        "base64-js": "^1.3.1",
-        "ieee754": "^1.2.1"
-      }
-    },
-    "node_modules/zip-stream/node_modules/glob": {
-      "version": "10.3.10",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-10.3.10.tgz",
-      "integrity": "sha512-fa46+tv1Ak0UPK1TOy/pZrIybNNt4HCv7SDzwyfiOZkvZLEbjsZkJBPtDHVshZjbecAoAGSC20MjLDG/qr679g==",
-      "dependencies": {
-        "foreground-child": "^3.1.0",
-        "jackspeak": "^2.3.5",
-        "minimatch": "^9.0.1",
-        "minipass": "^5.0.0 || ^6.0.2 || ^7.0.0",
-        "path-scurry": "^1.10.1"
-      },
-      "bin": {
-        "glob": "dist/esm/bin.mjs"
-      },
-      "engines": {
-        "node": ">=16 || 14 >=14.17"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
-    "node_modules/zip-stream/node_modules/minimatch": {
-      "version": "9.0.3",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.3.tgz",
-      "integrity": "sha512-RHiac9mvaRw0x3AYRgDC1CxAP7HTcNrrECeA8YYJeWnpo+2Q5CegtZjaotWTWxDG3UeGA1coE05iH1mPjT/2mg==",
-      "dependencies": {
-        "brace-expansion": "^2.0.1"
-      },
-      "engines": {
-        "node": ">=16 || 14 >=14.17"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
-    "node_modules/zip-stream/node_modules/readable-stream": {
-      "version": "4.5.2",
-      "resolved": "https://registry.npmjs.org/readable-stream/-/readable-stream-4.5.2.tgz",
-      "integrity": "sha512-yjavECdqeZ3GLXNgRXgeQEdz9fvDDkNKyHnbHRFtOr7/LcfgBcmct7t/ET+HaCTqfh06OzoAxrkN/IfjJBVe+g==",
-      "dependencies": {
-        "abort-controller": "^3.0.0",
-        "buffer": "^6.0.3",
-        "events": "^3.3.0",
-        "process": "^0.11.10",
-        "string_decoder": "^1.3.0"
-      },
-      "engines": {
-        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
-      }
    }
  }
 }
@@ -1,6 +1,6 @@
 {
  "name": "@actions/artifact",
-  "version": "2.1.6",
+  "version": "2.1.8",
  "preview": true,
  "description": "Actions artifact lib",
  "keywords": [
@@ -49,15 +49,14 @@
    "@octokit/plugin-retry": "^3.0.9",
    "@octokit/request-error": "^5.0.0",
    "@protobuf-ts/plugin": "^2.2.3-alpha.1",
-    "archiver": "^5.3.1",
-    "async": "^3.2.5",
+    "archiver": "^7.0.1",
    "crypto": "^1.0.1",
    "jwt-decode": "^3.1.2",
    "twirp-ts": "^2.5.0",
-    "unzip-stream": "^0.3.1",
-    "zip-stream": "^6.0.1"
+    "unzip-stream": "^0.3.1"
  },
  "devDependencies": {
+    "@types/archiver": "^5.3.2",
    "@types/unzip-stream": "^0.3.4",
    "typedoc": "^0.25.4",
    "typedoc-plugin-markdown": "^3.17.1",
@@ -1,7 +1,4 @@
 import fs from 'fs/promises'
-import * as stream from 'stream'
-import {createWriteStream} from 'fs'
-import * as path from 'path'
 import * as github from '@actions/github'
 import * as core from '@actions/core'
 import * as httpClient from '@actions/http-client'
@@ -47,11 +44,6 @@ async function streamExtract(url: string, directory: string): Promise<void> {
      await streamExtractExternal(url, directory)
      return
    } catch (error) {
-      if (error.message.includes('Malformed extraction path')) {
-        throw new Error(
-          `Artifact download failed with unretryable error: ${error.message}`
-        )
-      }
      retryCount++
      core.debug(
        `Failed to download artifact after ${retryCount} retries due to ${error.message}. Retrying in 5 seconds...`
@@ -86,8 +78,6 @@ export async function streamExtractExternal(
    }
    const timer = setTimeout(timerFn, timeout)

-    const createdDirectories = new Set<string>()
-    createdDirectories.add(directory)
    response.message
      .on('data', () => {
        timer.refresh()
@@ -99,46 +89,8 @@ export async function streamExtractExternal(
        clearTimeout(timer)
        reject(error)
      })
-      .pipe(unzip.Parse())
-      .pipe(
-        new stream.Transform({
-          objectMode: true,
-          transform: async (entry, _, callback) => {
-            const fullPath = path.normalize(path.join(directory, entry.path))
-            if (!directory.endsWith(path.sep)) {
-              directory += path.sep
-            }
-            if (!fullPath.startsWith(directory)) {
-              reject(new Error(`Malformed extraction path: ${fullPath}`))
-            }
-
-            if (entry.type === 'Directory') {
-              if (!createdDirectories.has(fullPath)) {
-                createdDirectories.add(fullPath)
-                await resolveOrCreateDirectory(fullPath).then(() => {
-                  entry.autodrain()
-                  callback()
-                })
-              } else {
-                entry.autodrain()
-                callback()
-              }
-            } else {
-              core.info(`Extracting artifact entry: ${fullPath}`)
-              if (!createdDirectories.has(path.dirname(fullPath))) {
-                createdDirectories.add(path.dirname(fullPath))
-                await resolveOrCreateDirectory(path.dirname(fullPath))
-              }
-
-              const writeStream = createWriteStream(fullPath)
-              writeStream.on('finish', callback)
-              writeStream.on('error', reject)
-              entry.pipe(writeStream)
-            }
-          }
-        })
-      )
-      .on('finish', async () => {
+      .pipe(unzip.Extract({path: directory}))
+      .on('close', () => {
        clearTimeout(timer)
        resolve()
      })
@@ -30,10 +30,10 @@ export function isGhes(): boolean {

  const hostname = ghUrl.hostname.trimEnd().toUpperCase()
  const isGitHubHost = hostname === 'GITHUB.COM'
-  const isGheHost =
-    hostname.endsWith('.GHE.COM') || hostname.endsWith('.GHE.LOCALHOST')
+  const isGheHost = hostname.endsWith('.GHE.COM')
+  const isLocalHost = hostname.endsWith('.LOCALHOST')

-  return !isGitHubHost && !isGheHost
+  return !isGitHubHost && !isGheHost && !isLocalHost
 }

 export function getGitHubWorkspaceDir(): string {
@@ -67,25 +67,18 @@ export async function uploadArtifact(
      'CreateArtifact: response from backend was not ok'
    )
  }
-  // Create the zipupload stream for use in blob upload
+
  const zipUploadStream = await createZipUploadStream(
    zipSpecification,
    options?.compressionLevel
-  ).catch(err => {
-    throw new InvalidResponseError(
-      `createZipUploadStream: response from backend was not ok: ${err}`
-    )
-  })
+  )

  // Upload zip to blob storage
  const uploadResult = await uploadZipToBlobStorage(
    createArtifactResp.signedUploadUrl,
    zipUploadStream
-  ).catch(err => {
-    throw new InvalidResponseError(
-      `uploadZipToBlobStorage: response blob was not ok: ${err}`
-    )
-  })
+  )
+
  // finalize the artifact
  const finalizeArtifactReq: FinalizeArtifactRequest = {
    workflowRunBackendId: backendIds.workflowRunBackendId,
@@ -93,12 +86,15 @@ export async function uploadArtifact(
    name,
    size: uploadResult.uploadSize ? uploadResult.uploadSize.toString() : '0'
  }
+
  if (uploadResult.sha256Hash) {
    finalizeArtifactReq.hash = StringValue.create({
      value: `sha256:${uploadResult.sha256Hash}`
    })
  }
+
  core.info(`Finalizing artifact upload`)
+
  const finalizeArtifactResp =
    await artifactClient.FinalizeArtifact(finalizeArtifactReq)
  if (!finalizeArtifactResp.ok) {
@@ -1,7 +1,6 @@
 import * as stream from 'stream'
-import * as ZipStream from 'zip-stream'
+import * as archiver from 'archiver'
 import * as core from '@actions/core'
-import async from 'async'
 import {createReadStream} from 'fs'
 import {UploadZipSpecification} from './upload-zip-specification'
 import {getUploadChunkSize} from '../shared/config'
@@ -31,57 +30,31 @@ export async function createZipUploadStream(
    `Creating Artifact archive with compressionLevel: ${compressionLevel}`
  )

-  const zlibOptions = {
-    zlib: {
-      level: compressionLevel,
-      bufferSize: getUploadChunkSize()
-    }
-  }
-  const zip = new ZipStream.default(zlibOptions)
+  const zip = archiver.create('zip', {
+    highWaterMark: getUploadChunkSize(),
+    zlib: {level: compressionLevel}
+  })

-  const bufferSize = getUploadChunkSize()
-  const zipUploadStream = new ZipUploadStream(bufferSize)
-  zip.pipe(zipUploadStream)
  // register callbacks for various events during the zip lifecycle
  zip.on('error', zipErrorCallback)
  zip.on('warning', zipWarningCallback)
  zip.on('finish', zipFinishCallback)
  zip.on('end', zipEndCallback)
-  const addFileToZip = (
-    file: UploadZipSpecification,
-    callback: (error?: Error) => void
-  ): void => {
+
+  for (const file of uploadSpecification) {
    if (file.sourcePath !== null) {
-      zip.entry(
-        createReadStream(file.sourcePath),
-        {name: file.destinationPath},
-        (error: unknown) => {
-          if (error) {
-            callback(error as Error) // Cast the error object to the Error type
-            return
-          }
-          callback()
-        }
-      )
-    } else {
-      zip.entry('', {name: file.destinationPath}, (error: unknown) => {
-        if (error) {
-          callback(error as Error)
-          return
-        }
-        callback()
+      // Add a normal file to the zip
+      zip.append(createReadStream(file.sourcePath), {
+        name: file.destinationPath
      })
+    } else {
+      // Add a directory to the zip
+      zip.append('', {name: file.destinationPath})
    }
  }

-  async.eachSeries(uploadSpecification, addFileToZip, (error: unknown) => {
-    if (error) {
-      core.error('Failed to add a file to the zip:')
-      core.info(error.toString()) // Convert error to string
-      return
-    }
-    zip.finalize() // Finalize the archive once all files have been added
-  })
+  const bufferSize = getUploadChunkSize()
+  const zipUploadStream = new ZipUploadStream(bufferSize)

  core.debug(
    `Zip write high watermark value ${zipUploadStream.writableHighWaterMark}`
@@ -90,6 +63,9 @@ export async function createZipUploadStream(
    `Zip read high watermark value ${zipUploadStream.readableHighWaterMark}`
  )

+  zip.pipe(zipUploadStream)
+  zip.finalize()
+
  return zipUploadStream
 }

@@ -100,6 +76,7 @@ const zipErrorCallback = (error: any): void => {

  throw new Error('An error has occurred during zip creation for the artifact')
 }
+
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 const zipWarningCallback = (error: any): void => {
  if (error.code === 'ENOENT') {
@@ -12,6 +12,9 @@ Once the attestation has been created and signed, it will be uploaded to the GH
 attestations API and associated with the repository from which the workflow was
 initiated.

+See [Using artifact attestations to establish provenance for builds](https://docs.github.com/en/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds)
+for more information on artifact attestations.
+
 ## Usage

 ### `attest`
@@ -1,5 +1,17 @@
 # @actions/attest Releases

+### 1.3.0
+
+- Dynamic construction of Sigstore API URLs
+- Switch to new GH provenance build type
+- Fetch existing Rekor entry on 409 conflict error
+- Bump @sigstore/bundle from 2.3.0 to 2.3.2
+- Bump @sigstore/sign from 2.3.0 to 2.3.2
+
+### 1.2.1
+
+- Retry request on attestation persistence failure
+
 ### 1.2.0

 - Generate attestations using the v0.3 Sigstore bundle format.
@@ -4,7 +4,7 @@ exports[`provenance functions buildSLSAProvenancePredicate returns a provenance
 {
  "params": {
    "buildDefinition": {
-      "buildType": "https://slsa-framework.github.io/github-actions-buildtypes/workflow/v1",
+      "buildType": "https://actions.github.io/buildtypes/workflow/v1",
      "externalParameters": {
        "workflow": {
          "path": ".github/workflows/main.yml",
@@ -17,6 +17,7 @@ exports[`provenance functions buildSLSAProvenancePredicate returns a provenance
          "event_name": "push",
          "repository_id": "repo-id",
          "repository_owner_id": "owner-id",
+          "runner_environment": "github-hosted",
        },
      },
      "resolvedDependencies": [
@@ -30,7 +31,7 @@ exports[`provenance functions buildSLSAProvenancePredicate returns a provenance
    },
    "runDetails": {
      "builder": {
-        "id": "https://github.com/actions/runner/github-hosted",
+        "id": "https://github.com/owner/workflows/.github/workflows/publish.yml@main",
      },
      "metadata": {
        "invocationId": "https://github.com/owner/repo/actions/runs/run-id/attempts/run-attempt",
@@ -0,0 +1,41 @@
+import {signingEndpoints} from '../src/endpoints'
+
+describe('signingEndpoints', () => {
+  const originalEnv = process.env
+
+  afterEach(() => {
+    process.env = originalEnv
+  })
+
+  describe('when using github.com', () => {
+    beforeEach(async () => {
+      process.env = {
+        ...originalEnv,
+        GITHUB_SERVER_URL: 'https://github.com'
+      }
+    })
+
+    it('returns expected endpoints', async () => {
+      const endpoints = signingEndpoints('github')
+
+      expect(endpoints.fulcioURL).toEqual('https://fulcio.githubapp.com')
+      expect(endpoints.tsaServerURL).toEqual('https://timestamp.githubapp.com')
+    })
+  })
+
+  describe('when using custom domain', () => {
+    beforeEach(async () => {
+      process.env = {
+        ...originalEnv,
+        GITHUB_SERVER_URL: 'https://foo.bar.com'
+      }
+    })
+
+    it('returns a expected endpoints', async () => {
+      const endpoints = signingEndpoints('github')
+
+      expect(endpoints.fulcioURL).toEqual('https://fulcio.foo.bar.com')
+      expect(endpoints.tsaServerURL).toEqual('https://timestamp.foo.bar.com')
+    })
+  })
+})
@@ -45,7 +45,8 @@ describe('getIDTokenClaims', () => {
      sha: 'sha',
      repository: 'repo',
      event_name: 'push',
-      workflow_ref: 'main',
+      job_workflow_ref: 'job_workflow_ref',
+      workflow_ref: 'workflow',
      repository_id: '1',
      repository_owner_id: '1',
      runner_environment: 'github-hosted',
@@ -3,7 +3,7 @@ import {mockFulcio, mockRekor, mockTSA} from '@sigstore/mock'
 import * as jose from 'jose'
 import nock from 'nock'
 import {MockAgent, setGlobalDispatcher} from 'undici'
-import {SIGSTORE_GITHUB, SIGSTORE_PUBLIC_GOOD} from '../src/endpoints'
+import {SIGSTORE_PUBLIC_GOOD, signingEndpoints} from '../src/endpoints'
 import {attestProvenance, buildSLSAProvenancePredicate} from '../src/provenance'

 describe('provenance functions', () => {
@@ -23,6 +23,7 @@ describe('provenance functions', () => {
    repository: 'owner/repo',
    ref: 'refs/heads/main',
    sha: 'babca52ab0c93ae16539e5923cb0d7403b9a093b',
+    job_workflow_ref: 'owner/workflows/.github/workflows/publish.yml@main',
    workflow_ref: 'owner/repo/.github/workflows/main.yml@main',
    event_name: 'push',
    repository_id: 'repo-id',
@@ -95,7 +96,7 @@ describe('provenance functions', () => {
    })

    describe('when using the github Sigstore instance', () => {
-      const {fulcioURL, tsaServerURL} = SIGSTORE_GITHUB
+      const {fulcioURL, tsaServerURL} = signingEndpoints('github')

      beforeEach(async () => {
        // Mock Sigstore
@@ -52,7 +52,39 @@ describe('writeAttestation', () => {
    })

    it('throws an error', async () => {
-      await expect(writeAttestation(attestation, token)).rejects.toThrow(/oops/)
+      await expect(
+        writeAttestation(attestation, token, {retry: 0})
+      ).rejects.toThrow(/oops/)
+    })
+  })
+
+  describe('when the api call fails but succeeds on retry', () => {
+    beforeEach(() => {
+      const pool = mockAgent.get('https://api.github.com')
+
+      pool
+        .intercept({
+          path: '/repos/foo/bar/attestations',
+          method: 'POST',
+          headers: {authorization: `token ${token}`},
+          body: JSON.stringify({bundle: attestation})
+        })
+        .reply(500, 'oops')
+        .times(1)
+
+      pool
+        .intercept({
+          path: '/repos/foo/bar/attestations',
+          method: 'POST',
+          headers: {authorization: `token ${token}`},
+          body: JSON.stringify({bundle: attestation})
+        })
+        .reply(201, {id: '123'})
+        .times(1)
+    })
+
+    it('persists the attestation', async () => {
+      await expect(writeAttestation(attestation, token)).resolves.toEqual('123')
    })
  })
 })
@@ -1,6 +1,6 @@
 {
  "name": "@actions/attest",
-  "version": "1.2.0",
+  "version": "1.3.0",
  "description": "Actions attestation lib",
  "keywords": [
    "github",
@@ -35,7 +35,7 @@
    "url": "https://github.com/actions/toolkit/issues"
  },
  "devDependencies": {
-    "@sigstore/mock": "^0.6.5",
+    "@sigstore/mock": "^0.7.4",
    "@sigstore/rekor-types": "^2.0.0",
    "@types/jsonwebtoken": "^9.0.6",
    "jose": "^5.2.3",
@@ -46,9 +46,15 @@
    "@actions/core": "^1.10.1",
    "@actions/github": "^6.0.0",
    "@actions/http-client": "^2.2.1",
-    "@sigstore/bundle": "^2.3.0",
-    "@sigstore/sign": "^2.3.0",
+    "@octokit/plugin-retry": "^6.0.1",
+    "@sigstore/bundle": "^2.3.2",
+    "@sigstore/sign": "^2.3.2",
    "jsonwebtoken": "^9.0.2",
    "jwks-rsa": "^3.1.0"
+  },
+  "overrides": {
+    "@octokit/plugin-retry": {
+      "@octokit/core": "^5.2.0"
+    }
  }
 }
@@ -6,9 +6,6 @@ const GITHUB_ID = 'github'
 const FULCIO_PUBLIC_GOOD_URL = 'https://fulcio.sigstore.dev'
 const REKOR_PUBLIC_GOOD_URL = 'https://rekor.sigstore.dev'

-const FULCIO_INTERNAL_URL = 'https://fulcio.githubapp.com'
-const TSA_INTERNAL_URL = 'https://timestamp.githubapp.com'
-
 export type SigstoreInstance = typeof PUBLIC_GOOD_ID | typeof GITHUB_ID

 export type Endpoints = {
@@ -22,11 +19,6 @@ export const SIGSTORE_PUBLIC_GOOD: Endpoints = {
  rekorURL: REKOR_PUBLIC_GOOD_URL
 }

-export const SIGSTORE_GITHUB: Endpoints = {
-  fulcioURL: FULCIO_INTERNAL_URL,
-  tsaServerURL: TSA_INTERNAL_URL
-}
-
 export const signingEndpoints = (sigstore?: SigstoreInstance): Endpoints => {
  let instance: SigstoreInstance

@@ -45,6 +37,19 @@ export const signingEndpoints = (sigstore?: SigstoreInstance): Endpoints => {
    case PUBLIC_GOOD_ID:
      return SIGSTORE_PUBLIC_GOOD
    case GITHUB_ID:
-      return SIGSTORE_GITHUB
+      return buildGitHubEndpoints()
+  }
+}
+
+function buildGitHubEndpoints(): Endpoints {
+  const serverURL = process.env.GITHUB_SERVER_URL || 'https://github.com'
+  let host = new URL(serverURL).hostname
+
+  if (host === 'github.com') {
+    host = 'githubapp.com'
+  }
+  return {
+    fulcioURL: `https://fulcio.${host}`,
+    tsaServerURL: `https://timestamp.${host}`
  }
 }
@@ -11,6 +11,7 @@ const REQUIRED_CLAIMS = [
  'sha',
  'repository',
  'event_name',
+  'job_workflow_ref',
  'workflow_ref',
  'repository_id',
  'repository_owner_id',
@@ -3,10 +3,7 @@ import {getIDTokenClaims} from './oidc'
 import type {Attestation, Predicate} from './shared.types'

 const SLSA_PREDICATE_V1_TYPE = 'https://slsa.dev/provenance/v1'
-
-const GITHUB_BUILDER_ID_PREFIX = 'https://github.com/actions/runner'
-const GITHUB_BUILD_TYPE =
-  'https://slsa-framework.github.io/github-actions-buildtypes/workflow/v1'
+const GITHUB_BUILD_TYPE = 'https://actions.github.io/buildtypes/workflow/v1'

 const DEFAULT_ISSUER = 'https://token.actions.githubusercontent.com'

@@ -55,7 +52,8 @@ export const buildSLSAProvenancePredicate = async (
          github: {
            event_name: claims.event_name,
            repository_id: claims.repository_id,
-            repository_owner_id: claims.repository_owner_id
+            repository_owner_id: claims.repository_owner_id,
+            runner_environment: claims.runner_environment
          }
        },
        resolvedDependencies: [
@@ -69,7 +67,7 @@ export const buildSLSAProvenancePredicate = async (
      },
      runDetails: {
        builder: {
-          id: `${GITHUB_BUILDER_ID_PREFIX}/${claims.runner_environment}`
+          id: `${serverURL}/${claims.job_workflow_ref}`
        },
        metadata: {
          invocationId: `${serverURL}/${claims.repository}/actions/runs/${claims.run_id}/attempts/${claims.run_attempt}`
@@ -87,6 +87,7 @@ const initBundleBuilder = (opts: SignOptions): BundleBuilder => {
      new RekorWitness({
        rekorBaseURL: opts.rekorURL,
        entryType: 'dsse',
+        fetchOnConflict: true,
        timeout,
        retry
      })
@@ -1,7 +1,12 @@
 import * as github from '@actions/github'
+import {retry} from '@octokit/plugin-retry'

 const CREATE_ATTESTATION_REQUEST = 'POST /repos/{owner}/{repo}/attestations'
+const DEFAULT_RETRY_COUNT = 5

+export type WriteOptions = {
+  retry?: number
+}
 /**
 * Writes an attestation to the repository's attestations endpoint.
 * @param attestation - The attestation to write.
@@ -11,9 +16,11 @@ const CREATE_ATTESTATION_REQUEST = 'POST /repos/{owner}/{repo}/attestations'
 */
 export const writeAttestation = async (
  attestation: unknown,
-  token: string
+  token: string,
+  options: WriteOptions = {}
 ): Promise<string> => {
-  const octokit = github.getOctokit(token)
+  const retries = options.retry ?? DEFAULT_RETRY_COUNT
+  const octokit = github.getOctokit(token, {retry: {retries}}, retry)

  try {
    const response = await octokit.request(CREATE_ATTESTATION_REQUEST, {
Author	SHA1	Message	Date
Rob HerleyandGitHub	56832696fc	npm audit fix	2024-07-03 17:03:40 +00:00
Rob HerleyandGitHub	176b40a888	allow localhost hostnames for artifact checks	2024-07-03 16:55:53 +00:00
Brian DeHamerandGitHub	361a115e53	Merge pull request #1759 from actions/bdehamer/rekor-409 config rekor to fetch on conflict	2024-06-12 12:25:06 -07:00
Brian DeHamer	dddc440d56	config rekor to fetch on conflict Signed-off-by: Brian DeHamer <[email protected]>	2024-06-12 11:57:18 -07:00
Brian DeHamerandGitHub	08d6f14ea8	Merge pull request #1745 from actions/bdehamer/attest-provenance (@actions/attest) New GHA provenance build type	2024-06-12 11:45:37 -07:00
Brian DeHamer	73100a7f85	new GHA build provenance Signed-off-by: Brian DeHamer <[email protected]>	2024-06-05 14:54:34 -07:00
Brian DeHamerandGitHub	c6b487124a	Merge pull request #1738 from actions/bdehamer/attest-1.3.0 (@actions/attest) prepare 1.3.0 release	2024-06-05 14:53:11 -07:00
Brian DeHamer	8735a7e2da	prep 1.3.0 release of @actions/attest Signed-off-by: Brian DeHamer <[email protected]>	2024-05-21 13:11:37 -07:00
Fredrik SkogmanandGitHub	d1df13e178	Merge pull request #1735 from kommendorkapten/dynamic-urls Read the server url from the environment variable.	2024-05-21 07:35:07 +02:00
Fredrik Skogman	d3d7736bae	Fixed a spelling error	2024-05-20 07:57:44 +02:00
Fredrik Skogman	7d18e7aa0d	PR feedback. Juse more JS idiomatic code	2024-05-20 07:52:36 +02:00
Fredrik Skogman	e60694077d	Read the server url from the environment variable. Instead of having the urls hardcoded, read them from the environment. I opted to read from the environment variable instead of the github context because it would be easier to test.	2024-05-16 17:00:35 +02:00
Brian DeHamerandGitHub	ae38557bb0	Merge pull request #1730 from actions/bdehamer/attest-readme Update @actions/attest README	2024-05-01 11:48:55 -07:00
Brian DeHamer	abb586d71e	add doc link in @actions/attest readme Signed-off-by: Brian DeHamer <[email protected]>	2024-05-01 11:30:45 -07:00
Brian DeHamerandGitHub	81a73aba8b	Merge pull request #1725 from actions/bdehamer/attest-retry-persist (@actions/attest) retry request on failure to save attestation	2024-04-24 19:59:43 -07:00
Brian DeHamer	0e8fe8af62	retry request on failure to save attestation Signed-off-by: Brian DeHamer <[email protected]>	2024-04-24 15:07:39 -07:00
BethanyandGitHub	29885a805e	Merge pull request #1724 from actions/bethanyj28/update-unzip-stream Use latest `unzip-stream` and `unzip.Extract`	2024-04-24 09:09:09 -04:00
bethanyj28	9eb3d3a673	lint	2024-04-23 16:10:57 -04:00
bethanyj28	6e642f628f	lint	2024-04-23 16:06:02 -04:00
bethanyj28	0159bbe7f2	bump version	2024-04-23 16:03:52 -04:00
bethanyj28	476276bf98	use latest unzip-stream	2024-04-23 15:54:54 -04:00