test

2024-04-15 13:05:46 +00:00
19 changed files with 403 additions and 1204 deletions
@@ -9015,24 +9015,6 @@
        "node": ">=8"
      }
    },
-    "node_modules/jackspeak": {
-      "version": "2.3.6",
-      "resolved": "https://registry.npmjs.org/jackspeak/-/jackspeak-2.3.6.tgz",
-      "integrity": "sha512-N3yCS/NegsOBokc8GAdM8UcmfsKiSS8cipheD/nivzr700H+nsMOxJjQnvwOcRYVuFkdH0wGUvW2WbXGmrZGbQ==",
-      "dev": true,
-      "dependencies": {
-        "@isaacs/cliui": "^8.0.2"
-      },
-      "engines": {
-        "node": ">=14"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      },
-      "optionalDependencies": {
-        "@pkgjs/parseargs": "^0.11.0"
-      }
-    },
    "node_modules/jake": {
      "version": "10.8.7",
      "resolved": "https://registry.npmjs.org/jake/-/jake-10.8.7.tgz",
@@ -13,7 +13,7 @@
    "lint": "eslint packages/**/*.ts",
    "lint-fix": "eslint packages/**/*.ts --fix",
    "new-package": "scripts/create-package",
-    "test": "jest --testTimeout 70000"
+    "test": "jest --testTimeout 60000"
  },
  "devDependencies": {
    "@types/jest": "^29.5.4",
@@ -16,7 +16,6 @@ This is the core library that powers the [`@actions/upload-artifact`](https://gi
    - [Downloading from other workflow runs or repos](#downloading-from-other-workflow-runs-or-repos)
    - [Speeding up large uploads](#speeding-up-large-uploads)
  - [Additional Resources](#additional-resources)
-
 ## v2 - What's New

 > [!IMPORTANT]
@@ -1,13 +1,5 @@
 # @actions/artifact Releases

-### 2.1.6
-
- Will retry on invalid request responses.
-
-### 2.1.5
-
- Bumped `archiver` dependency to 7.0.1
-
 ### 2.1.4

 - Adds info-level logging for zip extraction
@@ -19,9 +11,9 @@
 ### 2.1.2

 - Updated the stream extract functionality to use `unzip.Parse()` instead of `unzip.Extract()` for greater control of unzipping artifacts
-
+  
 ### 2.1.1
-
+ 
 - Updated `isGhes` check to include `.ghe.com` and `.ghe.localhost` as accepted hosts

 ### 2.1.0
@@ -116,54 +116,6 @@ describe('artifact-http-client', () => {
    expect(mockPost).toHaveBeenCalledTimes(2)
  })

-  it('should retry if invalid body response', async () => {
-    const mockPost = jest
-      .fn(() => {
-        const msgSucceeded = new http.IncomingMessage(new net.Socket())
-        msgSucceeded.statusCode = 200
-        return {
-          message: msgSucceeded,
-          readBody: async () => {
-            return Promise.resolve(
-              `{"ok": true, "signedUploadUrl": "http://localhost:8080/upload"}`
-            )
-          }
-        }
-      })
-      .mockImplementationOnce(() => {
-        const msgFailed = new http.IncomingMessage(new net.Socket())
-        msgFailed.statusCode = 502
-        msgFailed.statusMessage = 'Bad Gateway'
-        return {
-          message: msgFailed,
-          readBody: async () => {
-            return Promise.resolve('💥')
-          }
-        }
-      })
-    const mockHttpClient = (
-      HttpClient as unknown as jest.Mock
-    ).mockImplementation(() => {
-      return {
-        post: mockPost
-      }
-    })
-
-    const client = internalArtifactTwirpClient(clientOptions)
-    const artifact = await client.CreateArtifact({
-      workflowRunBackendId: '1234',
-      workflowJobRunBackendId: '5678',
-      name: 'artifact',
-      version: 4
-    })
-
-    expect(mockHttpClient).toHaveBeenCalledTimes(1)
-    expect(artifact).toBeDefined()
-    expect(artifact.ok).toBe(true)
-    expect(artifact.signedUploadUrl).toBe('http://localhost:8080/upload')
-    expect(mockPost).toHaveBeenCalledTimes(2)
-  })
-
  it('should fail if the request fails 5 times', async () => {
    const mockPost = jest.fn(() => {
      const msgFailed = new http.IncomingMessage(new net.Socket())
@@ -7,21 +7,11 @@ import {Timestamp, ArtifactServiceClientJSON} from '../src/generated'
 import * as blobUpload from '../src/internal/upload/blob-upload'
 import {uploadArtifact} from '../src/internal/upload/upload-artifact'
 import {noopLogs} from './common'
-import {
-  FilesNotFoundError,
-  InvalidResponseError
-} from '../src/internal/shared/errors'
-class NodeJSError extends Error {
-  code: string
+import {FilesNotFoundError} from '../src/internal/shared/errors'

-  constructor(message?: string, code?: string) {
-    super(message) // Pass the message to the Error constructor
-    this.code = code || ''
-  }
-}
 describe('upload-artifact', () => {
  beforeEach(() => {
-    // noopLogs()
+    noopLogs()
  })

  afterEach(() => {
@@ -361,102 +351,4 @@ describe('upload-artifact', () => {

    expect(uploadResp).rejects.toThrow()
  })
-
-  describe('should respond with non-successful callback on different zipstream lifecycle methods', () => {
-    beforeEach(() => {
-      noopLogs()
-    })
-
-    afterEach(() => {
-      jest.restoreAllMocks()
-    })
-
-    it('should handle ENOENT error', async () => {
-      const mockDate = new Date('2020-01-01')
-      jest
-        .spyOn(uploadZipSpecification, 'validateRootDirectory')
-        .mockReturnValue()
-      jest
-        .spyOn(uploadZipSpecification, 'getUploadZipSpecification')
-        .mockReturnValue([
-          {
-            sourcePath: '/home/user/files/plz-upload/file1.txt',
-            destinationPath: 'file1.txt'
-          },
-          {
-            sourcePath: '/home/user/files/plz-upload/file2.txt',
-            destinationPath: 'file2.txt'
-          }
-        ])
-
-      const mockZipStream = {
-        entry: jest.fn((source, data, callback) => {
-          const err = (new NodeJSError(
-            "ENOENT: no such file or directory, open '/home/user/files/plz-upload/file1.txt'"
-          ).code = 'ENOENT')
-          callback(null, err)
-        }),
-        pipe: jest.fn(),
-        on: jest.fn(),
-        finalize: jest.fn()
-      }
-
-      jest.mock('zip-stream', () => {
-        return {
-          default: jest.fn().mockImplementation(() => mockZipStream)
-        }
-      })
-
-      jest
-        .spyOn(zip, 'createZipUploadStream')
-        .mockReturnValue(
-          Promise.reject(
-            new NodeJSError(
-              "ENOENT: no such file or directory, open '/home/user/files/plz-upload/file1.txt'"
-            )
-          )
-        )
-      jest.spyOn(util, 'getBackendIdsFromToken').mockReturnValue({
-        workflowRunBackendId: '1234',
-        workflowJobRunBackendId: '5678'
-      })
-      jest
-        .spyOn(retention, 'getExpiration')
-        .mockReturnValue(Timestamp.fromDate(mockDate))
-      jest
-        .spyOn(ArtifactServiceClientJSON.prototype, 'CreateArtifact')
-        .mockReturnValue(
-          Promise.resolve({
-            ok: true,
-            signedUploadUrl: 'https://signed-upload-url.com'
-          })
-        )
-      jest.spyOn(blobUpload, 'uploadZipToBlobStorage').mockReturnValue(
-        Promise.resolve({
-          uploadSize: 1234,
-          sha256Hash: 'test-sha256-hash'
-        })
-      )
-      jest
-        .spyOn(ArtifactServiceClientJSON.prototype, 'FinalizeArtifact')
-        .mockReturnValue(Promise.resolve({ok: true, artifactId: '1'}))
-
-      // ArtifactHttpClient mocks
-      jest.spyOn(config, 'getRuntimeToken').mockReturnValue('test-token')
-      jest
-        .spyOn(config, 'getResultsServiceUrl')
-        .mockReturnValue('https://test-url.com')
-
-      const uploadResp = uploadArtifact(
-        'test-artifact',
-        [
-          '/home/user/files/plz-upload/file1.txt',
-          '/home/user/files/plz-upload/file2.txt',
-          '/home/user/files/plz-upload/dir/file3.txt'
-        ],
-        '/home/user/files/plz-upload'
-      )
-      expect(uploadResp).rejects.toThrowError(InvalidResponseError)
-    })
-  })
 })
@@ -1,6 +1,6 @@
 {
  "name": "@actions/artifact",
-  "version": "2.1.6",
+  "version": "2.1.4",
  "preview": true,
  "description": "Actions artifact lib",
  "keywords": [
@@ -50,14 +50,13 @@
    "@octokit/request-error": "^5.0.0",
    "@protobuf-ts/plugin": "^2.2.3-alpha.1",
    "archiver": "^5.3.1",
-    "async": "^3.2.5",
    "crypto": "^1.0.1",
    "jwt-decode": "^3.1.2",
    "twirp-ts": "^2.5.0",
-    "unzip-stream": "^0.3.1",
-    "zip-stream": "^6.0.1"
+    "unzip-stream": "^0.3.1"
  },
  "devDependencies": {
+    "@types/archiver": "^5.3.2",
    "@types/unzip-stream": "^0.3.4",
    "typedoc": "^0.25.4",
    "typedoc-plugin-markdown": "^3.17.1",
@@ -102,6 +102,7 @@ class ArtifactHttpClient implements Rpc {
      } catch (error) {
        if (error instanceof SyntaxError) {
          debug(`Raw Body: ${rawBody}`)
+          throw error
        }

        if (error instanceof UsageError) {
@@ -24,30 +24,11 @@ export async function uploadZipToBlobStorage(
  zipUploadStream: ZipUploadStream
 ): Promise<BlobUploadResponse> {
  let uploadByteCount = 0
-  let lastProgressTime = Date.now()
-  let timeoutId: NodeJS.Timeout | undefined

-  const chunkTimer = (timeout: number): NodeJS.Timeout => {
-    // clear the previous timeout
-    if (timeoutId) {
-      clearTimeout(timeoutId)
-    }
-
-    timeoutId = setTimeout(() => {
-      const now = Date.now()
-      // if there's been more than 30 seconds since the
-      // last progress event, then we'll consider the upload stalled
-      if (now - lastProgressTime > timeout) {
-        throw new Error('Upload progress stalled.')
-      }
-    }, timeout)
-    return timeoutId
-  }
  const maxConcurrency = getConcurrency()
  const bufferSize = getUploadChunkSize()
  const blobClient = new BlobClient(authenticatedUploadURL)
  const blockBlobClient = blobClient.getBlockBlobClient()
-  const timeoutDuration = 300000 // 30 seconds

  core.debug(
    `Uploading artifact zip to blob storage with maxConcurrency: ${maxConcurrency}, bufferSize: ${bufferSize}`
@@ -56,8 +37,6 @@ export async function uploadZipToBlobStorage(
  const uploadCallback = (progress: TransferProgressEvent): void => {
    core.info(`Uploaded bytes ${progress.loadedBytes}`)
    uploadByteCount = progress.loadedBytes
-    chunkTimer(timeoutDuration)
-    lastProgressTime = Date.now()
  }

  const options: BlockBlobUploadStreamOptions = {
@@ -75,8 +54,6 @@ export async function uploadZipToBlobStorage(
  core.info('Beginning upload of artifact content to blob storage')

  try {
-    // Start the chunk timer
-    timeoutId = chunkTimer(timeoutDuration)
    await blockBlobClient.uploadStream(
      uploadStream,
      bufferSize,
@@ -87,12 +64,8 @@ export async function uploadZipToBlobStorage(
    if (NetworkError.isNetworkErrorCode(error?.code)) {
      throw new NetworkError(error?.code)
    }
+
    throw error
-  } finally {
-    // clear the timeout whether or not the upload completes
-    if (timeoutId) {
-      clearTimeout(timeoutId)
-    }
  }

  core.info('Finished uploading artifact content to blob storage!')
@@ -106,6 +79,7 @@ export async function uploadZipToBlobStorage(
      `No data was uploaded to blob storage. Reported upload byte count is 0.`
    )
  }
+
  return {
    uploadSize: uploadByteCount,
    sha256Hash
@@ -67,25 +67,18 @@ export async function uploadArtifact(
      'CreateArtifact: response from backend was not ok'
    )
  }
-  // Create the zipupload stream for use in blob upload
+
  const zipUploadStream = await createZipUploadStream(
    zipSpecification,
    options?.compressionLevel
-  ).catch(err => {
-    throw new InvalidResponseError(
-      `createZipUploadStream: response from backend was not ok: ${err}`
-    )
-  })
+  )

  // Upload zip to blob storage
  const uploadResult = await uploadZipToBlobStorage(
    createArtifactResp.signedUploadUrl,
    zipUploadStream
-  ).catch(err => {
-    throw new InvalidResponseError(
-      `uploadZipToBlobStorage: response blob was not ok: ${err}`
-    )
-  })
+  )
+
  // finalize the artifact
  const finalizeArtifactReq: FinalizeArtifactRequest = {
    workflowRunBackendId: backendIds.workflowRunBackendId,
@@ -93,12 +86,15 @@ export async function uploadArtifact(
    name,
    size: uploadResult.uploadSize ? uploadResult.uploadSize.toString() : '0'
  }
+
  if (uploadResult.sha256Hash) {
    finalizeArtifactReq.hash = StringValue.create({
      value: `sha256:${uploadResult.sha256Hash}`
    })
  }
+
  core.info(`Finalizing artifact upload`)
+
  const finalizeArtifactResp =
    await artifactClient.FinalizeArtifact(finalizeArtifactReq)
  if (!finalizeArtifactResp.ok) {
@@ -1,7 +1,6 @@
 import * as stream from 'stream'
-import * as ZipStream from 'zip-stream'
+import * as archiver from 'archiver'
 import * as core from '@actions/core'
-import async from 'async'
 import {createReadStream} from 'fs'
 import {UploadZipSpecification} from './upload-zip-specification'
 import {getUploadChunkSize} from '../shared/config'
@@ -31,57 +30,31 @@ export async function createZipUploadStream(
    `Creating Artifact archive with compressionLevel: ${compressionLevel}`
  )

-  const zlibOptions = {
-    zlib: {
-      level: compressionLevel,
-      bufferSize: getUploadChunkSize()
-    }
-  }
-  const zip = new ZipStream.default(zlibOptions)
+  const zip = archiver.create('zip', {
+    highWaterMark: getUploadChunkSize(),
+    zlib: {level: compressionLevel}
+  })

-  const bufferSize = getUploadChunkSize()
-  const zipUploadStream = new ZipUploadStream(bufferSize)
-  zip.pipe(zipUploadStream)
  // register callbacks for various events during the zip lifecycle
  zip.on('error', zipErrorCallback)
  zip.on('warning', zipWarningCallback)
  zip.on('finish', zipFinishCallback)
  zip.on('end', zipEndCallback)
-  const addFileToZip = (
-    file: UploadZipSpecification,
-    callback: (error?: Error) => void
-  ): void => {
+
+  for (const file of uploadSpecification) {
    if (file.sourcePath !== null) {
-      zip.entry(
-        createReadStream(file.sourcePath),
-        {name: file.destinationPath},
-        (error: unknown) => {
-          if (error) {
-            callback(error as Error) // Cast the error object to the Error type
-            return
-          }
-          callback()
-        }
-      )
-    } else {
-      zip.entry('', {name: file.destinationPath}, (error: unknown) => {
-        if (error) {
-          callback(error as Error)
-          return
-        }
-        callback()
+      // Add a normal file to the zip
+      zip.append(createReadStream(file.sourcePath), {
+        name: file.destinationPath
      })
+    } else {
+      // Add a directory to the zip
+      zip.append('', {name: file.destinationPath})
    }
  }

-  async.eachSeries(uploadSpecification, addFileToZip, (error: unknown) => {
-    if (error) {
-      core.error('Failed to add a file to the zip:')
-      core.info(error.toString()) // Convert error to string
-      return
-    }
-    zip.finalize() // Finalize the archive once all files have been added
-  })
+  const bufferSize = getUploadChunkSize()
+  const zipUploadStream = new ZipUploadStream(bufferSize)

  core.debug(
    `Zip write high watermark value ${zipUploadStream.writableHighWaterMark}`
@@ -90,6 +63,9 @@ export async function createZipUploadStream(
    `Zip read high watermark value ${zipUploadStream.readableHighWaterMark}`
  )

+  zip.pipe(zipUploadStream)
+  zip.finalize()
+
  return zipUploadStream
 }

@@ -100,6 +76,7 @@ const zipErrorCallback = (error: any): void => {

  throw new Error('An error has occurred during zip creation for the artifact')
 }
+
 // eslint-disable-next-line @typescript-eslint/no-explicit-any
 const zipWarningCallback = (error: any): void => {
  if (error.code === 'ENOENT') {
@@ -5,7 +5,6 @@
 - Generate attestations using the v0.3 Sigstore bundle format.
 - Bump @sigstore/bundle from 2.2.0 to 2.3.0.
 - Bump @sigstore/sign from 2.2.3 to 2.3.0.
- Remove dependency on make-fetch-happen

 ### 1.1.0

@@ -2,7 +2,6 @@ import * as github from '@actions/github'
 import {mockFulcio, mockRekor, mockTSA} from '@sigstore/mock'
 import * as jose from 'jose'
 import nock from 'nock'
-import {MockAgent, setGlobalDispatcher} from 'undici'
 import {SIGSTORE_GITHUB, SIGSTORE_PUBLIC_GOOD} from '../src/endpoints'
 import {attestProvenance, buildSLSAProvenancePredicate} from '../src/provenance'

@@ -13,10 +12,6 @@ describe('provenance functions', () => {
  const jwksPath = '/.well-known/jwks.json'
  const tokenPath = '/token'

-  // MockAgent for mocking @actions/github
-  const mockAgent = new MockAgent()
-  setGlobalDispatcher(mockAgent)
-
  const claims = {
    iss: issuer,
    aud: 'nobody',
@@ -102,12 +97,9 @@ describe('provenance functions', () => {
        await mockFulcio({baseURL: fulcioURL, strict: false})
        await mockTSA({baseURL: tsaServerURL})

-        mockAgent
-          .get('https://api.github.com')
-          .intercept({
-            path: /^\/repos\/.*\/.*\/attestations$/,
-            method: 'post'
-          })
+        // Mock GH attestations API
+        nock('https://api.github.com')
+          .post(/^\/repos\/.*\/.*\/attestations$/)
          .reply(201, {id: attestationID})
      })

@@ -167,12 +159,8 @@ describe('provenance functions', () => {
        await mockRekor({baseURL: rekorURL})

        // Mock GH attestations API
-        mockAgent
-          .get('https://api.github.com')
-          .intercept({
-            path: /^\/repos\/.*\/.*\/attestations$/,
-            method: 'post'
-          })
+        nock('https://api.github.com')
+          .post(/^\/repos\/.*\/.*\/attestations$/)
          .reply(201, {id: attestationID})
      })

@@ -1,4 +1,4 @@
-import {MockAgent, setGlobalDispatcher} from 'undici'
+import nock from 'nock'
 import {writeAttestation} from '../src/store'

 describe('writeAttestation', () => {
@@ -6,9 +6,6 @@ describe('writeAttestation', () => {
  const attestation = {foo: 'bar '}
  const token = 'token'

-  const mockAgent = new MockAgent()
-  setGlobalDispatcher(mockAgent)
-
  beforeEach(() => {
    process.env = {
      ...originalEnv,
@@ -22,14 +19,9 @@ describe('writeAttestation', () => {

  describe('when the api call is successful', () => {
    beforeEach(() => {
-      mockAgent
-        .get('https://api.github.com')
-        .intercept({
-          path: '/repos/foo/bar/attestations',
-          method: 'POST',
-          headers: {authorization: `token ${token}`},
-          body: JSON.stringify({bundle: attestation})
-        })
+      nock('https://api.github.com')
+        .matchHeader('authorization', `token ${token}`)
+        .post('/repos/foo/bar/attestations', {bundle: attestation})
        .reply(201, {id: '123'})
    })

@@ -40,14 +32,9 @@ describe('writeAttestation', () => {

  describe('when the api call fails', () => {
    beforeEach(() => {
-      mockAgent
-        .get('https://api.github.com')
-        .intercept({
-          path: '/repos/foo/bar/attestations',
-          method: 'POST',
-          headers: {authorization: `token ${token}`},
-          body: JSON.stringify({bundle: attestation})
-        })
+      nock('https://api.github.com')
+        .matchHeader('authorization', `token ${token}`)
+        .post('/repos/foo/bar/attestations', {bundle: attestation})
        .reply(500, 'oops')
    })

@@ -15,15 +15,16 @@
        "@sigstore/bundle": "^2.3.0",
        "@sigstore/sign": "^2.3.0",
        "jsonwebtoken": "^9.0.2",
-        "jwks-rsa": "^3.1.0"
+        "jwks-rsa": "^3.1.0",
+        "make-fetch-happen": "^13.0.0"
      },
      "devDependencies": {
        "@sigstore/mock": "^0.6.5",
        "@sigstore/rekor-types": "^2.0.0",
        "@types/jsonwebtoken": "^9.0.6",
+        "@types/make-fetch-happen": "^10.0.4",
        "jose": "^5.2.3",
-        "nock": "^13.5.1",
-        "undici": "^5.28.4"
+        "nock": "^13.5.1"
      }
    },
    "node_modules/@actions/core": {
@@ -529,6 +530,17 @@
        "@types/node": "*"
      }
    },
+    "node_modules/@types/make-fetch-happen": {
+      "version": "10.0.4",
+      "resolved": "https://registry.npmjs.org/@types/make-fetch-happen/-/make-fetch-happen-10.0.4.tgz",
+      "integrity": "sha512-jKzweQaEMMAi55ehvR1z0JF6aSVQm/h1BXBhPLOJriaeQBctjw5YbpIGs7zAx9dN0Sa2OO5bcXwCkrlgenoPEA==",
+      "dev": true,
+      "dependencies": {
+        "@types/node-fetch": "*",
+        "@types/retry": "*",
+        "@types/ssri": "*"
+      }
+    },
    "node_modules/@types/mime": {
      "version": "1.3.5",
      "resolved": "https://registry.npmjs.org/@types/mime/-/mime-1.3.5.tgz",
@@ -542,6 +554,16 @@
        "undici-types": "~5.26.4"
      }
    },
+    "node_modules/@types/node-fetch": {
+      "version": "2.6.11",
+      "resolved": "https://registry.npmjs.org/@types/node-fetch/-/node-fetch-2.6.11.tgz",
+      "integrity": "sha512-24xFj9R5+rfQJLRyM56qh+wnVSYhyXC2tkoBndtY0U+vubqNsYXGjufB2nn8Q6gt0LrARwL6UBtMCSVCwl4B1g==",
+      "dev": true,
+      "dependencies": {
+        "@types/node": "*",
+        "form-data": "^4.0.0"
+      }
+    },
    "node_modules/@types/qs": {
      "version": "6.9.14",
      "resolved": "https://registry.npmjs.org/@types/qs/-/qs-6.9.14.tgz",
@@ -552,6 +574,12 @@
      "resolved": "https://registry.npmjs.org/@types/range-parser/-/range-parser-1.2.7.tgz",
      "integrity": "sha512-hKormJbkJqzQGhziax5PItDUTMAM9uE2XXQmM37dyd4hVM+5aVl7oVxMVUiVQn2oCQFN/LKCZdvSM0pFRqbSmQ=="
    },
+    "node_modules/@types/retry": {
+      "version": "0.12.5",
+      "resolved": "https://registry.npmjs.org/@types/retry/-/retry-0.12.5.tgz",
+      "integrity": "sha512-3xSjTp3v03X/lSQLkczaN9UIEwJMoMCA1+Nb5HfbJEQWogdeQIyVtTvxPXDQjZ5zws8rFQfVfRdz03ARihPJgw==",
+      "dev": true
+    },
    "node_modules/@types/send": {
      "version": "0.17.4",
      "resolved": "https://registry.npmjs.org/@types/send/-/send-0.17.4.tgz",
@@ -571,6 +599,15 @@
        "@types/node": "*"
      }
    },
+    "node_modules/@types/ssri": {
+      "version": "7.1.5",
+      "resolved": "https://registry.npmjs.org/@types/ssri/-/ssri-7.1.5.tgz",
+      "integrity": "sha512-odD/56S3B51liILSk5aXJlnYt99S6Rt9EFDDqGtJM26rKHApHcwyU/UoYHrzKkdkHMAIquGWCuHtQTbes+FRQw==",
+      "dev": true,
+      "dependencies": {
+        "@types/node": "*"
+      }
+    },
    "node_modules/agent-base": {
      "version": "7.1.0",
      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.0.tgz",
@@ -630,6 +667,12 @@
        "node": ">=12.0.0"
      }
    },
+    "node_modules/asynckit": {
+      "version": "0.4.0",
+      "resolved": "https://registry.npmjs.org/asynckit/-/asynckit-0.4.0.tgz",
+      "integrity": "sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==",
+      "dev": true
+    },
    "node_modules/balanced-match": {
      "version": "1.0.2",
      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
@@ -722,6 +765,18 @@
      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA=="
    },
+    "node_modules/combined-stream": {
+      "version": "1.0.8",
+      "resolved": "https://registry.npmjs.org/combined-stream/-/combined-stream-1.0.8.tgz",
+      "integrity": "sha512-FQN4MRfuJeHf7cBbBMJFXhKSDq+2kAArBlmRBvcvFE5BB1HZKXtSFASDhdlz9zOYwxh8lDdnvmMOe/+5cdoEdg==",
+      "dev": true,
+      "dependencies": {
+        "delayed-stream": "~1.0.0"
+      },
+      "engines": {
+        "node": ">= 0.8"
+      }
+    },
    "node_modules/cross-spawn": {
      "version": "7.0.3",
      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.3.tgz",
@@ -751,6 +806,15 @@
        }
      }
    },
+    "node_modules/delayed-stream": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/delayed-stream/-/delayed-stream-1.0.0.tgz",
+      "integrity": "sha512-ZySD7Nf91aLB0RxL4KGrKHBXl7Eds1DAmEdcoVawXnLD7SDhpNgtuII2aAkg7a7QS41jxPSZ17p4VdGnMHk3MQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.4.0"
+      }
+    },
    "node_modules/deprecation": {
      "version": "2.3.1",
      "resolved": "https://registry.npmjs.org/deprecation/-/deprecation-2.3.1.tgz",
@@ -803,6 +867,20 @@
        "url": "https://github.com/sponsors/isaacs"
      }
    },
+    "node_modules/form-data": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.0.tgz",
+      "integrity": "sha512-ETEklSGi5t0QMZuiXoA/Q6vcnxcLQP5vdugSpuAyi6SVGi2clPPp+xgEhuMaHC+zGgn31Kd235W35f7Hykkaww==",
+      "dev": true,
+      "dependencies": {
+        "asynckit": "^0.4.0",
+        "combined-stream": "^1.0.8",
+        "mime-types": "^2.1.12"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
    "node_modules/fs-minipass": {
      "version": "3.0.3",
      "resolved": "https://registry.npmjs.org/fs-minipass/-/fs-minipass-3.0.3.tgz",
@@ -1129,6 +1207,27 @@
        "node": "^16.14.0 || >=18.0.0"
      }
    },
+    "node_modules/mime-db": {
+      "version": "1.52.0",
+      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz",
+      "integrity": "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==",
+      "dev": true,
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
+    "node_modules/mime-types": {
+      "version": "2.1.35",
+      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz",
+      "integrity": "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==",
+      "dev": true,
+      "dependencies": {
+        "mime-db": "1.52.0"
+      },
+      "engines": {
+        "node": ">= 0.6"
+      }
+    },
    "node_modules/minimatch": {
      "version": "9.0.3",
      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.3.tgz",
@@ -1644,9 +1743,9 @@
      }
    },
    "node_modules/tar": {
-      "version": "6.2.1",
-      "resolved": "https://registry.npmjs.org/tar/-/tar-6.2.1.tgz",
-      "integrity": "sha512-DZ4yORTwrbTj/7MZYq2w+/ZFdI6OZ/f9SFHR+71gIVUZhOQPHzVCLpvRnPgyaMpfWxxk/4ONva3GQSyNIKRv6A==",
+      "version": "6.2.0",
+      "resolved": "https://registry.npmjs.org/tar/-/tar-6.2.0.tgz",
+      "integrity": "sha512-/Wo7DcT0u5HUV486xg675HtjNd3BXZ6xDbzsCUZPt5iw8bTQ63bP0Raut3mvro9u+CUyq7YQd8Cx55fsZXxqLQ==",
      "dependencies": {
        "chownr": "^2.0.0",
        "fs-minipass": "^2.0.0",
@@ -1722,9 +1821,9 @@
      }
    },
    "node_modules/undici": {
-      "version": "5.28.4",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-5.28.4.tgz",
-      "integrity": "sha512-72RFADWFqKmUb2hmmvNODKL3p9hcB6Gt2DOQMis1SEBaV6a4MH8soBvzg+95CYhCKPFedut2JY9bMfrDl9D23g==",
+      "version": "5.28.3",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-5.28.3.tgz",
+      "integrity": "sha512-3ItfzbrhDlINjaP0duwnNsKpDQk3acHI3gVJ1z4fmwMK31k5G9OVIAMLSIaP6w4FaGkaAkN6zaQO9LUvZ1t7VA==",
      "dependencies": {
        "@fastify/busboy": "^2.0.0"
      },
@@ -2329,6 +2428,17 @@
        "@types/node": "*"
      }
    },
+    "@types/make-fetch-happen": {
+      "version": "10.0.4",
+      "resolved": "https://registry.npmjs.org/@types/make-fetch-happen/-/make-fetch-happen-10.0.4.tgz",
+      "integrity": "sha512-jKzweQaEMMAi55ehvR1z0JF6aSVQm/h1BXBhPLOJriaeQBctjw5YbpIGs7zAx9dN0Sa2OO5bcXwCkrlgenoPEA==",
+      "dev": true,
+      "requires": {
+        "@types/node-fetch": "*",
+        "@types/retry": "*",
+        "@types/ssri": "*"
+      }
+    },
    "@types/mime": {
      "version": "1.3.5",
      "resolved": "https://registry.npmjs.org/@types/mime/-/mime-1.3.5.tgz",
@@ -2342,6 +2452,16 @@
        "undici-types": "~5.26.4"
      }
    },
+    "@types/node-fetch": {
+      "version": "2.6.11",
+      "resolved": "https://registry.npmjs.org/@types/node-fetch/-/node-fetch-2.6.11.tgz",
+      "integrity": "sha512-24xFj9R5+rfQJLRyM56qh+wnVSYhyXC2tkoBndtY0U+vubqNsYXGjufB2nn8Q6gt0LrARwL6UBtMCSVCwl4B1g==",
+      "dev": true,
+      "requires": {
+        "@types/node": "*",
+        "form-data": "^4.0.0"
+      }
+    },
    "@types/qs": {
      "version": "6.9.14",
      "resolved": "https://registry.npmjs.org/@types/qs/-/qs-6.9.14.tgz",
@@ -2352,6 +2472,12 @@
      "resolved": "https://registry.npmjs.org/@types/range-parser/-/range-parser-1.2.7.tgz",
      "integrity": "sha512-hKormJbkJqzQGhziax5PItDUTMAM9uE2XXQmM37dyd4hVM+5aVl7oVxMVUiVQn2oCQFN/LKCZdvSM0pFRqbSmQ=="
    },
+    "@types/retry": {
+      "version": "0.12.5",
+      "resolved": "https://registry.npmjs.org/@types/retry/-/retry-0.12.5.tgz",
+      "integrity": "sha512-3xSjTp3v03X/lSQLkczaN9UIEwJMoMCA1+Nb5HfbJEQWogdeQIyVtTvxPXDQjZ5zws8rFQfVfRdz03ARihPJgw==",
+      "dev": true
+    },
    "@types/send": {
      "version": "0.17.4",
      "resolved": "https://registry.npmjs.org/@types/send/-/send-0.17.4.tgz",
@@ -2371,6 +2497,15 @@
        "@types/node": "*"
      }
    },
+    "@types/ssri": {
+      "version": "7.1.5",
+      "resolved": "https://registry.npmjs.org/@types/ssri/-/ssri-7.1.5.tgz",
+      "integrity": "sha512-odD/56S3B51liILSk5aXJlnYt99S6Rt9EFDDqGtJM26rKHApHcwyU/UoYHrzKkdkHMAIquGWCuHtQTbes+FRQw==",
+      "dev": true,
+      "requires": {
+        "@types/node": "*"
+      }
+    },
    "agent-base": {
      "version": "7.1.0",
      "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.0.tgz",
@@ -2409,6 +2544,12 @@
        "tslib": "^2.4.0"
      }
    },
+    "asynckit": {
+      "version": "0.4.0",
+      "resolved": "https://registry.npmjs.org/asynckit/-/asynckit-0.4.0.tgz",
+      "integrity": "sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==",
+      "dev": true
+    },
    "balanced-match": {
      "version": "1.0.2",
      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
@@ -2486,6 +2627,15 @@
      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA=="
    },
+    "combined-stream": {
+      "version": "1.0.8",
+      "resolved": "https://registry.npmjs.org/combined-stream/-/combined-stream-1.0.8.tgz",
+      "integrity": "sha512-FQN4MRfuJeHf7cBbBMJFXhKSDq+2kAArBlmRBvcvFE5BB1HZKXtSFASDhdlz9zOYwxh8lDdnvmMOe/+5cdoEdg==",
+      "dev": true,
+      "requires": {
+        "delayed-stream": "~1.0.0"
+      }
+    },
    "cross-spawn": {
      "version": "7.0.3",
      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.3.tgz",
@@ -2504,6 +2654,12 @@
        "ms": "2.1.2"
      }
    },
+    "delayed-stream": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/delayed-stream/-/delayed-stream-1.0.0.tgz",
+      "integrity": "sha512-ZySD7Nf91aLB0RxL4KGrKHBXl7Eds1DAmEdcoVawXnLD7SDhpNgtuII2aAkg7a7QS41jxPSZ17p4VdGnMHk3MQ==",
+      "dev": true
+    },
    "deprecation": {
      "version": "2.3.1",
      "resolved": "https://registry.npmjs.org/deprecation/-/deprecation-2.3.1.tgz",
@@ -2550,6 +2706,17 @@
        "signal-exit": "^4.0.1"
      }
    },
+    "form-data": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/form-data/-/form-data-4.0.0.tgz",
+      "integrity": "sha512-ETEklSGi5t0QMZuiXoA/Q6vcnxcLQP5vdugSpuAyi6SVGi2clPPp+xgEhuMaHC+zGgn31Kd235W35f7Hykkaww==",
+      "dev": true,
+      "requires": {
+        "asynckit": "^0.4.0",
+        "combined-stream": "^1.0.8",
+        "mime-types": "^2.1.12"
+      }
+    },
    "fs-minipass": {
      "version": "3.0.3",
      "resolved": "https://registry.npmjs.org/fs-minipass/-/fs-minipass-3.0.3.tgz",
@@ -2817,6 +2984,21 @@
        "ssri": "^10.0.0"
      }
    },
+    "mime-db": {
+      "version": "1.52.0",
+      "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz",
+      "integrity": "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==",
+      "dev": true
+    },
+    "mime-types": {
+      "version": "2.1.35",
+      "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz",
+      "integrity": "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==",
+      "dev": true,
+      "requires": {
+        "mime-db": "1.52.0"
+      }
+    },
    "minimatch": {
      "version": "9.0.3",
      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.3.tgz",
@@ -3185,9 +3367,9 @@
      }
    },
    "tar": {
-      "version": "6.2.1",
-      "resolved": "https://registry.npmjs.org/tar/-/tar-6.2.1.tgz",
-      "integrity": "sha512-DZ4yORTwrbTj/7MZYq2w+/ZFdI6OZ/f9SFHR+71gIVUZhOQPHzVCLpvRnPgyaMpfWxxk/4ONva3GQSyNIKRv6A==",
+      "version": "6.2.0",
+      "resolved": "https://registry.npmjs.org/tar/-/tar-6.2.0.tgz",
+      "integrity": "sha512-/Wo7DcT0u5HUV486xg675HtjNd3BXZ6xDbzsCUZPt5iw8bTQ63bP0Raut3mvro9u+CUyq7YQd8Cx55fsZXxqLQ==",
      "requires": {
        "chownr": "^2.0.0",
        "fs-minipass": "^2.0.0",
@@ -3251,9 +3433,9 @@
      "integrity": "sha512-1h/Lnq9yajKY2PEbBadPXj3VxsDDu844OnaAo52UVmIzIvwwtBPIuNvkjuzBlTWpfJyUbG3ez0KSBibQkj4ojg=="
    },
    "undici": {
-      "version": "5.28.4",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-5.28.4.tgz",
-      "integrity": "sha512-72RFADWFqKmUb2hmmvNODKL3p9hcB6Gt2DOQMis1SEBaV6a4MH8soBvzg+95CYhCKPFedut2JY9bMfrDl9D23g==",
+      "version": "5.28.3",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-5.28.3.tgz",
+      "integrity": "sha512-3ItfzbrhDlINjaP0duwnNsKpDQk3acHI3gVJ1z4fmwMK31k5G9OVIAMLSIaP6w4FaGkaAkN6zaQO9LUvZ1t7VA==",
      "requires": {
        "@fastify/busboy": "^2.0.0"
      }
@@ -38,9 +38,9 @@
    "@sigstore/mock": "^0.6.5",
    "@sigstore/rekor-types": "^2.0.0",
    "@types/jsonwebtoken": "^9.0.6",
+    "@types/make-fetch-happen": "^10.0.4",
    "jose": "^5.2.3",
-    "nock": "^13.5.1",
-    "undici": "^5.28.4"
+    "nock": "^13.5.1"
  },
  "dependencies": {
    "@actions/core": "^1.10.1",
@@ -49,6 +49,7 @@
    "@sigstore/bundle": "^2.3.0",
    "@sigstore/sign": "^2.3.0",
    "jsonwebtoken": "^9.0.2",
-    "jwks-rsa": "^3.1.0"
+    "jwks-rsa": "^3.1.0",
+    "make-fetch-happen": "^13.0.0"
  }
 }
@@ -1,4 +1,5 @@
 import * as github from '@actions/github'
+import fetch from 'make-fetch-happen'

 const CREATE_ATTESTATION_REQUEST = 'POST /repos/{owner}/{repo}/attestations'

@@ -13,7 +14,7 @@ export const writeAttestation = async (
  attestation: unknown,
  token: string
 ): Promise<string> => {
-  const octokit = github.getOctokit(token)
+  const octokit = github.getOctokit(token, {request: {fetch}})

  try {
    const response = await octokit.request(CREATE_ATTESTATION_REQUEST, {
@@ -22,11 +23,7 @@ export const writeAttestation = async (
      data: {bundle: attestation}
    })

-    const data =
-      typeof response.data == 'string'
-        ? JSON.parse(response.data)
-        : response.data
-    return data?.id
+    return response.data?.id
  } catch (err) {
    const message = err instanceof Error ? err.message : err
    throw new Error(`Failed to persist attestation: ${message}`)
@@ -6,7 +6,7 @@
  "packages": {
    "": {
      "name": "@actions/http-client",
-      "version": "2.2.1",
+      "version": "2.2.0",
      "license": "MIT",
      "dependencies": {
        "tunnel": "^0.0.6",