Update http-client to 2.2.1

Merge pull request #1678 from actions/bethanyj28/logging
Add info level logging for zip extract
2024-03-01 15:02:07 -05:00 · 2024-03-01 13:09:41 -05:00 · 2024-03-01 13:04:16 -05:00 · 2024-03-01 12:54:40 -05:00 · 2024-02-29 12:01:04 -05:00 · 2024-02-29 10:41:57 -05:00
79 changed files with 5987 additions and 310 deletions
@@ -72,7 +72,7 @@ jobs:
            console.log('Successfully blocked second artifact upload')
          }
  verify:
-    name: Verify
+    name: Verify and Delete
    runs-on: ubuntu-latest
    needs: [upload]
    steps:
@@ -164,3 +164,31 @@ jobs:
              }
            }
          }
+    - name: Delete Artifacts
+      uses: actions/github-script@v7
+      with:
+        script: |
+          const {default: artifactClient} = require('./packages/artifact/lib/artifact')
+
+          const artifactsToDelete = [
+            'my-artifact-ubuntu-latest',
+            'my-artifact-windows-latest',
+            'my-artifact-macos-latest'
+          ]
+
+          for (const artifactName of artifactsToDelete) {
+            const {id} = await artifactClient.deleteArtifact(artifactName)
+          }
+
+          const {artifacts} = await artifactClient.listArtifacts({latest: true})
+          const foundArtifacts = artifacts.filter(artifact =>
+            artifactsToDelete.includes(artifact.name)
+          )
+
+          if (foundArtifacts.length !== 0) {
+            console.log('Unexpected length of found artifacts:', foundArtifacts)
+            throw new Error(
+              `Expected 0 artifacts but found ${foundArtifacts.length} artifacts.`
+            )
+          }
+
@@ -18,10 +18,10 @@ jobs:

    steps:
    - name: Checkout
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4

    - name: Set Node.js 20.x
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@v4
      with:
        node-version: 20.x

@@ -22,10 +22,10 @@ jobs:

    steps:
    - name: Checkout
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4

    - name: Set Node.js 20.x
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@v4
      with:
        node-version: 20.x

@@ -20,7 +20,7 @@ jobs:

    steps:
    - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
@@ -5,7 +5,7 @@ on:
    inputs:
      package:
        required: true
-        description: 'core, artifact, cache, exec, github, glob, http-client, io, tool-cache'
+        description: 'core, artifact, cache, exec, github, glob, http-client, io, tool-cache, attest'

 jobs:
  test:
@@ -13,13 +13,13 @@ jobs:

    steps:
      - name: setup repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4

      - name: verify package exists
        run: ls packages/${{ github.event.inputs.package }}

      - name: Set Node.js 20.x
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
        with:
          node-version: 20.x

@@ -40,7 +40,7 @@ jobs:
        working-directory: packages/${{ github.event.inputs.package }}

      - name: upload artifact
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
        with:
          name: ${{ github.event.inputs.package }}
          path: packages/${{ github.event.inputs.package }}/*.tgz
@@ -49,10 +49,13 @@ jobs:
    runs-on: macos-latest
    needs: test
    environment: npm-publish
+    permissions:
+      contents: read
+      id-token: write
    steps:

      - name: download artifact
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
        with:
          name: ${{ github.event.inputs.package }}

@@ -62,7 +65,7 @@ jobs:
          NPM_TOKEN: ${{ secrets.TOKEN }}

      - name: publish
-        run: npm publish *.tgz
+        run: npm publish --provenance *.tgz

      - name: notify slack on failure
        if: failure()
@@ -23,10 +23,10 @@ jobs:

    steps:
    - name: Checkout
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4

    - name: Set Node.js 20.x
-      uses: actions/setup-node@v3
+      uses: actions/setup-node@v4
      with:
        node-version: 20.x

@@ -9,7 +9,7 @@ jobs:
    if: ${{ github.repository_owner == 'actions' }}
    steps:
    - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
    - name: Update Octokit
      working-directory: packages/github 
      run: |
@@ -2,3 +2,4 @@

 /packages/artifact/   @actions/artifacts-actions
 /packages/cache/      @actions/actions-cache
+/packages/attest/      @actions/package-security
@@ -102,6 +102,15 @@ $ npm install @actions/cache
 ```
 <br/>

+:lock_with_ink_pen: [@actions/attest](packages/attest)
+
+Provides functions to write attestations for workflow artifacts. Read more [here](packages/attest)
+
+```bash
+$ npm install @actions/attest
+```
+<br/>
+
 ## Creating an Action with the Toolkit

 :question: [Choosing an action type](docs/action-types.md)
@@ -32,7 +32,7 @@ jobs:
        os: [ubuntu-16.04, windows-2019]
    runs-on: ${{matrix.os}}
    actions:
-    - uses: actions/setup-node@v3
+    - uses: actions/setup-node@v4
      with:
        version: ${{matrix.node}}
    - run: | 
@@ -18,7 +18,7 @@ e.g. To use https://github.com/actions/setup-node, users will author:

 ```yaml
 steps:
-    using: actions/setup-node@v3
+    using: actions/setup-node@v4
 ```

 # Define Metadata
@@ -6664,9 +6664,9 @@
      }
    },
    "node_modules/ip": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/ip/-/ip-2.0.0.tgz",
-      "integrity": "sha512-WKa+XuLG1A1R0UWhl2+1XQSi+fZWMsYKffMZTTYsiZaUD8k2yDAj5atimTUD2TZkyCkNEeYE5NhFZmupOGtjYQ==",
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/ip/-/ip-2.0.1.tgz",
+      "integrity": "sha512-lJUL9imLTNi1ZfXT+DU6rBBdbiKGBuay9B6xGSPVjUeQwaH1RIGqef8RZkUtHioLmSNpPR5M4HVKJGm1j8FWVQ==",
      "dev": true
    },
    "node_modules/is-array-buffer": {
@@ -12,6 +12,7 @@ This is the core library that powers the [`@actions/upload-artifact`](https://gi
  - [Quick Start](#quick-start)
  - [Examples](#examples)
    - [Upload and Download](#upload-and-download)
+    - [Delete an Artifact](#delete-an-artifact)
    - [Downloading from other workflow runs or repos](#downloading-from-other-workflow-runs-or-repos)
    - [Speeding up large uploads](#speeding-up-large-uploads)
  - [Additional Resources](#additional-resources)
@@ -106,6 +107,41 @@ const {downloadPath} = await artifact.downloadArtifact(id, {
 console.log(`Downloaded artifact ${id} to: ${downloadPath}`)
 ```

+### Delete an Artifact
+
+To delete an artifact, all you need is the name.
+
+```js
+const {id} = await artifact.deleteArtifact(
+  // name of the artifact
+  'my-artifact'
+)
+
+console.log(`Deleted Artifact ID '${id}'`)
+```
+
+It also supports options to delete from other repos/runs given a github token with `actions:write` permissions on the target repository is supplied.
+
+```js
+const findBy = {
+  // must have actions:write permission on target repository
+  token: process.env['GITHUB_TOKEN'],
+  workflowRunId: 123,
+  repositoryOwner: 'actions',
+  repositoryName: 'toolkit'
+}
+
+
+const {id} = await artifact.deleteArtifact(
+  // name of the artifact
+  'my-artifact',
+  // options to find by other repo/owner
+  { findBy }
+)
+
+console.log(`Deleted Artifact ID '${id}' from ${findBy.repositoryOwner}/ ${findBy.repositoryName}`)
+```
+
 ### Downloading from other workflow runs or repos

 It may be useful to download Artifacts from other workflow runs, or even other repositories. By default, the permissions are scoped so they can only download Artifacts within the current workflow run. To elevate permissions for this scenario, you must specify `options.findBy` to `downloadArtifact`.
@@ -1,15 +1,111 @@
 # @actions/artifact Releases

-### 0.1.0
+### 2.1.4

- Initial release
+- Adds info-level logging for zip extraction

-### 0.2.0
+### 2.1.3

- Fixes to TCP connections not closing
- GZip file compression to speed up downloads
- Improved logging and output
- Extra documentation
+- Fixes a bug in the extract logic updated in 2.1.2
+
+### 2.1.2
+
+- Updated the stream extract functionality to use `unzip.Parse()` instead of `unzip.Extract()` for greater control of unzipping artifacts
+  
+### 2.1.1
+ 
+- Updated `isGhes` check to include `.ghe.com` and `.ghe.localhost` as accepted hosts
+
+### 2.1.0
+
+- Added `ArtifactClient#deleteArtifact` to delete artifacts by name [#1626](https://github.com/actions/toolkit/pull/1626)
+- Update error messaging to be more useful [#1628](https://github.com/actions/toolkit/pull/1628)
+
+### 2.0.1
+
+- Patch to fix transient request timeouts https://github.com/actions/download-artifact/issues/249
+
+### 2.0.0
+
+- Major release. Supports new Artifact backend for improved speed, reliability and behavior.
+- Numerous API changes, [some breaking](./README.md#breaking-changes).
+
+- [Blog post with more info](https://github.blog/2024-02-12-get-started-with-v4-of-github-actions-artifacts/)
+
+### 1.1.1
+
+- Fixed a bug in Node16 where if an HTTP download finished too quickly (<1ms, e.g. when it's mocked) we attempt to delete a temp file that has not been created yet [#1278](https://github.com/actions/toolkit/pull/1278/commits/b9de68a590daf37c6747e38d3cb4f1dd2cfb791c)
+
+### 1.1.0
+
+- Add `x-actions-results-crc64` and `x-actions-results-md5` checksum headers on upload [#1063](https://github.com/actions/toolkit/pull/1063)
+
+### 1.0.2
+
+- Update to v2.0.1 of `@actions/http-client` [#1087](https://github.com/actions/toolkit/pull/1087)
+
+### 1.0.1
+
+- Update to v2.0.0 of `@actions/http-client`
+
+### 1.0.0
+
+- Update `lockfileVersion` to `v2` in `package-lock.json` [#1009](https://github.com/actions/toolkit/pull/1009)
+
+### 0.6.1
+
+- Fix for failing 0 byte file uploads on Windows [#962](https://github.com/actions/toolkit/pull/962)
+
+### 0.6.0
+
+- Support upload from named pipes [#748](https://github.com/actions/toolkit/pull/748)
+- Fixes to percentage values being greater than 100% when downloading all artifacts [#889](https://github.com/actions/toolkit/pull/889)
+- Improved logging and output during artifact upload [#949](https://github.com/actions/toolkit/pull/949)
+- Improvements to client-side validation for certain invalid characters not allowed during upload: [#951](https://github.com/actions/toolkit/pull/951)
+- Faster upload speeds for certain types of large files by exempting gzip compression [#956](https://github.com/actions/toolkit/pull/956)
+- More detailed logging when dealing with chunked uploads [#957](https://github.com/actions/toolkit/pull/957)
+  
+### 0.5.2
+
+- Add HTTP 500 as a retryable status code for artifact upload and download.
+  
+### 0.5.1
+
+- Bump @actions/http-client to version 1.0.11 to fix proxy related issues during artifact upload and download
+
+### 0.5.0
+
+- Improved retry-ability for all http calls during artifact upload and download if an error is encountered
+
+### 0.4.2
+
+- Improved retry-ability when a partial artifact download is encountered
+
+### 0.4.1
+
+- Update to latest @actions/core version
+
+### 0.4.0
+
+- Add option to specify custom retentions on artifacts
+- 
+### 0.3.5
+
+- Retry in the event of a 413 response
+
+### 0.3.3
+
+- Increase chunk size during upload from 4MB to 8MB
+- Improve user-agent strings during API calls to help internally diagnose issues
+
+### 0.3.2
+
+- Fix to ensure readstreams get correctly reset in the event of a retry
+
+### 0.3.1
+
+- Fix to ensure temporary gzip files get correctly deleted during artifact upload
+- Remove spaces as a forbidden character during upload

 ### 0.3.0

@@ -20,84 +116,13 @@
 - Clearer error message if storage quota has been reached
 - Improved logging and output during artifact download

-### 0.3.1
+### 0.2.0

- Fix to ensure temporary gzip files get correctly deleted during artifact upload
- Remove spaces as a forbidden character during upload
+- Fixes to TCP connections not closing
+- GZip file compression to speed up downloads
+- Improved logging and output
+- Extra documentation

-### 0.3.2
+### 0.1.0

- Fix to ensure readstreams get correctly reset in the event of a retry
-
-### 0.3.3
-
- Increase chunk size during upload from 4MB to 8MB
- Improve user-agent strings during API calls to help internally diagnose issues
-
-### 0.3.5
-
- Retry in the event of a 413 response
-
-### 0.4.0
-
- Add option to specify custom retentions on artifacts
-
-### 0.4.1
-
- Update to latest @actions/core version
-
-### 0.4.2
-
- Improved retry-ability when a partial artifact download is encountered
-
-### 0.5.0
-
- Improved retry-ability for all http calls during artifact upload and download if an error is encountered
-
-### 0.5.1
-
- Bump @actions/http-client to version 1.0.11 to fix proxy related issues during artifact upload and download
-
-### 0.5.2
-
- Add HTTP 500 as a retryable status code for artifact upload and download.
-
-### 0.6.0
-
- Support upload from named pipes [#748](https://github.com/actions/toolkit/pull/748)
- Fixes to percentage values being greater than 100% when downloading all artifacts [#889](https://github.com/actions/toolkit/pull/889)
- Improved logging and output during artifact upload [#949](https://github.com/actions/toolkit/pull/949)
- Improvements to client-side validation for certain invalid characters not allowed during upload: [#951](https://github.com/actions/toolkit/pull/951)
- Faster upload speeds for certain types of large files by exempting gzip compression [#956](https://github.com/actions/toolkit/pull/956)
- More detailed logging when dealing with chunked uploads [#957](https://github.com/actions/toolkit/pull/957)
-
-### 0.6.1
-
- Fix for failing 0 byte file uploads on Windows [#962](https://github.com/actions/toolkit/pull/962)
-
-### 1.0.0
-
- Update `lockfileVersion` to `v2` in `package-lock.json` [#1009](https://github.com/actions/toolkit/pull/1009)
-
-### 1.0.1
-
- Update to v2.0.0 of `@actions/http-client`
-
-### 1.0.2
-
- Update to v2.0.1 of `@actions/http-client` [#1087](https://github.com/actions/toolkit/pull/1087)
-
-### 1.1.0
-
- Add `x-actions-results-crc64` and `x-actions-results-md5` checksum headers on upload [#1063](https://github.com/actions/toolkit/pull/1063)
-
-### 1.1.1
-
- Fixed a bug in Node16 where if an HTTP download finished too quickly (<1ms, e.g. when it's mocked) we attempt to delete a temp file that has not been created yet [#1278](https://github.com/actions/toolkit/pull/1278/commits/b9de68a590daf37c6747e38d3cb4f1dd2cfb791c)
-
-### 2.0.0
-
-Major release. Supports new Artifact backend for improved speed, reliability and behavior.
-Numerous API changes, [some breaking](./README.md#breaking-changes).
-
-Blog post with more info: TBD
+- Initial release
@@ -0,0 +1,27 @@
+import * as config from '../src/internal/shared/config'
+
+beforeEach(() => {
+  jest.resetModules()
+})
+
+describe('isGhes', () => {
+  it('should return false when the request domain is github.com', () => {
+    process.env.GITHUB_SERVER_URL = 'https://github.com'
+    expect(config.isGhes()).toBe(false)
+  })
+
+  it('should return false when the request domain ends with ghe.com', () => {
+    process.env.GITHUB_SERVER_URL = 'https://my.domain.ghe.com'
+    expect(config.isGhes()).toBe(false)
+  })
+
+  it('should return false when the request domain ends with ghe.localhost', () => {
+    process.env.GITHUB_SERVER_URL = 'https://my.domain.ghe.localhost'
+    expect(config.isGhes()).toBe(false)
+  })
+
+  it('should return false when the request domain is specific to an enterprise', () => {
+    process.env.GITHUB_SERVER_URL = 'https://my-enterprise.github.com'
+    expect(config.isGhes()).toBe(true)
+  })
+})
@@ -0,0 +1,192 @@
+import * as github from '@actions/github'
+import type {RestEndpointMethods} from '@octokit/plugin-rest-endpoint-methods/dist-types/generated/method-types'
+import type {RequestInterface} from '@octokit/types'
+import {
+  deleteArtifactInternal,
+  deleteArtifactPublic
+} from '../src/internal/delete/delete-artifact'
+import * as config from '../src/internal/shared/config'
+import {ArtifactServiceClientJSON, Timestamp} from '../src/generated'
+import * as util from '../src/internal/shared/util'
+import {noopLogs} from './common'
+
+type MockedRequest = jest.MockedFunction<RequestInterface<object>>
+
+type MockedDeleteArtifact = jest.MockedFunction<
+  RestEndpointMethods['actions']['deleteArtifact']
+>
+
+jest.mock('@actions/github', () => ({
+  getOctokit: jest.fn().mockReturnValue({
+    request: jest.fn(),
+    rest: {
+      actions: {
+        deleteArtifact: jest.fn()
+      }
+    }
+  })
+}))
+
+const fixtures = {
+  repo: 'toolkit',
+  owner: 'actions',
+  token: 'ghp_1234567890',
+  runId: 123,
+  backendIds: {
+    workflowRunBackendId: 'c4d7c21f-ba3f-4ddc-a8c8-6f2f626f8422',
+    workflowJobRunBackendId: '760803a1-f890-4d25-9a6e-a3fc01a0c7cf'
+  },
+  artifacts: [
+    {
+      id: 1,
+      name: 'my-artifact',
+      size: 456,
+      createdAt: new Date('2023-12-01')
+    },
+    {
+      id: 2,
+      name: 'my-artifact',
+      size: 456,
+      createdAt: new Date('2023-12-02')
+    }
+  ]
+}
+
+describe('delete-artifact', () => {
+  beforeAll(() => {
+    noopLogs()
+  })
+
+  describe('public', () => {
+    it('should delete an artifact', async () => {
+      const mockRequest = github.getOctokit(fixtures.token)
+        .request as MockedRequest
+      mockRequest.mockResolvedValueOnce({
+        status: 200,
+        headers: {},
+        url: '',
+        data: {
+          artifacts: [
+            {
+              name: fixtures.artifacts[0].name,
+              id: fixtures.artifacts[0].id,
+              size_in_bytes: fixtures.artifacts[0].size,
+              created_at: fixtures.artifacts[0].createdAt.toISOString()
+            }
+          ]
+        }
+      })
+
+      const mockDeleteArtifact = github.getOctokit(fixtures.token).rest.actions
+        .deleteArtifact as MockedDeleteArtifact
+      mockDeleteArtifact.mockResolvedValueOnce({
+        status: 204,
+        headers: {},
+        url: '',
+        data: null as never
+      })
+
+      const response = await deleteArtifactPublic(
+        fixtures.artifacts[0].name,
+        fixtures.runId,
+        fixtures.owner,
+        fixtures.repo,
+        fixtures.token
+      )
+
+      expect(response).toEqual({
+        id: fixtures.artifacts[0].id
+      })
+    })
+
+    it('should fail if non-200 response', async () => {
+      const mockRequest = github.getOctokit(fixtures.token)
+        .request as MockedRequest
+      mockRequest.mockResolvedValueOnce({
+        status: 200,
+        headers: {},
+        url: '',
+        data: {
+          artifacts: [
+            {
+              name: fixtures.artifacts[0].name,
+              id: fixtures.artifacts[0].id,
+              size_in_bytes: fixtures.artifacts[0].size,
+              created_at: fixtures.artifacts[0].createdAt.toISOString()
+            }
+          ]
+        }
+      })
+
+      const mockDeleteArtifact = github.getOctokit(fixtures.token).rest.actions
+        .deleteArtifact as MockedDeleteArtifact
+      mockDeleteArtifact.mockRejectedValue(new Error('boom'))
+
+      await expect(
+        deleteArtifactPublic(
+          fixtures.artifacts[0].name,
+          fixtures.runId,
+          fixtures.owner,
+          fixtures.repo,
+          fixtures.token
+        )
+      ).rejects.toThrow('boom')
+    })
+  })
+
+  describe('internal', () => {
+    beforeEach(() => {
+      jest.spyOn(config, 'getRuntimeToken').mockReturnValue('test-token')
+      jest
+        .spyOn(util, 'getBackendIdsFromToken')
+        .mockReturnValue(fixtures.backendIds)
+      jest
+        .spyOn(config, 'getResultsServiceUrl')
+        .mockReturnValue('https://results.local')
+    })
+
+    it('should delete an artifact', async () => {
+      jest
+        .spyOn(ArtifactServiceClientJSON.prototype, 'ListArtifacts')
+        .mockResolvedValue({
+          artifacts: fixtures.artifacts.map(artifact => ({
+            ...fixtures.backendIds,
+            databaseId: artifact.id.toString(),
+            name: artifact.name,
+            size: artifact.size.toString(),
+            createdAt: Timestamp.fromDate(artifact.createdAt)
+          }))
+        })
+      jest
+        .spyOn(ArtifactServiceClientJSON.prototype, 'DeleteArtifact')
+        .mockResolvedValue({
+          ok: true,
+          artifactId: fixtures.artifacts[0].id.toString()
+        })
+      const response = await deleteArtifactInternal(fixtures.artifacts[0].name)
+      expect(response).toEqual({
+        id: fixtures.artifacts[0].id
+      })
+    })
+
+    it('should fail if non-200 response', async () => {
+      jest
+        .spyOn(ArtifactServiceClientJSON.prototype, 'ListArtifacts')
+        .mockResolvedValue({
+          artifacts: fixtures.artifacts.map(artifact => ({
+            ...fixtures.backendIds,
+            databaseId: artifact.id.toString(),
+            name: artifact.name,
+            size: artifact.size.toString(),
+            createdAt: Timestamp.fromDate(artifact.createdAt)
+          }))
+        })
+      jest
+        .spyOn(ArtifactServiceClientJSON.prototype, 'DeleteArtifact')
+        .mockRejectedValue(new Error('boom'))
+      await expect(
+        deleteArtifactInternal(fixtures.artifacts[0].id)
+      ).rejects.toThrow('boom')
+    })
+  })
+})
@@ -121,6 +121,16 @@ const mockGetArtifactFailure = jest.fn(() => {
  }
 })

+const mockGetArtifactMalicious = jest.fn(() => {
+  const message = new http.IncomingMessage(new net.Socket())
+  message.statusCode = 200
+  message.push(fs.readFileSync(path.join(__dirname, 'fixtures', 'evil.zip'))) // evil.zip contains files that are formatted x/../../etc/hosts
+  message.push(null)
+  return {
+    message
+  }
+})
+
 describe('download-artifact', () => {
  describe('public', () => {
    beforeEach(setup)
@@ -170,6 +180,51 @@ describe('download-artifact', () => {
      expect(response.downloadPath).toBe(fixtures.workspaceDir)
    })

+    it('should not allow path traversal from malicious artifacts', async () => {
+      const downloadArtifactMock = github.getOctokit(fixtures.token).rest
+        .actions.downloadArtifact as MockedDownloadArtifact
+      downloadArtifactMock.mockResolvedValueOnce({
+        headers: {
+          location: fixtures.blobStorageUrl
+        },
+        status: 302,
+        url: '',
+        data: Buffer.from('')
+      })
+
+      const mockHttpClient = (HttpClient as jest.Mock).mockImplementation(
+        () => {
+          return {
+            get: mockGetArtifactMalicious
+          }
+        }
+      )
+
+      await expect(
+        downloadArtifactPublic(
+          fixtures.artifactID,
+          fixtures.repositoryOwner,
+          fixtures.repositoryName,
+          fixtures.token
+        )
+      ).rejects.toBeInstanceOf(Error)
+
+      expect(downloadArtifactMock).toHaveBeenCalledWith({
+        owner: fixtures.repositoryOwner,
+        repo: fixtures.repositoryName,
+        artifact_id: fixtures.artifactID,
+        archive_format: 'zip',
+        request: {
+          redirect: 'manual'
+        }
+      })
+
+      expect(mockHttpClient).toHaveBeenCalledWith(getUserAgentString())
+      expect(mockGetArtifactMalicious).toHaveBeenCalledWith(
+        fixtures.blobStorageUrl
+      )
+    })
+
    it('should successfully download an artifact to user defined path', async () => {
      const customPath = path.join(testDir, 'custom')

@@ -3,6 +3,8 @@
 - [Frequently Asked Questions](#frequently-asked-questions)
  - [Supported Characters](#supported-characters)
  - [Compression? ZIP? How is my artifact stored?](#compression-zip-how-is-my-artifact-stored)
+  - [Which versions of the artifacts packages are compatible?](#which-versions-of-the-artifacts-packages-are-compatible)
+  - [How long will my artifact be available?](#how-long-will-my-artifact-be-available)

 ## Supported Characters

@@ -33,3 +35,28 @@ The value can range from 0 to 9:

 Higher levels will result in better compression, but will take longer to complete.
 For large files that are not easily compressed, a value of 0 is recommended for significantly faster uploads.
+
+## Which versions of the artifacts packages are compatible?
+[actions/upload-artifact](https://github.com/actions/upload-artifact) and [actions/download-artifact](https://github.com/actions/download-artifact), leverage [GitHub Actions toolkit](https://github.com/actions/toolkit) and are typically used together to upload and download artifacts in your workflows.
+
+| upload-artifact | download-artifact | toolkit |
+|---|---|---|
+| v4 | v4 | v2 |
+| < v3 | < v3 | < v1 |
+
+Use matching versions of `actions/upload-artifact` and `actions/download-artifact` to ensure compatibility.
+
+In your GitHub Actions workflow YAML file, you specify the version of the actions you want to use. For example:
+
+```yaml
+  uses: actions/upload-artifact@v4
+  # ...
+  uses: actions/download-artifact@v4
+  # ...
+```
+
+**Release Notes:**
+Check the release notes for each repository to see if there are any specific notes about compatibility or changes in behavior.
+
+## How long will my artifact be available?
+The default retention period is **90 days**. For more information, visit: https://github.com/actions/upload-artifact?tab=readme-ov-file#retention-period 
@@ -11,11 +11,14 @@
 - [FilesNotFoundError](classes/FilesNotFoundError.md)
 - [GHESNotSupportedError](classes/GHESNotSupportedError.md)
 - [InvalidResponseError](classes/InvalidResponseError.md)
+- [NetworkError](classes/NetworkError.md)
+- [UsageError](classes/UsageError.md)

 ### Interfaces

 - [Artifact](interfaces/Artifact.md)
 - [ArtifactClient](interfaces/ArtifactClient.md)
+- [DeleteArtifactResponse](interfaces/DeleteArtifactResponse.md)
 - [DownloadArtifactOptions](interfaces/DownloadArtifactOptions.md)
 - [DownloadArtifactResponse](interfaces/DownloadArtifactResponse.md)
 - [FindOptions](interfaces/FindOptions.md)
@@ -37,4 +40,4 @@

 #### Defined in

-[src/artifact.ts:7](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/artifact.ts#L7)
+[src/artifact.ts:7](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/artifact.ts#L7)
@@ -48,7 +48,7 @@ Error.constructor

 #### Defined in

-[src/internal/shared/errors.ts:24](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/shared/errors.ts#L24)
+[src/internal/shared/errors.ts:24](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/shared/errors.ts#L24)

 ## Properties

@@ -16,6 +16,7 @@ The default artifact client that is used by the artifact action(s).

 ### Methods

+- [deleteArtifact](DefaultArtifactClient.md#deleteartifact)
 - [downloadArtifact](DefaultArtifactClient.md#downloadartifact)
 - [getArtifact](DefaultArtifactClient.md#getartifact)
 - [listArtifacts](DefaultArtifactClient.md#listartifacts)
@@ -33,6 +34,37 @@ The default artifact client that is used by the artifact action(s).

 ## Methods

+### deleteArtifact
+
+▸ **deleteArtifact**(`artifactName`, `options?`): `Promise`\<[`DeleteArtifactResponse`](../interfaces/DeleteArtifactResponse.md)\>
+
+Delete an Artifact
+
+If `options.findBy` is specified, this will use the public Delete Artifact API https://docs.github.com/en/rest/actions/artifacts?apiVersion=2022-11-28#delete-an-artifact
+
+#### Parameters
+
+| Name | Type | Description |
+| :------ | :------ | :------ |
+| `artifactName` | `string` | The name of the artifact to delete |
+| `options?` | [`FindOptions`](../interfaces/FindOptions.md) | Extra options that allow for the customization of the delete behavior |
+
+#### Returns
+
+`Promise`\<[`DeleteArtifactResponse`](../interfaces/DeleteArtifactResponse.md)\>
+
+single DeleteArtifactResponse object
+
+#### Implementation of
+
+[ArtifactClient](../interfaces/ArtifactClient.md).[deleteArtifact](../interfaces/ArtifactClient.md#deleteartifact)
+
+#### Defined in
+
+[src/internal/client.ts:248](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/client.ts#L248)
+
+___
+
 ### downloadArtifact

 ▸ **downloadArtifact**(`artifactId`, `options?`): `Promise`\<[`DownloadArtifactResponse`](../interfaces/DownloadArtifactResponse.md)\>
@@ -45,7 +77,7 @@ If `options.findBy` is specified, this will use the public Download Artifact API

 | Name | Type | Description |
 | :------ | :------ | :------ |
-| `artifactId` | `number` | The name of the artifact to download |
+| `artifactId` | `number` | The id of the artifact to download |
 | `options?` | [`DownloadArtifactOptions`](../interfaces/DownloadArtifactOptions.md) & [`FindOptions`](../interfaces/FindOptions.md) | Extra options that allow for the customization of the download behavior |

 #### Returns
@@ -60,7 +92,7 @@ single DownloadArtifactResponse object

 #### Defined in

-[src/internal/client.ts:119](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/client.ts#L119)
+[src/internal/client.ts:138](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/client.ts#L138)

 ___

@@ -95,7 +127,7 @@ If there are multiple artifacts with the same name in the same workflow run this

 #### Defined in

-[src/internal/client.ts:193](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/client.ts#L193)
+[src/internal/client.ts:212](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/client.ts#L212)

 ___

@@ -127,7 +159,7 @@ ListArtifactResponse object

 #### Defined in

-[src/internal/client.ts:157](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/client.ts#L157)
+[src/internal/client.ts:176](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/client.ts#L176)

 ___

@@ -158,4 +190,4 @@ single UploadArtifactResponse object

 #### Defined in

-[src/internal/client.ts:94](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/client.ts#L94)
+[src/internal/client.ts:113](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/client.ts#L113)
@@ -49,7 +49,7 @@ Error.constructor

 #### Defined in

-[src/internal/shared/errors.ts:4](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/shared/errors.ts#L4)
+[src/internal/shared/errors.ts:4](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/shared/errors.ts#L4)

 ## Properties

@@ -59,7 +59,7 @@ Error.constructor

 #### Defined in

-[src/internal/shared/errors.ts:2](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/shared/errors.ts#L2)
+[src/internal/shared/errors.ts:2](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/shared/errors.ts#L2)

 ___

@@ -48,7 +48,7 @@ Error.constructor

 #### Defined in

-[src/internal/shared/errors.ts:31](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/shared/errors.ts#L31)
+[src/internal/shared/errors.ts:31](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/shared/errors.ts#L31)

 ## Properties

@@ -48,7 +48,7 @@ Error.constructor

 #### Defined in

-[src/internal/shared/errors.ts:17](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/shared/errors.ts#L17)
+[src/internal/shared/errors.ts:17](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/shared/errors.ts#L17)

 ## Properties

@@ -0,0 +1,201 @@
+[@actions/artifact](../README.md) / NetworkError
+
+# Class: NetworkError
+
+## Hierarchy
+
+- `Error`
+
+  ↳ **`NetworkError`**
+
+## Table of contents
+
+### Constructors
+
+- [constructor](NetworkError.md#constructor)
+
+### Properties
+
+- [code](NetworkError.md#code)
+- [message](NetworkError.md#message)
+- [name](NetworkError.md#name)
+- [stack](NetworkError.md#stack)
+- [prepareStackTrace](NetworkError.md#preparestacktrace)
+- [stackTraceLimit](NetworkError.md#stacktracelimit)
+
+### Methods
+
+- [captureStackTrace](NetworkError.md#capturestacktrace)
+- [isNetworkErrorCode](NetworkError.md#isnetworkerrorcode)
+
+## Constructors
+
+### constructor
+
+• **new NetworkError**(`code`): [`NetworkError`](NetworkError.md)
+
+#### Parameters
+
+| Name | Type |
+| :------ | :------ |
+| `code` | `string` |
+
+#### Returns
+
+[`NetworkError`](NetworkError.md)
+
+#### Overrides
+
+Error.constructor
+
+#### Defined in
+
+[src/internal/shared/errors.ts:42](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/shared/errors.ts#L42)
+
+## Properties
+
+### code
+
+• **code**: `string`
+
+#### Defined in
+
+[src/internal/shared/errors.ts:40](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/shared/errors.ts#L40)
+
+___
+
+### message
+
+• **message**: `string`
+
+#### Inherited from
+
+Error.message
+
+#### Defined in
+
+node_modules/typescript/lib/lib.es5.d.ts:1068
+
+___
+
+### name
+
+• **name**: `string`
+
+#### Inherited from
+
+Error.name
+
+#### Defined in
+
+node_modules/typescript/lib/lib.es5.d.ts:1067
+
+___
+
+### stack
+
+• `Optional` **stack**: `string`
+
+#### Inherited from
+
+Error.stack
+
+#### Defined in
+
+node_modules/typescript/lib/lib.es5.d.ts:1069
+
+___
+
+### prepareStackTrace
+
+▪ `Static` `Optional` **prepareStackTrace**: (`err`: `Error`, `stackTraces`: `CallSite`[]) => `any`
+
+#### Type declaration
+
+▸ (`err`, `stackTraces`): `any`
+
+Optional override for formatting stack traces
+
+##### Parameters
+
+| Name | Type |
+| :------ | :------ |
+| `err` | `Error` |
+| `stackTraces` | `CallSite`[] |
+
+##### Returns
+
+`any`
+
+**`See`**
+
+https://v8.dev/docs/stack-trace-api#customizing-stack-traces
+
+#### Inherited from
+
+Error.prepareStackTrace
+
+#### Defined in
+
+node_modules/@types/node/globals.d.ts:11
+
+___
+
+### stackTraceLimit
+
+▪ `Static` **stackTraceLimit**: `number`
+
+#### Inherited from
+
+Error.stackTraceLimit
+
+#### Defined in
+
+node_modules/@types/node/globals.d.ts:13
+
+## Methods
+
+### captureStackTrace
+
+▸ **captureStackTrace**(`targetObject`, `constructorOpt?`): `void`
+
+Create .stack property on a target object
+
+#### Parameters
+
+| Name | Type |
+| :------ | :------ |
+| `targetObject` | `object` |
+| `constructorOpt?` | `Function` |
+
+#### Returns
+
+`void`
+
+#### Inherited from
+
+Error.captureStackTrace
+
+#### Defined in
+
+node_modules/@types/node/globals.d.ts:4
+
+___
+
+### isNetworkErrorCode
+
+▸ **isNetworkErrorCode**(`code?`): `boolean`
+
+#### Parameters
+
+| Name | Type |
+| :------ | :------ |
+| `code?` | `string` |
+
+#### Returns
+
+`boolean`
+
+#### Defined in
+
+[src/internal/shared/errors.ts:49](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/shared/errors.ts#L49)
@@ -0,0 +1,184 @@
+[@actions/artifact](../README.md) / UsageError
+
+# Class: UsageError
+
+## Hierarchy
+
+- `Error`
+
+  ↳ **`UsageError`**
+
+## Table of contents
+
+### Constructors
+
+- [constructor](UsageError.md#constructor)
+
+### Properties
+
+- [message](UsageError.md#message)
+- [name](UsageError.md#name)
+- [stack](UsageError.md#stack)
+- [prepareStackTrace](UsageError.md#preparestacktrace)
+- [stackTraceLimit](UsageError.md#stacktracelimit)
+
+### Methods
+
+- [captureStackTrace](UsageError.md#capturestacktrace)
+- [isUsageErrorMessage](UsageError.md#isusageerrormessage)
+
+## Constructors
+
+### constructor
+
+• **new UsageError**(): [`UsageError`](UsageError.md)
+
+#### Returns
+
+[`UsageError`](UsageError.md)
+
+#### Overrides
+
+Error.constructor
+
+#### Defined in
+
+[src/internal/shared/errors.ts:62](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/shared/errors.ts#L62)
+
+## Properties
+
+### message
+
+• **message**: `string`
+
+#### Inherited from
+
+Error.message
+
+#### Defined in
+
+node_modules/typescript/lib/lib.es5.d.ts:1068
+
+___
+
+### name
+
+• **name**: `string`
+
+#### Inherited from
+
+Error.name
+
+#### Defined in
+
+node_modules/typescript/lib/lib.es5.d.ts:1067
+
+___
+
+### stack
+
+• `Optional` **stack**: `string`
+
+#### Inherited from
+
+Error.stack
+
+#### Defined in
+
+node_modules/typescript/lib/lib.es5.d.ts:1069
+
+___
+
+### prepareStackTrace
+
+▪ `Static` `Optional` **prepareStackTrace**: (`err`: `Error`, `stackTraces`: `CallSite`[]) => `any`
+
+#### Type declaration
+
+▸ (`err`, `stackTraces`): `any`
+
+Optional override for formatting stack traces
+
+##### Parameters
+
+| Name | Type |
+| :------ | :------ |
+| `err` | `Error` |
+| `stackTraces` | `CallSite`[] |
+
+##### Returns
+
+`any`
+
+**`See`**
+
+https://v8.dev/docs/stack-trace-api#customizing-stack-traces
+
+#### Inherited from
+
+Error.prepareStackTrace
+
+#### Defined in
+
+node_modules/@types/node/globals.d.ts:11
+
+___
+
+### stackTraceLimit
+
+▪ `Static` **stackTraceLimit**: `number`
+
+#### Inherited from
+
+Error.stackTraceLimit
+
+#### Defined in
+
+node_modules/@types/node/globals.d.ts:13
+
+## Methods
+
+### captureStackTrace
+
+▸ **captureStackTrace**(`targetObject`, `constructorOpt?`): `void`
+
+Create .stack property on a target object
+
+#### Parameters
+
+| Name | Type |
+| :------ | :------ |
+| `targetObject` | `object` |
+| `constructorOpt?` | `Function` |
+
+#### Returns
+
+`void`
+
+#### Inherited from
+
+Error.captureStackTrace
+
+#### Defined in
+
+node_modules/@types/node/globals.d.ts:4
+
+___
+
+### isUsageErrorMessage
+
+▸ **isUsageErrorMessage**(`msg?`): `boolean`
+
+#### Parameters
+
+| Name | Type |
+| :------ | :------ |
+| `msg?` | `string` |
+
+#### Returns
+
+`boolean`
+
+#### Defined in
+
+[src/internal/shared/errors.ts:68](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/shared/errors.ts#L68)
@@ -23,7 +23,7 @@ The time when the artifact was created

 #### Defined in

-[src/internal/shared/interfaces.ts:123](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/shared/interfaces.ts#L123)
+[src/internal/shared/interfaces.ts:123](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/shared/interfaces.ts#L123)

 ___

@@ -35,7 +35,7 @@ The ID of the artifact

 #### Defined in

-[src/internal/shared/interfaces.ts:113](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/shared/interfaces.ts#L113)
+[src/internal/shared/interfaces.ts:113](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/shared/interfaces.ts#L113)

 ___

@@ -47,7 +47,7 @@ The name of the artifact

 #### Defined in

-[src/internal/shared/interfaces.ts:108](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/shared/interfaces.ts#L108)
+[src/internal/shared/interfaces.ts:108](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/shared/interfaces.ts#L108)

 ___

@@ -59,4 +59,4 @@ The size of the artifact in bytes

 #### Defined in

-[src/internal/shared/interfaces.ts:118](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/shared/interfaces.ts#L118)
+[src/internal/shared/interfaces.ts:118](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/shared/interfaces.ts#L118)
@@ -12,6 +12,7 @@ Generic interface for the artifact client.

 ### Methods

+- [deleteArtifact](ArtifactClient.md#deleteartifact)
 - [downloadArtifact](ArtifactClient.md#downloadartifact)
 - [getArtifact](ArtifactClient.md#getartifact)
 - [listArtifacts](ArtifactClient.md#listartifacts)
@@ -19,6 +20,33 @@ Generic interface for the artifact client.

 ## Methods

+### deleteArtifact
+
+▸ **deleteArtifact**(`artifactName`, `options?`): `Promise`\<[`DeleteArtifactResponse`](DeleteArtifactResponse.md)\>
+
+Delete an Artifact
+
+If `options.findBy` is specified, this will use the public Delete Artifact API https://docs.github.com/en/rest/actions/artifacts?apiVersion=2022-11-28#delete-an-artifact
+
+#### Parameters
+
+| Name | Type | Description |
+| :------ | :------ | :------ |
+| `artifactName` | `string` | The name of the artifact to delete |
+| `options?` | [`FindOptions`](FindOptions.md) | Extra options that allow for the customization of the delete behavior |
+
+#### Returns
+
+`Promise`\<[`DeleteArtifactResponse`](DeleteArtifactResponse.md)\>
+
+single DeleteArtifactResponse object
+
+#### Defined in
+
+[src/internal/client.ts:103](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/client.ts#L103)
+
+___
+
 ### downloadArtifact

 ▸ **downloadArtifact**(`artifactId`, `options?`): `Promise`\<[`DownloadArtifactResponse`](DownloadArtifactResponse.md)\>
@@ -31,7 +59,7 @@ If `options.findBy` is specified, this will use the public Download Artifact API

 | Name | Type | Description |
 | :------ | :------ | :------ |
-| `artifactId` | `number` | The name of the artifact to download |
+| `artifactId` | `number` | The id of the artifact to download |
 | `options?` | [`DownloadArtifactOptions`](DownloadArtifactOptions.md) & [`FindOptions`](FindOptions.md) | Extra options that allow for the customization of the download behavior |

 #### Returns
@@ -42,7 +70,7 @@ single DownloadArtifactResponse object

 #### Defined in

-[src/internal/client.ts:84](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/client.ts#L84)
+[src/internal/client.ts:89](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/client.ts#L89)

 ___

@@ -73,7 +101,7 @@ If there are multiple artifacts with the same name in the same workflow run this

 #### Defined in

-[src/internal/client.ts:70](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/client.ts#L70)
+[src/internal/client.ts:75](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/client.ts#L75)

 ___

@@ -101,7 +129,7 @@ ListArtifactResponse object

 #### Defined in

-[src/internal/client.ts:52](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/client.ts#L52)
+[src/internal/client.ts:57](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/client.ts#L57)

 ___

@@ -128,4 +156,4 @@ single UploadArtifactResponse object

 #### Defined in

-[src/internal/client.ts:35](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/client.ts#L35)
+[src/internal/client.ts:40](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/client.ts#L40)
@@ -0,0 +1,23 @@
+[@actions/artifact](../README.md) / DeleteArtifactResponse
+
+# Interface: DeleteArtifactResponse
+
+Response from the server when deleting an artifact
+
+## Table of contents
+
+### Properties
+
+- [id](DeleteArtifactResponse.md#id)
+
+## Properties
+
+### id
+
+• **id**: `number`
+
+The id of the artifact that was deleted
+
+#### Defined in
+
+[src/internal/shared/interfaces.ts:158](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/shared/interfaces.ts#L158)
@@ -20,4 +20,4 @@ Denotes where the artifact will be downloaded to. If not specified then the arti

 #### Defined in

-[src/internal/shared/interfaces.ts:98](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/shared/interfaces.ts#L98)
+[src/internal/shared/interfaces.ts:98](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/shared/interfaces.ts#L98)
@@ -20,4 +20,4 @@ The path where the artifact was downloaded to

 #### Defined in

-[src/internal/shared/interfaces.ts:88](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/shared/interfaces.ts#L88)
+[src/internal/shared/interfaces.ts:88](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/shared/interfaces.ts#L88)
@@ -27,4 +27,4 @@ The criteria for finding Artifact(s) out of the scope of the current run.

 #### Defined in

-[src/internal/shared/interfaces.ts:131](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/shared/interfaces.ts#L131)
+[src/internal/shared/interfaces.ts:131](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/shared/interfaces.ts#L131)
@@ -20,4 +20,4 @@ Metadata about the artifact that was found

 #### Defined in

-[src/internal/shared/interfaces.ts:57](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/shared/interfaces.ts#L57)
+[src/internal/shared/interfaces.ts:57](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/shared/interfaces.ts#L57)
@@ -21,4 +21,4 @@ In the case of reruns, this can be useful to avoid duplicates

 #### Defined in

-[src/internal/shared/interfaces.ts:68](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/shared/interfaces.ts#L68)
+[src/internal/shared/interfaces.ts:68](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/shared/interfaces.ts#L68)
@@ -20,4 +20,4 @@ A list of artifacts that were found

 #### Defined in

-[src/internal/shared/interfaces.ts:78](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/shared/interfaces.ts#L78)
+[src/internal/shared/interfaces.ts:78](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/shared/interfaces.ts#L78)
@@ -28,7 +28,7 @@ For large files that are not easily compressed, a value of 0 is recommended for

 #### Defined in

-[src/internal/shared/interfaces.ts:47](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/shared/interfaces.ts#L47)
+[src/internal/shared/interfaces.ts:47](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/shared/interfaces.ts#L47)

 ___

@@ -52,4 +52,4 @@ input of 0 assumes default retention setting.

 #### Defined in

-[src/internal/shared/interfaces.ts:36](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/shared/interfaces.ts#L36)
+[src/internal/shared/interfaces.ts:36](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/shared/interfaces.ts#L36)
@@ -22,7 +22,7 @@ This ID can be used as input to other APIs to download, delete or get more infor

 #### Defined in

-[src/internal/shared/interfaces.ts:14](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/shared/interfaces.ts#L14)
+[src/internal/shared/interfaces.ts:14](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/shared/interfaces.ts#L14)

 ___

@@ -34,4 +34,4 @@ Total size of the artifact in bytes. Not provided if no artifact was uploaded

 #### Defined in

-[src/internal/shared/interfaces.ts:8](https://github.com/actions/toolkit/blob/e3764a5/packages/artifact/src/internal/shared/interfaces.ts#L8)
+[src/internal/shared/interfaces.ts:8](https://github.com/actions/toolkit/blob/daf23ba/packages/artifact/src/internal/shared/interfaces.ts#L8)
@@ -1,12 +1,12 @@
 {
  "name": "@actions/artifact",
-  "version": "2.0.0",
+  "version": "2.1.4",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "@actions/artifact",
-      "version": "2.0.0",
+      "version": "2.1.4",
      "license": "MIT",
      "dependencies": {
        "@actions/core": "^1.10.0",
@@ -1,6 +1,6 @@
 {
  "name": "@actions/artifact",
-  "version": "2.0.0",
+  "version": "2.1.4",
  "preview": true,
  "description": "Actions artifact lib",
  "keywords": [
@@ -196,6 +196,36 @@ export interface GetSignedArtifactURLResponse {
     */
    signedUrl: string;
 }
+/**
+ * @generated from protobuf message github.actions.results.api.v1.DeleteArtifactRequest
+ */
+export interface DeleteArtifactRequest {
+    /**
+     * @generated from protobuf field: string workflow_run_backend_id = 1;
+     */
+    workflowRunBackendId: string;
+    /**
+     * @generated from protobuf field: string workflow_job_run_backend_id = 2;
+     */
+    workflowJobRunBackendId: string;
+    /**
+     * @generated from protobuf field: string name = 3;
+     */
+    name: string;
+}
+/**
+ * @generated from protobuf message github.actions.results.api.v1.DeleteArtifactResponse
+ */
+export interface DeleteArtifactResponse {
+    /**
+     * @generated from protobuf field: bool ok = 1;
+     */
+    ok: boolean;
+    /**
+     * @generated from protobuf field: int64 artifact_id = 2;
+     */
+    artifactId: string;
+}
 // @generated message type with reflection information, may provide speed optimized methods
 class CreateArtifactRequest$Type extends MessageType<CreateArtifactRequest> {
    constructor() {
@@ -759,6 +789,121 @@ class GetSignedArtifactURLResponse$Type extends MessageType<GetSignedArtifactURL
 * @generated MessageType for protobuf message github.actions.results.api.v1.GetSignedArtifactURLResponse
 */
 export const GetSignedArtifactURLResponse = new GetSignedArtifactURLResponse$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class DeleteArtifactRequest$Type extends MessageType<DeleteArtifactRequest> {
+    constructor() {
+        super("github.actions.results.api.v1.DeleteArtifactRequest", [
+            { no: 1, name: "workflow_run_backend_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 2, name: "workflow_job_run_backend_id", kind: "scalar", T: 9 /*ScalarType.STRING*/ },
+            { no: 3, name: "name", kind: "scalar", T: 9 /*ScalarType.STRING*/ }
+        ]);
+    }
+    create(value?: PartialMessage<DeleteArtifactRequest>): DeleteArtifactRequest {
+        const message = { workflowRunBackendId: "", workflowJobRunBackendId: "", name: "" };
+        globalThis.Object.defineProperty(message, MESSAGE_TYPE, { enumerable: false, value: this });
+        if (value !== undefined)
+            reflectionMergePartial<DeleteArtifactRequest>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: DeleteArtifactRequest): DeleteArtifactRequest {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* string workflow_run_backend_id */ 1:
+                    message.workflowRunBackendId = reader.string();
+                    break;
+                case /* string workflow_job_run_backend_id */ 2:
+                    message.workflowJobRunBackendId = reader.string();
+                    break;
+                case /* string name */ 3:
+                    message.name = reader.string();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: DeleteArtifactRequest, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* string workflow_run_backend_id = 1; */
+        if (message.workflowRunBackendId !== "")
+            writer.tag(1, WireType.LengthDelimited).string(message.workflowRunBackendId);
+        /* string workflow_job_run_backend_id = 2; */
+        if (message.workflowJobRunBackendId !== "")
+            writer.tag(2, WireType.LengthDelimited).string(message.workflowJobRunBackendId);
+        /* string name = 3; */
+        if (message.name !== "")
+            writer.tag(3, WireType.LengthDelimited).string(message.name);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message github.actions.results.api.v1.DeleteArtifactRequest
+ */
+export const DeleteArtifactRequest = new DeleteArtifactRequest$Type();
+// @generated message type with reflection information, may provide speed optimized methods
+class DeleteArtifactResponse$Type extends MessageType<DeleteArtifactResponse> {
+    constructor() {
+        super("github.actions.results.api.v1.DeleteArtifactResponse", [
+            { no: 1, name: "ok", kind: "scalar", T: 8 /*ScalarType.BOOL*/ },
+            { no: 2, name: "artifact_id", kind: "scalar", T: 3 /*ScalarType.INT64*/ }
+        ]);
+    }
+    create(value?: PartialMessage<DeleteArtifactResponse>): DeleteArtifactResponse {
+        const message = { ok: false, artifactId: "0" };
+        globalThis.Object.defineProperty(message, MESSAGE_TYPE, { enumerable: false, value: this });
+        if (value !== undefined)
+            reflectionMergePartial<DeleteArtifactResponse>(this, message, value);
+        return message;
+    }
+    internalBinaryRead(reader: IBinaryReader, length: number, options: BinaryReadOptions, target?: DeleteArtifactResponse): DeleteArtifactResponse {
+        let message = target ?? this.create(), end = reader.pos + length;
+        while (reader.pos < end) {
+            let [fieldNo, wireType] = reader.tag();
+            switch (fieldNo) {
+                case /* bool ok */ 1:
+                    message.ok = reader.bool();
+                    break;
+                case /* int64 artifact_id */ 2:
+                    message.artifactId = reader.int64().toString();
+                    break;
+                default:
+                    let u = options.readUnknownField;
+                    if (u === "throw")
+                        throw new globalThis.Error(`Unknown field ${fieldNo} (wire type ${wireType}) for ${this.typeName}`);
+                    let d = reader.skip(wireType);
+                    if (u !== false)
+                        (u === true ? UnknownFieldHandler.onRead : u)(this.typeName, message, fieldNo, wireType, d);
+            }
+        }
+        return message;
+    }
+    internalBinaryWrite(message: DeleteArtifactResponse, writer: IBinaryWriter, options: BinaryWriteOptions): IBinaryWriter {
+        /* bool ok = 1; */
+        if (message.ok !== false)
+            writer.tag(1, WireType.Varint).bool(message.ok);
+        /* int64 artifact_id = 2; */
+        if (message.artifactId !== "0")
+            writer.tag(2, WireType.Varint).int64(message.artifactId);
+        let u = options.writeUnknownFields;
+        if (u !== false)
+            (u == true ? UnknownFieldHandler.onWrite : u)(this.typeName, message, writer);
+        return writer;
+    }
+}
+/**
+ * @generated MessageType for protobuf message github.actions.results.api.v1.DeleteArtifactResponse
+ */
+export const DeleteArtifactResponse = new DeleteArtifactResponse$Type();
 /**
 * @generated ServiceType for protobuf service github.actions.results.api.v1.ArtifactService
 */
@@ -766,5 +911,6 @@ export const ArtifactService = new ServiceType("github.actions.results.api.v1.Ar
    { name: "CreateArtifact", options: {}, I: CreateArtifactRequest, O: CreateArtifactResponse },
    { name: "FinalizeArtifact", options: {}, I: FinalizeArtifactRequest, O: FinalizeArtifactResponse },
    { name: "ListArtifacts", options: {}, I: ListArtifactsRequest, O: ListArtifactsResponse },
-    { name: "GetSignedArtifactURL", options: {}, I: GetSignedArtifactURLRequest, O: GetSignedArtifactURLResponse }
+    { name: "GetSignedArtifactURL", options: {}, I: GetSignedArtifactURLRequest, O: GetSignedArtifactURLResponse },
+    { name: "DeleteArtifact", options: {}, I: DeleteArtifactRequest, O: DeleteArtifactResponse }
 ]);
@@ -17,6 +17,8 @@ import {
  ListArtifactsResponse,
  GetSignedArtifactURLRequest,
  GetSignedArtifactURLResponse,
+  DeleteArtifactRequest,
+  DeleteArtifactResponse,
 } from "./artifact";

 //==================================//
@@ -43,6 +45,9 @@ export interface ArtifactServiceClient {
  GetSignedArtifactURL(
    request: GetSignedArtifactURLRequest
  ): Promise<GetSignedArtifactURLResponse>;
+  DeleteArtifact(
+    request: DeleteArtifactRequest
+  ): Promise<DeleteArtifactResponse>;
 }

 export class ArtifactServiceClientJSON implements ArtifactServiceClient {
@@ -53,6 +58,7 @@ export class ArtifactServiceClientJSON implements ArtifactServiceClient {
    this.FinalizeArtifact.bind(this);
    this.ListArtifacts.bind(this);
    this.GetSignedArtifactURL.bind(this);
+    this.DeleteArtifact.bind(this);
  }
  CreateArtifact(
    request: CreateArtifactRequest
@@ -129,6 +135,26 @@ export class ArtifactServiceClientJSON implements ArtifactServiceClient {
      })
    );
  }
+
+  DeleteArtifact(
+    request: DeleteArtifactRequest
+  ): Promise<DeleteArtifactResponse> {
+    const data = DeleteArtifactRequest.toJson(request, {
+      useProtoFieldName: true,
+      emitDefaultValues: false,
+    });
+    const promise = this.rpc.request(
+      "github.actions.results.api.v1.ArtifactService",
+      "DeleteArtifact",
+      "application/json",
+      data as object
+    );
+    return promise.then((data) =>
+      DeleteArtifactResponse.fromJson(data as any, {
+        ignoreUnknownFields: true,
+      })
+    );
+  }
 }

 export class ArtifactServiceClientProtobuf implements ArtifactServiceClient {
@@ -139,6 +165,7 @@ export class ArtifactServiceClientProtobuf implements ArtifactServiceClient {
    this.FinalizeArtifact.bind(this);
    this.ListArtifacts.bind(this);
    this.GetSignedArtifactURL.bind(this);
+    this.DeleteArtifact.bind(this);
  }
  CreateArtifact(
    request: CreateArtifactRequest
@@ -197,6 +224,21 @@ export class ArtifactServiceClientProtobuf implements ArtifactServiceClient {
      GetSignedArtifactURLResponse.fromBinary(data as Uint8Array)
    );
  }
+
+  DeleteArtifact(
+    request: DeleteArtifactRequest
+  ): Promise<DeleteArtifactResponse> {
+    const data = DeleteArtifactRequest.toBinary(request);
+    const promise = this.rpc.request(
+      "github.actions.results.api.v1.ArtifactService",
+      "DeleteArtifact",
+      "application/protobuf",
+      data
+    );
+    return promise.then((data) =>
+      DeleteArtifactResponse.fromBinary(data as Uint8Array)
+    );
+  }
 }

 //==================================//
@@ -220,6 +262,10 @@ export interface ArtifactServiceTwirp<T extends TwirpContext = TwirpContext> {
    ctx: T,
    request: GetSignedArtifactURLRequest
  ): Promise<GetSignedArtifactURLResponse>;
+  DeleteArtifact(
+    ctx: T,
+    request: DeleteArtifactRequest
+  ): Promise<DeleteArtifactResponse>;
 }

 export enum ArtifactServiceMethod {
@@ -227,6 +273,7 @@ export enum ArtifactServiceMethod {
  FinalizeArtifact = "FinalizeArtifact",
  ListArtifacts = "ListArtifacts",
  GetSignedArtifactURL = "GetSignedArtifactURL",
+  DeleteArtifact = "DeleteArtifact",
 }

 export const ArtifactServiceMethodList = [
@@ -234,6 +281,7 @@ export const ArtifactServiceMethodList = [
  ArtifactServiceMethod.FinalizeArtifact,
  ArtifactServiceMethod.ListArtifacts,
  ArtifactServiceMethod.GetSignedArtifactURL,
+  ArtifactServiceMethod.DeleteArtifact,
 ];

 export function createArtifactServiceServer<
@@ -333,6 +381,26 @@ function matchArtifactServiceRoute<T extends TwirpContext = TwirpContext>(
          interceptors
        );
      };
+    case "DeleteArtifact":
+      return async (
+        ctx: T,
+        service: ArtifactServiceTwirp,
+        data: Buffer,
+        interceptors?: Interceptor<
+          T,
+          DeleteArtifactRequest,
+          DeleteArtifactResponse
+        >[]
+      ) => {
+        ctx = { ...ctx, methodName: "DeleteArtifact" };
+        await events.onMatch(ctx);
+        return handleArtifactServiceDeleteArtifactRequest(
+          ctx,
+          service,
+          data,
+          interceptors
+        );
+      };
    default:
      events.onNotFound();
      const msg = `no handler found`;
@@ -463,6 +531,35 @@ function handleArtifactServiceGetSignedArtifactURLRequest<
      throw new TwirpError(TwirpErrorCode.BadRoute, msg);
  }
 }
+
+function handleArtifactServiceDeleteArtifactRequest<
+  T extends TwirpContext = TwirpContext
+>(
+  ctx: T,
+  service: ArtifactServiceTwirp,
+  data: Buffer,
+  interceptors?: Interceptor<T, DeleteArtifactRequest, DeleteArtifactResponse>[]
+): Promise<string | Uint8Array> {
+  switch (ctx.contentType) {
+    case TwirpContentType.JSON:
+      return handleArtifactServiceDeleteArtifactJSON<T>(
+        ctx,
+        service,
+        data,
+        interceptors
+      );
+    case TwirpContentType.Protobuf:
+      return handleArtifactServiceDeleteArtifactProtobuf<T>(
+        ctx,
+        service,
+        data,
+        interceptors
+      );
+    default:
+      const msg = "unexpected Content-Type";
+      throw new TwirpError(TwirpErrorCode.BadRoute, msg);
+  }
+}
 async function handleArtifactServiceCreateArtifactJSON<
  T extends TwirpContext = TwirpContext
 >(
@@ -646,6 +743,50 @@ async function handleArtifactServiceGetSignedArtifactURLJSON<
    }) as string
  );
 }
+
+async function handleArtifactServiceDeleteArtifactJSON<
+  T extends TwirpContext = TwirpContext
+>(
+  ctx: T,
+  service: ArtifactServiceTwirp,
+  data: Buffer,
+  interceptors?: Interceptor<T, DeleteArtifactRequest, DeleteArtifactResponse>[]
+) {
+  let request: DeleteArtifactRequest;
+  let response: DeleteArtifactResponse;
+
+  try {
+    const body = JSON.parse(data.toString() || "{}");
+    request = DeleteArtifactRequest.fromJson(body, {
+      ignoreUnknownFields: true,
+    });
+  } catch (e) {
+    if (e instanceof Error) {
+      const msg = "the json request could not be decoded";
+      throw new TwirpError(TwirpErrorCode.Malformed, msg).withCause(e, true);
+    }
+  }
+
+  if (interceptors && interceptors.length > 0) {
+    const interceptor = chainInterceptors(...interceptors) as Interceptor<
+      T,
+      DeleteArtifactRequest,
+      DeleteArtifactResponse
+    >;
+    response = await interceptor(ctx, request!, (ctx, inputReq) => {
+      return service.DeleteArtifact(ctx, inputReq);
+    });
+  } else {
+    response = await service.DeleteArtifact(ctx, request!);
+  }
+
+  return JSON.stringify(
+    DeleteArtifactResponse.toJson(response, {
+      useProtoFieldName: true,
+      emitDefaultValues: false,
+    }) as string
+  );
+}
 async function handleArtifactServiceCreateArtifactProtobuf<
  T extends TwirpContext = TwirpContext
 >(
@@ -797,3 +938,39 @@ async function handleArtifactServiceGetSignedArtifactURLProtobuf<

  return Buffer.from(GetSignedArtifactURLResponse.toBinary(response));
 }
+
+async function handleArtifactServiceDeleteArtifactProtobuf<
+  T extends TwirpContext = TwirpContext
+>(
+  ctx: T,
+  service: ArtifactServiceTwirp,
+  data: Buffer,
+  interceptors?: Interceptor<T, DeleteArtifactRequest, DeleteArtifactResponse>[]
+) {
+  let request: DeleteArtifactRequest;
+  let response: DeleteArtifactResponse;
+
+  try {
+    request = DeleteArtifactRequest.fromBinary(data);
+  } catch (e) {
+    if (e instanceof Error) {
+      const msg = "the protobuf request could not be decoded";
+      throw new TwirpError(TwirpErrorCode.Malformed, msg).withCause(e, true);
+    }
+  }
+
+  if (interceptors && interceptors.length > 0) {
+    const interceptor = chainInterceptors(...interceptors) as Interceptor<
+      T,
+      DeleteArtifactRequest,
+      DeleteArtifactResponse
+    >;
+    response = await interceptor(ctx, request!, (ctx, inputReq) => {
+      return service.DeleteArtifact(ctx, inputReq);
+    });
+  } else {
+    response = await service.DeleteArtifact(ctx, request!);
+  }
+
+  return Buffer.from(DeleteArtifactResponse.toBinary(response));
+}
@@ -8,13 +8,18 @@ import {
  ListArtifactsOptions,
  ListArtifactsResponse,
  DownloadArtifactResponse,
-  FindOptions
+  FindOptions,
+  DeleteArtifactResponse
 } from './shared/interfaces'
 import {uploadArtifact} from './upload/upload-artifact'
 import {
  downloadArtifactPublic,
  downloadArtifactInternal
 } from './download/download-artifact'
+import {
+  deleteArtifactPublic,
+  deleteArtifactInternal
+} from './delete/delete-artifact'
 import {getArtifactPublic, getArtifactInternal} from './find/get-artifact'
 import {listArtifactsPublic, listArtifactsInternal} from './find/list-artifacts'
 import {GHESNotSupportedError} from './shared/errors'
@@ -77,7 +82,7 @@ export interface ArtifactClient {
   *
   * If `options.findBy` is specified, this will use the public Download Artifact API https://docs.github.com/en/rest/actions/artifacts?apiVersion=2022-11-28#download-an-artifact
   *
-   * @param artifactId The name of the artifact to download
+   * @param artifactId The id of the artifact to download
   * @param options Extra options that allow for the customization of the download behavior
   * @returns single DownloadArtifactResponse object
   */
@@ -85,6 +90,20 @@ export interface ArtifactClient {
    artifactId: number,
    options?: DownloadArtifactOptions & FindOptions
  ): Promise<DownloadArtifactResponse>
+
+  /**
+   * Delete an Artifact
+   *
+   * If `options.findBy` is specified, this will use the public Delete Artifact API https://docs.github.com/en/rest/actions/artifacts?apiVersion=2022-11-28#delete-an-artifact
+   *
+   * @param artifactName The name of the artifact to delete
+   * @param options Extra options that allow for the customization of the delete behavior
+   * @returns single DeleteArtifactResponse object
+   */
+  deleteArtifact(
+    artifactName: string,
+    options?: FindOptions
+  ): Promise<DeleteArtifactResponse>
 }

 /**
@@ -225,4 +244,41 @@ If the error persists, please check whether Actions and API requests are operati
      throw error
    }
  }
+
+  async deleteArtifact(
+    artifactName: string,
+    options?: FindOptions
+  ): Promise<DeleteArtifactResponse> {
+    try {
+      if (isGhes()) {
+        throw new GHESNotSupportedError()
+      }
+
+      if (options?.findBy) {
+        const {
+          findBy: {repositoryOwner, repositoryName, workflowRunId, token}
+        } = options
+
+        return deleteArtifactPublic(
+          artifactName,
+          workflowRunId,
+          repositoryOwner,
+          repositoryName,
+          token
+        )
+      }
+
+      return deleteArtifactInternal(artifactName)
+    } catch (error) {
+      warning(
+        `Delete Artifact failed with error: ${error}.
+
+Errors can be temporary, so please try again and optionally run the action with debug mode enabled for more information.
+
+If the error persists, please check whether Actions and API requests are operating normally at [https://githubstatus.com](https://www.githubstatus.com).`
+      )
+
+      throw error
+    }
+  }
 }
@@ -0,0 +1,109 @@
+import {info, debug} from '@actions/core'
+import {getOctokit} from '@actions/github'
+import {DeleteArtifactResponse} from '../shared/interfaces'
+import {getUserAgentString} from '../shared/user-agent'
+import {getRetryOptions} from '../find/retry-options'
+import {defaults as defaultGitHubOptions} from '@actions/github/lib/utils'
+import {requestLog} from '@octokit/plugin-request-log'
+import {retry} from '@octokit/plugin-retry'
+import {OctokitOptions} from '@octokit/core/dist-types/types'
+import {internalArtifactTwirpClient} from '../shared/artifact-twirp-client'
+import {getBackendIdsFromToken} from '../shared/util'
+import {
+  DeleteArtifactRequest,
+  ListArtifactsRequest,
+  StringValue
+} from '../../generated'
+import {getArtifactPublic} from '../find/get-artifact'
+import {ArtifactNotFoundError, InvalidResponseError} from '../shared/errors'
+
+export async function deleteArtifactPublic(
+  artifactName: string,
+  workflowRunId: number,
+  repositoryOwner: string,
+  repositoryName: string,
+  token: string
+): Promise<DeleteArtifactResponse> {
+  const [retryOpts, requestOpts] = getRetryOptions(defaultGitHubOptions)
+
+  const opts: OctokitOptions = {
+    log: undefined,
+    userAgent: getUserAgentString(),
+    previews: undefined,
+    retry: retryOpts,
+    request: requestOpts
+  }
+
+  const github = getOctokit(token, opts, retry, requestLog)
+
+  const getArtifactResp = await getArtifactPublic(
+    artifactName,
+    workflowRunId,
+    repositoryOwner,
+    repositoryName,
+    token
+  )
+
+  const deleteArtifactResp = await github.rest.actions.deleteArtifact({
+    owner: repositoryOwner,
+    repo: repositoryName,
+    artifact_id: getArtifactResp.artifact.id
+  })
+
+  if (deleteArtifactResp.status !== 204) {
+    throw new InvalidResponseError(
+      `Invalid response from GitHub API: ${deleteArtifactResp.status} (${deleteArtifactResp?.headers?.['x-github-request-id']})`
+    )
+  }
+
+  return {
+    id: getArtifactResp.artifact.id
+  }
+}
+
+export async function deleteArtifactInternal(
+  artifactName
+): Promise<DeleteArtifactResponse> {
+  const artifactClient = internalArtifactTwirpClient()
+
+  const {workflowRunBackendId, workflowJobRunBackendId} =
+    getBackendIdsFromToken()
+
+  const listReq: ListArtifactsRequest = {
+    workflowRunBackendId,
+    workflowJobRunBackendId,
+    nameFilter: StringValue.create({value: artifactName})
+  }
+
+  const listRes = await artifactClient.ListArtifacts(listReq)
+
+  if (listRes.artifacts.length === 0) {
+    throw new ArtifactNotFoundError(
+      `Artifact not found for name: ${artifactName}`
+    )
+  }
+
+  let artifact = listRes.artifacts[0]
+  if (listRes.artifacts.length > 1) {
+    artifact = listRes.artifacts.sort(
+      (a, b) => Number(b.databaseId) - Number(a.databaseId)
+    )[0]
+
+    debug(
+      `More than one artifact found for a single name, returning newest (id: ${artifact.databaseId})`
+    )
+  }
+
+  const req: DeleteArtifactRequest = {
+    workflowRunBackendId: artifact.workflowRunBackendId,
+    workflowJobRunBackendId: artifact.workflowJobRunBackendId,
+    name: artifact.name
+  }
+
+  const res = await artifactClient.DeleteArtifact(req)
+  info(`Artifact '${artifactName}' (ID: ${res.artifactId}) deleted`)
+
+  return {
+    id: Number(res.artifactId)
+  }
+}
@@ -1,4 +1,7 @@
 import fs from 'fs/promises'
+import * as stream from 'stream'
+import {createWriteStream} from 'fs'
+import * as path from 'path'
 import * as github from '@actions/github'
 import * as core from '@actions/core'
 import * as httpClient from '@actions/http-client'
@@ -44,6 +47,11 @@ async function streamExtract(url: string, directory: string): Promise<void> {
      await streamExtractExternal(url, directory)
      return
    } catch (error) {
+      if (error.message.includes('Malformed extraction path')) {
+        throw new Error(
+          `Artifact download failed with unretryable error: ${error.message}`
+        )
+      }
      retryCount++
      core.debug(
        `Failed to download artifact after ${retryCount} retries due to ${error.message}. Retrying in 5 seconds...`
@@ -78,6 +86,8 @@ export async function streamExtractExternal(
    }
    const timer = setTimeout(timerFn, timeout)

+    const createdDirectories = new Set<string>()
+    createdDirectories.add(directory)
    response.message
      .on('data', () => {
        timer.refresh()
@@ -89,8 +99,46 @@ export async function streamExtractExternal(
        clearTimeout(timer)
        reject(error)
      })
-      .pipe(unzip.Extract({path: directory}))
-      .on('close', () => {
+      .pipe(unzip.Parse())
+      .pipe(
+        new stream.Transform({
+          objectMode: true,
+          transform: async (entry, _, callback) => {
+            const fullPath = path.normalize(path.join(directory, entry.path))
+            if (!directory.endsWith(path.sep)) {
+              directory += path.sep
+            }
+            if (!fullPath.startsWith(directory)) {
+              reject(new Error(`Malformed extraction path: ${fullPath}`))
+            }
+
+            if (entry.type === 'Directory') {
+              if (!createdDirectories.has(fullPath)) {
+                createdDirectories.add(fullPath)
+                await resolveOrCreateDirectory(fullPath).then(() => {
+                  entry.autodrain()
+                  callback()
+                })
+              } else {
+                entry.autodrain()
+                callback()
+              }
+            } else {
+              core.info(`Extracting artifact entry: ${fullPath}`)
+              if (!createdDirectories.has(path.dirname(fullPath))) {
+                createdDirectories.add(path.dirname(fullPath))
+                await resolveOrCreateDirectory(path.dirname(fullPath))
+              }
+
+              const writeStream = createWriteStream(fullPath)
+              writeStream.on('finish', callback)
+              writeStream.on('error', reject)
+              entry.pipe(writeStream)
+            }
+          }
+        })
+      )
+      .on('finish', async () => {
        clearTimeout(timer)
        resolve()
      })
@@ -49,7 +49,9 @@ export async function getArtifactPublic(

  if (getArtifactResp.data.artifacts.length === 0) {
    throw new ArtifactNotFoundError(
-      `Artifact not found for name: ${artifactName}`
+      `Artifact not found for name: ${artifactName}
+        Please ensure that your artifact is not expired and the artifact was uploaded using a compatible version of toolkit/upload-artifact.
+        For more information, visit the GitHub Artifacts FAQ: https://github.com/actions/toolkit/blob/main/packages/artifact/docs/faq.md`
    )
  }

@@ -89,7 +91,9 @@ export async function getArtifactInternal(

  if (res.artifacts.length === 0) {
    throw new ArtifactNotFoundError(
-      `Artifact not found for name: ${artifactName}`
+      `Artifact not found for name: ${artifactName}
+        Please ensure that your artifact is not expired and the artifact was uploaded using a compatible version of toolkit/upload-artifact.
+        For more information, visit the GitHub Artifacts FAQ: https://github.com/actions/toolkit/blob/main/packages/artifact/docs/faq.md`
    )
  }

@@ -27,7 +27,13 @@ export function isGhes(): boolean {
  const ghUrl = new URL(
    process.env['GITHUB_SERVER_URL'] || 'https://github.com'
  )
-  return ghUrl.hostname.toUpperCase() !== 'GITHUB.COM'
+
+  const hostname = ghUrl.hostname.trimEnd().toUpperCase()
+  const isGitHubHost = hostname === 'GITHUB.COM'
+  const isGheHost =
+    hostname.endsWith('.GHE.COM') || hostname.endsWith('.GHE.LOCALHOST')
+
+  return !isGitHubHost && !isGheHost
 }

 export function getGitHubWorkspaceDir(): string {
@@ -147,3 +147,13 @@ export interface FindOptions {
    repositoryName: string
  }
 }
+
+/**
+ * Response from the server when deleting an artifact
+ */
+export interface DeleteArtifactResponse {
+  /**
+   * The id of the artifact that was deleted
+   */
+  id: number
+}
@@ -0,0 +1,9 @@
+The MIT License (MIT)
+
+Copyright 2024 GitHub
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
@@ -0,0 +1,172 @@
+# `@actions/attest`
+
+Functions for generating signed attestations for workflow artifacts.
+
+Attestations bind some subject (a named artifact along with its digest) to a
+predicate (some assertion about that subject) using the [in-toto
+statement](https://github.com/in-toto/attestation/tree/main/spec/v1) format. A
+signature is generated for the attestation using a
+[Sigstore](https://www.sigstore.dev/)-issued signing certificate.
+
+Once the attestation has been created and signed, it will be uploaded to the GH
+attestations API and associated with the repository from which the workflow was
+initiated.
+
+## Usage
+
+### `attest`
+
+The `attest` function takes the supplied subject/predicate pair and generates a
+signed attestation.
+
+```js
+const { attest } = require('@actions/attest');
+const core = require('@actions/core');
+
+async function run() {
+    // In order to persist attestations to the repo, this should be a token with
+    // repository write permissions.
+    const ghToken = core.getInput('gh-token');
+
+    const attestation = await attest({
+        subjectName: 'my-artifact-name',
+        subjectDigest: { 'sha256': '36ab4667...'},
+        predicateType: 'https://in-toto.io/attestation/release',
+        predicate: { . . . },
+        token: ghToken
+    });
+
+    console.log(attestation);
+}
+
+run();
+```
+
+The `attest` function supports the following options:
+
+```typescript
+export type AttestOptions = {
+  // The name of the subject to be attested.
+  subjectName: string
+  // The digest of the subject to be attested. Should be a map of digest
+  // algorithms to their hex-encoded values.
+  subjectDigest: Record<string, string>
+  // URI identifying the content type of the predicate being attested.
+  predicateType: string
+  // Predicate to be attested.
+  predicate: object
+  // GitHub token for writing attestations.
+  token: string
+  // Sigstore instance to use for signing. Must be one of "public-good" or
+  // "github".
+  sigstore?: 'public-good' | 'github'
+  // Whether to skip writing the attestation to the GH attestations API.
+  skipWrite?: boolean
+}
+```
+
+### `attestProvenance`
+
+The `attestProvenance` function accepts the name and digest of some artifact and
+generates a build provenance attestation over those values.
+
+The attestation is formed by first generating a [SLSA provenance
+predicate](https://slsa.dev/spec/v1.0/provenance) populated with
+[metadata](https://github.com/slsa-framework/github-actions-buildtypes/tree/main/workflow/v1)
+pulled from the GitHub Actions run.
+
+```js
+const { attestProvenance } = require('@actions/attest');
+const core = require('@actions/core');
+
+async function run() {
+    // In order to persist attestations to the repo, this should be a token with
+    // repository write permissions.
+    const ghToken = core.getInput('gh-token');
+
+    const attestation = await attestProvenance({
+        subjectName: 'my-artifact-name',
+        subjectDigest: { 'sha256': '36ab4667...'},
+        token: ghToken
+    });
+
+    console.log(attestation);
+}
+
+run();
+```
+
+The `attestProvenance` function supports the following options:
+
+```typescript
+export type AttestProvenanceOptions = {
+  // The name of the subject to be attested.
+  subjectName: string
+  // The digest of the subject to be attested. Should be a map of digest
+  // algorithms to their hex-encoded values.
+  subjectDigest: Record<string, string>
+  // GitHub token for writing attestations.
+  token: string
+  // Sigstore instance to use for signing. Must be one of "public-good" or
+  // "github".
+  sigstore?: 'public-good' | 'github'
+  // Whether to skip writing the attestation to the GH attestations API.
+  skipWrite?: boolean
+}
+```
+
+### `Attestation`
+
+The `Attestation` returned by `attest`/`attestProvenance` has the following
+fields:
+
+```typescript
+export type Attestation = {
+  /*
+   * JSON-serialized Sigstore bundle containing the provenance attestation,
+   * signature, signing certificate and witnessed timestamp.
+   */
+  bundle: SerializedBundle
+  /*
+   * PEM-encoded signing certificate used to sign the attestation.
+   */
+  certificate: string
+  /*
+   * ID of Rekor transparency log entry created for the attestation (if
+   * applicable).
+   */
+  tlogID?: string
+  /*
+   * ID of the persisted attestation (accessible via the GH API).
+   */
+  attestationID?: string
+}
+```
+
+For details about the Sigstore bundle format, see the [Bundle protobuf
+specification](https://github.com/sigstore/protobuf-specs/blob/main/protos/sigstore_bundle.proto).
+
+## Sigstore Instance
+
+When generating the signed attestation there are two different Sigstore
+instances which can be used to issue the signing certificate. By default,
+workflows initiated from public repositories will use the Sigstore public-good
+instance and persist the attestation signature to the public [Rekor transparency
+log](https://docs.sigstore.dev/logging/overview/). Workflows initiated from
+private/internal repositories will use the GitHub-internal Sigstore instance
+which uses a signed timestamp issued by GitHub's timestamp authority in place of
+the public transparency log.
+
+The default Sigstore instance selection can be overridden by passing an explicit
+value of either "public-good" or "github" for the `sigstore` option when calling
+either `attest` or `attestProvenance`.
+
+## Storage
+
+Attestations created by `attest`/`attestProvenance` will be uploaded to the GH
+attestations API and associated with the appropriate repository. Attestation
+storage is only supported for public repositories or repositories which belong
+to a GitHub Enterprise Cloud account.
+
+In order to generate attestations for private, non-Enterprise repositories, the
+`skipWrite` option should be set to `true`.
@@ -0,0 +1,5 @@
+# @actions/attest Releases
+
+### 1.0.0
+
+- Initial release
@@ -0,0 +1,19 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`buildIntotoStatement returns a provenance hydrated from env vars 1`] = `
+{
+  "_type": "https://in-toto.io/Statement/v1",
+  "predicate": {
+    "key": "value",
+  },
+  "predicateType": "predicatey",
+  "subject": [
+    {
+      "digest": {
+        "sha256": "7d070f6b64d9bcc530fe99cc21eaaa4b3c364e0b2d367d7735671fa202a03b32",
+      },
+      "name": "subjecty",
+    },
+  ],
+}
+`;
@@ -0,0 +1,42 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`buildSLSAProvenancePredicate returns a provenance hydrated from env vars 1`] = `
+{
+  "params": {
+    "buildDefinition": {
+      "buildType": "https://slsa-framework.github.io/github-actions-buildtypes/workflow/v1",
+      "externalParameters": {
+        "workflow": {
+          "path": ".github/workflows/main.yml",
+          "ref": "main",
+          "repository": "https://github.com/owner/repo",
+        },
+      },
+      "internalParameters": {
+        "github": {
+          "event_name": "push",
+          "repository_id": "repo-id",
+          "repository_owner_id": "owner-id",
+        },
+      },
+      "resolvedDependencies": [
+        {
+          "digest": {
+            "gitCommit": "babca52ab0c93ae16539e5923cb0d7403b9a093b",
+          },
+          "uri": "git+https://github.com/owner/repo@refs/heads/main",
+        },
+      ],
+    },
+    "runDetails": {
+      "builder": {
+        "id": "https://github.com/actions/runner/github-hosted",
+      },
+      "metadata": {
+        "invocationId": "https://github.com/owner/repo/actions/runs/run-id/attempts/run-attempt",
+      },
+    },
+  },
+  "type": "https://slsa.dev/provenance/v1",
+}
+`;
@@ -0,0 +1,6 @@
+import {attest, attestProvenance} from '../src'
+
+it('exports functions', () => {
+  expect(attestProvenance).toBeInstanceOf(Function)
+  expect(attest).toBeInstanceOf(Function)
+})
@@ -0,0 +1,23 @@
+import {buildIntotoStatement} from '../src/intoto'
+import type {Predicate, Subject} from '../src/shared.types'
+
+describe('buildIntotoStatement', () => {
+  const subject: Subject = {
+    name: 'subjecty',
+    digest: {
+      sha256: '7d070f6b64d9bcc530fe99cc21eaaa4b3c364e0b2d367d7735671fa202a03b32'
+    }
+  }
+
+  const predicate: Predicate = {
+    type: 'predicatey',
+    params: {
+      key: 'value'
+    }
+  }
+
+  it('returns a provenance hydrated from env vars', () => {
+    const statement = buildIntotoStatement(subject, predicate)
+    expect(statement).toMatchSnapshot()
+  })
+})
@@ -0,0 +1,213 @@
+import * as github from '@actions/github'
+import {mockFulcio, mockRekor, mockTSA} from '@sigstore/mock'
+import nock from 'nock'
+import {SIGSTORE_GITHUB, SIGSTORE_PUBLIC_GOOD} from '../src/endpoints'
+import {attestProvenance, buildSLSAProvenancePredicate} from '../src/provenance'
+
+// Dummy workflow environment
+const env = {
+  GITHUB_REPOSITORY: 'owner/repo',
+  GITHUB_REF: 'refs/heads/main',
+  GITHUB_SHA: 'babca52ab0c93ae16539e5923cb0d7403b9a093b',
+  GITHUB_WORKFLOW_REF: 'owner/repo/.github/workflows/main.yml@main',
+  GITHUB_SERVER_URL: 'https://github.com',
+  GITHUB_EVENT_NAME: 'push',
+  GITHUB_REPOSITORY_ID: 'repo-id',
+  GITHUB_REPOSITORY_OWNER_ID: 'owner-id',
+  GITHUB_RUN_ID: 'run-id',
+  GITHUB_RUN_ATTEMPT: 'run-attempt',
+  RUNNER_ENVIRONMENT: 'github-hosted'
+}
+
+describe('buildSLSAProvenancePredicate', () => {
+  it('returns a provenance hydrated from env vars', () => {
+    const predicate = buildSLSAProvenancePredicate(env)
+    expect(predicate).toMatchSnapshot()
+  })
+})
+
+describe('attestProvenance', () => {
+  // Capture original environment variables so we can restore them after each
+  // test
+  const originalEnv = process.env
+
+  // Subject to attest
+  const subjectName = 'subjective'
+  const subjectDigest = {
+    sha256: '7d070f6b64d9bcc530fe99cc21eaaa4b3c364e0b2d367d7735671fa202a03b32'
+  }
+
+  // Fake an OIDC token
+  const oidcPayload = {sub: 'foo@bar.com', iss: ''}
+  const oidcToken = `.${Buffer.from(JSON.stringify(oidcPayload)).toString(
+    'base64'
+  )}.}`
+
+  const tokenURL = 'https://token.url'
+  const attestationID = '1234567890'
+
+  beforeEach(async () => {
+    jest.clearAllMocks()
+
+    nock(tokenURL)
+      .get('/')
+      .query({audience: 'sigstore'})
+      .reply(200, {value: oidcToken})
+
+    // Set-up GHA environment variables
+    process.env = {
+      ...originalEnv,
+      ...env,
+      ACTIONS_ID_TOKEN_REQUEST_URL: tokenURL,
+      ACTIONS_ID_TOKEN_REQUEST_TOKEN: 'token'
+    }
+  })
+
+  afterEach(() => {
+    // Restore the original environment
+    process.env = originalEnv
+  })
+
+  describe('when using the github Sigstore instance', () => {
+    const {fulcioURL, tsaServerURL} = SIGSTORE_GITHUB
+
+    beforeEach(async () => {
+      // Mock Sigstore
+      await mockFulcio({baseURL: fulcioURL, strict: false})
+      await mockTSA({baseURL: tsaServerURL})
+
+      // Mock GH attestations API
+      nock('https://api.github.com')
+        .post(/^\/repos\/.*\/.*\/attestations$/)
+        .reply(201, {id: attestationID})
+    })
+
+    describe('when the sigstore instance is explicitly set', () => {
+      it('attests provenance', async () => {
+        const attestation = await attestProvenance({
+          subjectName,
+          subjectDigest,
+          token: 'token',
+          sigstore: 'github'
+        })
+
+        expect(attestation).toBeDefined()
+        expect(attestation.bundle).toBeDefined()
+        expect(attestation.certificate).toMatch(/-----BEGIN CERTIFICATE-----/)
+        expect(attestation.tlogID).toBeUndefined()
+        expect(attestation.attestationID).toBe(attestationID)
+      })
+    })
+
+    describe('when the sigstore instance is inferred from the repo visibility', () => {
+      const savedRepository = github.context.payload.repository
+
+      beforeEach(() => {
+        /* eslint-disable-next-line @typescript-eslint/no-explicit-any */
+        github.context.payload.repository = {visibility: 'private'} as any
+      })
+
+      afterEach(() => {
+        github.context.payload.repository = savedRepository
+      })
+
+      it('attests provenance', async () => {
+        const attestation = await attestProvenance({
+          subjectName,
+          subjectDigest,
+          token: 'token'
+        })
+
+        expect(attestation).toBeDefined()
+        expect(attestation.bundle).toBeDefined()
+        expect(attestation.certificate).toMatch(/-----BEGIN CERTIFICATE-----/)
+        expect(attestation.tlogID).toBeUndefined()
+        expect(attestation.attestationID).toBe(attestationID)
+      })
+    })
+  })
+
+  describe('when using the public-good Sigstore instance', () => {
+    const {fulcioURL, rekorURL} = SIGSTORE_PUBLIC_GOOD
+
+    beforeEach(async () => {
+      // Mock Sigstore
+      await mockFulcio({baseURL: fulcioURL, strict: false})
+      await mockRekor({baseURL: rekorURL})
+
+      // Mock GH attestations API
+      nock('https://api.github.com')
+        .post(/^\/repos\/.*\/.*\/attestations$/)
+        .reply(201, {id: attestationID})
+    })
+
+    describe('when the sigstore instance is explicitly set', () => {
+      it('attests provenance', async () => {
+        const attestation = await attestProvenance({
+          subjectName,
+          subjectDigest,
+          token: 'token',
+          sigstore: 'public-good'
+        })
+
+        expect(attestation).toBeDefined()
+        expect(attestation.bundle).toBeDefined()
+        expect(attestation.certificate).toMatch(/-----BEGIN CERTIFICATE-----/)
+        expect(attestation.tlogID).toBeDefined()
+        expect(attestation.attestationID).toBe(attestationID)
+      })
+    })
+
+    describe('when the sigstore instance is inferred from the repo visibility', () => {
+      const savedRepository = github.context.payload.repository
+
+      beforeEach(() => {
+        /* eslint-disable-next-line @typescript-eslint/no-explicit-any */
+        github.context.payload.repository = {visibility: 'public'} as any
+      })
+
+      afterEach(() => {
+        github.context.payload.repository = savedRepository
+      })
+
+      it('attests provenance', async () => {
+        const attestation = await attestProvenance({
+          subjectName,
+          subjectDigest,
+          token: 'token'
+        })
+
+        expect(attestation).toBeDefined()
+        expect(attestation.bundle).toBeDefined()
+        expect(attestation.certificate).toMatch(/-----BEGIN CERTIFICATE-----/)
+        expect(attestation.tlogID).toBeDefined()
+        expect(attestation.attestationID).toBe(attestationID)
+      })
+    })
+  })
+
+  describe('when skipWrite is set to true', () => {
+    const {fulcioURL, rekorURL} = SIGSTORE_PUBLIC_GOOD
+    beforeEach(async () => {
+      // Mock Sigstore
+      await mockFulcio({baseURL: fulcioURL, strict: false})
+      await mockRekor({baseURL: rekorURL})
+    })
+
+    it('attests provenance', async () => {
+      const attestation = await attestProvenance({
+        subjectName,
+        subjectDigest,
+        token: 'token',
+        sigstore: 'public-good',
+        skipWrite: true
+      })
+
+      expect(attestation).toBeDefined()
+      expect(attestation.bundle).toBeDefined()
+      expect(attestation.certificate).toMatch(/-----BEGIN CERTIFICATE-----/)
+      expect(attestation.tlogID).toBeDefined()
+      expect(attestation.attestationID).toBeUndefined()
+    })
+  })
+})
@@ -0,0 +1,105 @@
+import {mockFulcio, mockRekor, mockTSA} from '@sigstore/mock'
+import nock from 'nock'
+import {Payload, signPayload} from '../src/sign'
+
+describe('signProvenance', () => {
+  const originalEnv = process.env
+
+  // Fake an OIDC token
+  const subject = 'foo@bar.com'
+  const oidcPayload = {sub: subject, iss: ''}
+  const oidcToken = `.${Buffer.from(JSON.stringify(oidcPayload)).toString(
+    'base64'
+  )}.}`
+
+  // Dummy provenance to be signed
+  const provenance = {
+    _type: 'https://in-toto.io/Statement/v1',
+    subject: {
+      name: 'subjective',
+      digest: {
+        sha256:
+          '7d070f6b64d9bcc530fe99cc21eaaa4b3c364e0b2d367d7735671fa202a03b32'
+      }
+    }
+  }
+
+  const payload: Payload = {
+    body: Buffer.from(JSON.stringify(provenance)),
+    type: 'application/vnd.in-toto+json'
+  }
+
+  const fulcioURL = 'https://fulcio.url'
+  const rekorURL = 'https://rekor.url'
+  const tsaServerURL = 'https://tsa.url'
+
+  beforeEach(() => {
+    // Mock OIDC token endpoint
+    const tokenURL = 'https://token.url'
+
+    process.env = {
+      ...originalEnv,
+      ACTIONS_ID_TOKEN_REQUEST_URL: tokenURL,
+      ACTIONS_ID_TOKEN_REQUEST_TOKEN: 'token'
+    }
+
+    nock(tokenURL)
+      .get('/')
+      .query({audience: 'sigstore'})
+      .reply(200, {value: oidcToken})
+  })
+
+  afterEach(() => {
+    process.env = originalEnv
+  })
+
+  describe('when visibility is public', () => {
+    beforeEach(async () => {
+      await mockFulcio({baseURL: fulcioURL, strict: false})
+      await mockRekor({baseURL: rekorURL})
+    })
+
+    it('returns a bundle', async () => {
+      const att = await signPayload(payload, {fulcioURL, rekorURL})
+
+      expect(att).toBeDefined()
+      expect(att.mediaType).toEqual(
+        'application/vnd.dev.sigstore.bundle+json;version=0.2'
+      )
+
+      expect(att.content.$case).toEqual('dsseEnvelope')
+      expect(att.verificationMaterial.content.$case).toEqual(
+        'x509CertificateChain'
+      )
+      expect(att.verificationMaterial.tlogEntries).toHaveLength(1)
+      expect(
+        att.verificationMaterial.timestampVerificationData?.rfc3161Timestamps
+      ).toHaveLength(0)
+    })
+  })
+
+  describe('when visibility is private', () => {
+    beforeEach(async () => {
+      await mockFulcio({baseURL: fulcioURL, strict: false})
+      await mockTSA({baseURL: tsaServerURL})
+    })
+
+    it('returns a bundle', async () => {
+      const att = await signPayload(payload, {fulcioURL, tsaServerURL})
+
+      expect(att).toBeDefined()
+      expect(att.mediaType).toEqual(
+        'application/vnd.dev.sigstore.bundle+json;version=0.2'
+      )
+
+      expect(att.content.$case).toEqual('dsseEnvelope')
+      expect(att.verificationMaterial.content.$case).toEqual(
+        'x509CertificateChain'
+      )
+      expect(att.verificationMaterial.tlogEntries).toHaveLength(0)
+      expect(
+        att.verificationMaterial.timestampVerificationData?.rfc3161Timestamps
+      ).toHaveLength(1)
+    })
+  })
+})
@@ -0,0 +1,45 @@
+import nock from 'nock'
+import {writeAttestation} from '../src/store'
+
+describe('writeAttestation', () => {
+  const originalEnv = process.env
+  const attestation = {foo: 'bar '}
+  const token = 'token'
+
+  beforeEach(() => {
+    process.env = {
+      ...originalEnv,
+      GITHUB_REPOSITORY: 'foo/bar'
+    }
+  })
+
+  afterEach(() => {
+    process.env = originalEnv
+  })
+
+  describe('when the api call is successful', () => {
+    beforeEach(() => {
+      nock('https://api.github.com')
+        .matchHeader('authorization', `token ${token}`)
+        .post('/repos/foo/bar/attestations', {bundle: attestation})
+        .reply(201, {id: '123'})
+    })
+
+    it('persists the attestation', async () => {
+      await expect(writeAttestation(attestation, token)).resolves.toEqual('123')
+    })
+  })
+
+  describe('when the api call fails', () => {
+    beforeEach(() => {
+      nock('https://api.github.com')
+        .matchHeader('authorization', `token ${token}`)
+        .post('/repos/foo/bar/attestations', {bundle: attestation})
+        .reply(500, 'oops')
+    })
+
+    it('persists the attestation', async () => {
+      await expect(writeAttestation(attestation, token)).rejects.toThrow(/oops/)
+    })
+  })
+})
@@ -0,0 +1,49 @@
+{
+  "name": "@actions/attest",
+  "version": "1.0.0",
+  "description": "Actions attestation lib",
+  "keywords": [
+    "github",
+    "actions",
+    "attestation"
+  ],
+  "homepage": "https://github.com/actions/toolkit/tree/main/packages/attest",
+  "license": "MIT",
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "directories": {
+    "lib": "lib",
+    "test": "__tests__"
+  },
+  "files": [
+    "lib"
+  ],
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/actions/toolkit.git",
+    "directory": "packages/attest"
+  },
+  "scripts": {
+    "test": "echo \"Error: run tests from root\" && exit 1",
+    "tsc": "tsc"
+  },
+  "bugs": {
+    "url": "https://github.com/actions/toolkit/issues"
+  },
+  "devDependencies": {
+    "@sigstore/mock": "^0.6.5",
+    "@sigstore/rekor-types": "^2.0.0",
+    "@types/make-fetch-happen": "^10.0.4",
+    "nock": "^13.5.1"
+  },
+  "dependencies": {
+    "@actions/github": "^6.0.0",
+    "@sigstore/bundle": "^2.2.0",
+    "@sigstore/sign": "^2.2.3",
+    "make-fetch-happen": "^13.0.0"
+  }
+}
@@ -0,0 +1,96 @@
+import {Bundle, bundleToJSON} from '@sigstore/bundle'
+import {X509Certificate} from 'crypto'
+import {SigstoreInstance, signingEndpoints} from './endpoints'
+import {buildIntotoStatement} from './intoto'
+import {Payload, signPayload} from './sign'
+import {writeAttestation} from './store'
+
+import type {Attestation, Predicate, Subject} from './shared.types'
+
+const INTOTO_PAYLOAD_TYPE = 'application/vnd.in-toto+json'
+
+/**
+ * Options for attesting a subject / predicate.
+ */
+export type AttestOptions = {
+  // The name of the subject to be attested.
+  subjectName: string
+  // The digest of the subject to be attested. Should be a map of digest
+  // algorithms to their hex-encoded values.
+  subjectDigest: Record<string, string>
+  // Content type of the predicate being attested.
+  predicateType: string
+  // Predicate to be attested.
+  predicate: object
+  // GitHub token for writing attestations.
+  token: string
+  // Sigstore instance to use for signing. Must be one of "public-good" or
+  // "github".
+  sigstore?: SigstoreInstance
+  // Whether to skip writing the attestation to the GH attestations API.
+  skipWrite?: boolean
+}
+
+/**
+ * Generates an attestation for the given subject and predicate. The subject and
+ * predicate are combined into an in-toto statement, which is then signed using
+ * the identified Sigstore instance and stored as an attestation.
+ * @param options - The options for attestation.
+ * @returns A promise that resolves to the attestation.
+ */
+export async function attest(options: AttestOptions): Promise<Attestation> {
+  const subject: Subject = {
+    name: options.subjectName,
+    digest: options.subjectDigest
+  }
+  const predicate: Predicate = {
+    type: options.predicateType,
+    params: options.predicate
+  }
+  const statement = buildIntotoStatement(subject, predicate)
+
+  // Sign the provenance statement
+  const payload: Payload = {
+    body: Buffer.from(JSON.stringify(statement)),
+    type: INTOTO_PAYLOAD_TYPE
+  }
+  const endpoints = signingEndpoints(options.sigstore)
+  const bundle = await signPayload(payload, endpoints)
+
+  // Store the attestation
+  let attestationID: string | undefined
+  if (options.skipWrite !== true) {
+    attestationID = await writeAttestation(bundleToJSON(bundle), options.token)
+  }
+
+  return toAttestation(bundle, attestationID)
+}
+
+function toAttestation(bundle: Bundle, attestationID?: string): Attestation {
+  let certBytes: Buffer
+  switch (bundle.verificationMaterial.content.$case) {
+    case 'x509CertificateChain':
+      certBytes =
+        bundle.verificationMaterial.content.x509CertificateChain.certificates[0]
+          .rawBytes
+      break
+    case 'certificate':
+      certBytes = bundle.verificationMaterial.content.certificate.rawBytes
+      break
+    default:
+      throw new Error('Bundle must contain an x509 certificate')
+  }
+
+  const signingCert = new X509Certificate(certBytes)
+
+  // Collect transparency log ID if available
+  const tlogEntries = bundle.verificationMaterial.tlogEntries
+  const tlogID = tlogEntries.length > 0 ? tlogEntries[0].logIndex : undefined
+
+  return {
+    bundle: bundleToJSON(bundle),
+    certificate: signingCert.toString(),
+    tlogID,
+    attestationID
+  }
+}
@@ -0,0 +1,50 @@
+import * as github from '@actions/github'
+
+const PUBLIC_GOOD_ID = 'public-good'
+const GITHUB_ID = 'github'
+
+const FULCIO_PUBLIC_GOOD_URL = 'https://fulcio.sigstore.dev'
+const REKOR_PUBLIC_GOOD_URL = 'https://rekor.sigstore.dev'
+
+const FULCIO_INTERNAL_URL = 'https://fulcio.githubapp.com'
+const TSA_INTERNAL_URL = 'https://timestamp.githubapp.com'
+
+export type SigstoreInstance = typeof PUBLIC_GOOD_ID | typeof GITHUB_ID
+
+export type Endpoints = {
+  fulcioURL: string
+  rekorURL?: string
+  tsaServerURL?: string
+}
+
+export const SIGSTORE_PUBLIC_GOOD: Endpoints = {
+  fulcioURL: FULCIO_PUBLIC_GOOD_URL,
+  rekorURL: REKOR_PUBLIC_GOOD_URL
+}
+
+export const SIGSTORE_GITHUB: Endpoints = {
+  fulcioURL: FULCIO_INTERNAL_URL,
+  tsaServerURL: TSA_INTERNAL_URL
+}
+
+export const signingEndpoints = (sigstore?: SigstoreInstance): Endpoints => {
+  let instance: SigstoreInstance
+
+  // An explicitly set instance type takes precedence, but if not set, use the
+  // repository's visibility to determine the instance type.
+  if (sigstore && [PUBLIC_GOOD_ID, GITHUB_ID].includes(sigstore)) {
+    instance = sigstore
+  } else {
+    instance =
+      github.context.payload.repository?.visibility === 'public'
+        ? PUBLIC_GOOD_ID
+        : GITHUB_ID
+  }
+
+  switch (instance) {
+    case PUBLIC_GOOD_ID:
+      return SIGSTORE_PUBLIC_GOOD
+    case GITHUB_ID:
+      return SIGSTORE_GITHUB
+  }
+}
@@ -0,0 +1,9 @@
+export {AttestOptions, attest} from './attest'
+export {
+  AttestProvenanceOptions,
+  attestProvenance,
+  buildSLSAProvenancePredicate
+} from './provenance'
+
+export type {SerializedBundle} from '@sigstore/bundle'
+export type {Attestation, Predicate, Subject} from './shared.types'
@@ -0,0 +1,32 @@
+import {Predicate, Subject} from './shared.types'
+
+const INTOTO_STATEMENT_V1_TYPE = 'https://in-toto.io/Statement/v1'
+
+/**
+ * An in-toto statement.
+ * https://github.com/in-toto/attestation/blob/main/spec/v1/statement.md
+ */
+export type InTotoStatement = {
+  _type: string
+  subject: Subject[]
+  predicateType: string
+  predicate: object
+}
+
+/**
+ * Assembles the given subject and predicate into an in-toto statement.
+ * @param subject - The subject of the statement.
+ * @param predicate - The predicate of the statement.
+ * @returns The constructed in-toto statement.
+ */
+export const buildIntotoStatement = (
+  subject: Subject,
+  predicate: Predicate
+): InTotoStatement => {
+  return {
+    _type: INTOTO_STATEMENT_V1_TYPE,
+    subject: [subject],
+    predicateType: predicate.type,
+    predicate: predicate.params
+  }
+}
@@ -0,0 +1,93 @@
+import {attest, AttestOptions} from './attest'
+import type {Attestation, Predicate} from './shared.types'
+
+const SLSA_PREDICATE_V1_TYPE = 'https://slsa.dev/provenance/v1'
+
+const GITHUB_BUILDER_ID_PREFIX = 'https://github.com/actions/runner'
+const GITHUB_BUILD_TYPE =
+  'https://slsa-framework.github.io/github-actions-buildtypes/workflow/v1'
+
+export type AttestProvenanceOptions = Omit<
+  AttestOptions,
+  'predicate' | 'predicateType'
+>
+
+/**
+ * Builds an SLSA (Supply Chain Levels for Software Artifacts) provenance
+ * predicate using the GitHub Actions Workflow build type.
+ * https://slsa.dev/spec/v1.0/provenance
+ * https://github.com/slsa-framework/github-actions-buildtypes/tree/main/workflow/v1
+ * @param env - The Node.js process environment variables. Defaults to
+ * `process.env`.
+ * @returns The SLSA provenance predicate.
+ */
+export const buildSLSAProvenancePredicate = (
+  env: NodeJS.ProcessEnv = process.env
+): Predicate => {
+  const workflow = env.GITHUB_WORKFLOW_REF || ''
+
+  // Split just the path and ref from the workflow string.
+  // owner/repo/.github/workflows/main.yml@main =>
+  //   .github/workflows/main.yml, main
+  const [workflowPath, workflowRef] = workflow
+    .replace(`${env.GITHUB_REPOSITORY}/`, '')
+    .split('@')
+
+  return {
+    type: SLSA_PREDICATE_V1_TYPE,
+    params: {
+      buildDefinition: {
+        buildType: GITHUB_BUILD_TYPE,
+        externalParameters: {
+          workflow: {
+            ref: workflowRef,
+            repository: `${env.GITHUB_SERVER_URL}/${env.GITHUB_REPOSITORY}`,
+            path: workflowPath
+          }
+        },
+        internalParameters: {
+          github: {
+            event_name: env.GITHUB_EVENT_NAME,
+            repository_id: env.GITHUB_REPOSITORY_ID,
+            repository_owner_id: env.GITHUB_REPOSITORY_OWNER_ID
+          }
+        },
+        resolvedDependencies: [
+          {
+            uri: `git+${env.GITHUB_SERVER_URL}/${env.GITHUB_REPOSITORY}@${env.GITHUB_REF}`,
+            digest: {
+              gitCommit: env.GITHUB_SHA
+            }
+          }
+        ]
+      },
+      runDetails: {
+        builder: {
+          id: `${GITHUB_BUILDER_ID_PREFIX}/${env.RUNNER_ENVIRONMENT}`
+        },
+        metadata: {
+          invocationId: `${env.GITHUB_SERVER_URL}/${env.GITHUB_REPOSITORY}/actions/runs/${env.GITHUB_RUN_ID}/attempts/${env.GITHUB_RUN_ATTEMPT}`
+        }
+      }
+    }
+  }
+}
+
+/**
+ * Attests the build provenance of the provided subject. Generates the SLSA
+ * build provenance predicate, assembles it into an in-toto statement, and
+ * attests it.
+ *
+ * @param options - The options for attesting the provenance.
+ * @returns A promise that resolves to the attestation.
+ */
+export async function attestProvenance(
+  options: AttestProvenanceOptions
+): Promise<Attestation> {
+  const predicate = buildSLSAProvenancePredicate(process.env)
+  return attest({
+    ...options,
+    predicateType: predicate.type,
+    predicate: predicate.params
+  })
+}
@@ -0,0 +1,52 @@
+import type {SerializedBundle} from '@sigstore/bundle'
+
+/*
+ * The subject of an attestation.
+ */
+export type Subject = {
+  /*
+   * Name of the subject.
+   */
+  name: string
+  /*
+   * Digests of the subject. Should be a map of digest algorithms to their hex-encoded values.
+   */
+  digest: Record<string, string>
+}
+
+/*
+ * The predicate of an attestation.
+ */
+export type Predicate = {
+  /*
+   * URI identifying the content type of the predicate.
+   */
+  type: string
+  /*
+   * Predicate parameters.
+   */
+  params: object
+}
+
+/*
+ * Artifact attestation.
+ */
+export type Attestation = {
+  /*
+   * Serialized Sigstore bundle containing the provenance attestation,
+   * signature, signing certificate and witnessed timestamp.
+   */
+  bundle: SerializedBundle
+  /*
+   * PEM-encoded signing certificate used to sign the attestation.
+   */
+  certificate: string
+  /*
+   * ID of Rekor transparency log entry created for the attestation.
+   */
+  tlogID?: string
+  /*
+   * ID of the persisted attestation (accessible via the GH API).
+   */
+  attestationID?: string
+}
@@ -0,0 +1,107 @@
+import {Bundle} from '@sigstore/bundle'
+import {
+  BundleBuilder,
+  CIContextProvider,
+  DSSEBundleBuilder,
+  FulcioSigner,
+  RekorWitness,
+  TSAWitness,
+  Witness
+} from '@sigstore/sign'
+
+const OIDC_AUDIENCE = 'sigstore'
+const DEFAULT_TIMEOUT = 10000
+const DEFAULT_RETRIES = 3
+
+/**
+ * The payload to be signed (body) and its media type (type).
+ */
+export type Payload = {
+  body: Buffer
+  type: string
+}
+
+/**
+ * Options for signing a document.
+ */
+export type SignOptions = {
+  /**
+   * The URL of the Fulcio service.
+   */
+  fulcioURL: string
+  /**
+   * The URL of the Rekor service.
+   */
+  rekorURL?: string
+  /**
+   * The URL of the TSA (Time Stamping Authority) server.
+   */
+  tsaServerURL?: string
+  /**
+   * The timeout duration in milliseconds when communicating with Sigstore
+   * services.
+   */
+  timeout?: number
+  /**
+   * The number of retry attempts.
+   */
+  retry?: number
+}
+
+/**
+ * Signs the provided payload with a Sigstore-issued certificate and returns the
+ * signature bundle.
+ * @param payload Payload to be signed.
+ * @param options Signing options.
+ * @returns A promise that resolves to the Sigstore signature bundle.
+ */
+export const signPayload = async (
+  payload: Payload,
+  options: SignOptions
+): Promise<Bundle> => {
+  const artifact = {
+    data: payload.body,
+    type: payload.type
+  }
+
+  // Sign the artifact and build the bundle
+  return initBundleBuilder(options).create(artifact)
+}
+
+// Assembles the Sigstore bundle builder with the appropriate options
+const initBundleBuilder = (opts: SignOptions): BundleBuilder => {
+  const identityProvider = new CIContextProvider(OIDC_AUDIENCE)
+  const timeout = opts.timeout || DEFAULT_TIMEOUT
+  const retry = opts.retry || DEFAULT_RETRIES
+  const witnesses: Witness[] = []
+
+  const signer = new FulcioSigner({
+    identityProvider,
+    fulcioBaseURL: opts.fulcioURL,
+    timeout,
+    retry
+  })
+
+  if (opts.rekorURL) {
+    witnesses.push(
+      new RekorWitness({
+        rekorBaseURL: opts.rekorURL,
+        entryType: 'dsse',
+        timeout,
+        retry
+      })
+    )
+  }
+
+  if (opts.tsaServerURL) {
+    witnesses.push(
+      new TSAWitness({
+        tsaBaseURL: opts.tsaServerURL,
+        timeout,
+        retry
+      })
+    )
+  }
+
+  return new DSSEBundleBuilder({signer, witnesses})
+}
@@ -0,0 +1,31 @@
+import * as github from '@actions/github'
+import fetch from 'make-fetch-happen'
+
+const CREATE_ATTESTATION_REQUEST = 'POST /repos/{owner}/{repo}/attestations'
+
+/**
+ * Writes an attestation to the repository's attestations endpoint.
+ * @param attestation - The attestation to write.
+ * @param token - The GitHub token for authentication.
+ * @returns The ID of the attestation.
+ * @throws Error if the attestation fails to persist.
+ */
+export const writeAttestation = async (
+  attestation: unknown,
+  token: string
+): Promise<string> => {
+  const octokit = github.getOctokit(token, {request: {fetch}})
+
+  try {
+    const response = await octokit.request(CREATE_ATTESTATION_REQUEST, {
+      owner: github.context.repo.owner,
+      repo: github.context.repo.repo,
+      data: {bundle: attestation}
+    })
+
+    return response.data?.id
+  } catch (err) {
+    const message = err instanceof Error ? err.message : err
+    throw new Error(`Failed to persist attestation: ${message}`)
+  }
+}
@@ -0,0 +1,12 @@
+{
+  "extends": "../../tsconfig.json",
+  "compilerOptions": {
+    "baseUrl": "./",
+    "outDir": "./lib",
+    "declaration": true,
+    "rootDir": "./src"
+  },
+  "include": [
+    "./src"
+  ]
+}
@@ -1,16 +1,154 @@
 # @actions/cache Releases

-### 0.1.0
+### 3.2.4

- Initial release
+- Updated `isGhes` check to include `.ghe.com` and `.ghe.localhost` as accepted hosts
+  
+### 3.2.3

-### 0.2.0
+- Fixed a bug that mutated path arguments to `getCacheVersion` [#1378](https://github.com/actions/toolkit/pull/1378)

- Fixes issues with the zstd compression algorithm on Windows and Ubuntu 16.04 [#469](https://github.com/actions/toolkit/pull/469)
+### 3.2.2

-### 0.2.1
+- Add new default cache download method to improve performance and reduce hangs [#1484](https://github.com/actions/toolkit/pull/1484)

- Fix to await async function getCompressionMethod
+### 3.2.1
+
+- Updated @azure/storage-blob to `v12.13.0`
+
+### 3.2.0
+
+- Add `lookupOnly` to cache restore `DownloadOptions`.
+
+### 3.1.4
+
+- Fix zstd not being used due to `zstd --version` output change in zstd 1.5.4 release. See [#1353](https://github.com/actions/toolkit/pull/1353).
+
+### 3.1.3
+
+- Fix to prevent from setting MYSYS environement variable globally [#1329](https://github.com/actions/toolkit/pull/1329).
+
+### 3.1.2
+
+- Fix issue with symlink restoration on windows.
+
+### 3.1.1
+
+- Reverted changes in 3.1.0 to fix issue with symlink restoration on windows.
+- Added support for verbose logging about cache version during cache miss.
+
+### 3.1.0
+
+- Update actions/cache on windows to use gnu tar and zstd by default
+- Update actions/cache on windows to fallback to bsdtar and zstd if gnu tar is not available.
+- Added support for fallback to gzip to restore old caches on windows.
+
+### 3.1.0-beta.3
+
+- Bug Fixes for fallback to gzip to restore old caches on windows and bsdtar if gnutar is not available.
+
+### 3.1.0-beta.2
+
+- Added support for fallback to gzip to restore old caches on windows.
+
+### 3.0.6
+
+- Added `@azure/abort-controller` to dependencies to fix compatibility issue with ESM [#1208](https://github.com/actions/toolkit/issues/1208)
+
+### 3.0.5
+
+- Update `@actions/cache` to use `@actions/core@^1.10.0`
+
+### 3.0.4
+
+- Fix zstd not working for windows on gnu tar in issues [#888](https://github.com/actions/cache/issues/888) and [#891](https://github.com/actions/cache/issues/891).
+- Allowing users to provide a custom timeout as input for aborting download of a cache segment using an environment variable `SEGMENT_DOWNLOAD_TIMEOUT_MINS`. Default is 60 minutes.
+
+### 3.0.3
+
+- Bug fixes for download stuck issue [#810](https://github.com/actions/cache/issues/810).
+
+### 3.0.2
+
+- Added 1 hour timeout for the download stuck issue [#810](https://github.com/actions/cache/issues/810).
+
+### 3.0.1
+
+- Fix [#833](https://github.com/actions/cache/issues/833) - cache doesn't work with github workspace directory.
+- Fix [#809](https://github.com/actions/cache/issues/809) `zstd -d: no such file or directory` error on AWS self-hosted runners.
+
+### 3.0.0
+
+- Updated actions/cache to suppress Actions cache server error and log warning for those error  [#1122](https://github.com/actions/toolkit/pull/1122)
+
+### 2.0.6
+
+- Fix `Tar failed with error: The process '/usr/bin/tar' failed with exit code 1` issue when temp directory where tar is getting created is actually the subdirectory of the path mentioned by the user for caching. ([issue](https://github.com/actions/cache/issues/689))
+
+### 2.0.5
+
+- Fix to avoid saving empty cache when no files are available for caching. ([issue](https://github.com/actions/cache/issues/624))
+
+### 2.0.4
+
+- Update to v2.0.1 of `@actions/http-client` [#1087](https://github.com/actions/toolkit/pull/1087)
+
+### 2.0.3
+
+- Update to v2.0.0 of `@actions/http-client`
+
+### 2.0.0
+
+- Added support to check if Actions cache service feature is available or not [#1028](https://github.com/actions/toolkit/pull/1028)
+
+### 1.0.11
+
+- Fix file downloads > 2GB([issue](https://github.com/actions/cache/issues/773))
+
+### 1.0.10
+
+- Update `lockfileVersion` to `v2` in `package-lock.json [#1022](https://github.com/actions/toolkit/pull/1022)
+
+### 1.0.9
+
+- Use @azure/ms-rest-js v2.6.0
+- Use @azure/storage-blob v12.8.0
+
+### 1.0.8
+
+- Increase the allowed artifact cache size from 5GB to 10GB ([issue](https://github.com/actions/cache/discussions/497))
+
+### 1.0.7
+
+- Fixes permissions issue extracting archives with GNU tar on macOS ([issue](https://github.com/actions/cache/issues/527))
+
+### 1.0.6
+
+- Make caching more verbose [#650](https://github.com/actions/toolkit/pull/650)
+- Use GNU tar on macOS if available [#701](https://github.com/actions/toolkit/pull/701)
+
+### 1.0.5
+
+- Fix to ensure Windows cache paths get resolved correctly
+
+### 1.0.4
+
+- Use @actions/core v1.2.6
+- Fixes uploadChunk to throw an error if any unsuccessful response code is received
+
+### 1.0.3
+
+- Use http-client v1.0.9
+- Fixes error handling so retries are not attempted on non-retryable errors (409 Conflict, for example)
+- Adds 5 second delay between retry attempts
+
+### 1.0.2
+
+- Use posix archive format to add support for some tools
+
+### 1.0.1
+
+- Fix bug in downloading large files (> 2 GBs) with the Azure SDK

 ### 1.0.0

@@ -19,148 +157,14 @@
 - Includes changes that break compatibility with earlier versions, including:
  - `retry`, `retryTypedResponse`, and `retryHttpClientResponse` moved from `cacheHttpClient` to `requestUtils`

-### 1.0.1
+### 0.2.1

- Fix bug in downloading large files (> 2 GBs) with the Azure SDK
+- Fix to await async function getCompressionMethod
+  
+### 0.2.0

-### 1.0.2
+- Fixes issues with the zstd compression algorithm on Windows and Ubuntu 16.04 [#469](https://github.com/actions/toolkit/pull/469)
+  
+### 0.1.0

- Use posix archive format to add support for some tools
-
-### 1.0.3
-
- Use http-client v1.0.9
- Fixes error handling so retries are not attempted on non-retryable errors (409 Conflict, for example)
- Adds 5 second delay between retry attempts
-
-### 1.0.4
-
- Use @actions/core v1.2.6
- Fixes uploadChunk to throw an error if any unsuccessful response code is received
-
-### 1.0.5
-
- Fix to ensure Windows cache paths get resolved correctly
-
-### 1.0.6
-
- Make caching more verbose [#650](https://github.com/actions/toolkit/pull/650)
- Use GNU tar on macOS if available [#701](https://github.com/actions/toolkit/pull/701)
-
-### 1.0.7
-
- Fixes permissions issue extracting archives with GNU tar on macOS ([issue](https://github.com/actions/cache/issues/527))
-
-### 1.0.8
-
- Increase the allowed artifact cache size from 5GB to 10GB ([issue](https://github.com/actions/cache/discussions/497))
-
-### 1.0.9
-
- Use @azure/ms-rest-js v2.6.0
- Use @azure/storage-blob v12.8.0
-
-### 1.0.10
-
- Update `lockfileVersion` to `v2` in `package-lock.json [#1022](https://github.com/actions/toolkit/pull/1022)
-
-### 1.0.11
-
- Fix file downloads > 2GB([issue](https://github.com/actions/cache/issues/773))
-
-### 2.0.0
-
- Added support to check if Actions cache service feature is available or not [#1028](https://github.com/actions/toolkit/pull/1028)
-
-### 2.0.3
-
- Update to v2.0.0 of `@actions/http-client`
-
-### 2.0.4
-
- Update to v2.0.1 of `@actions/http-client` [#1087](https://github.com/actions/toolkit/pull/1087)
-
-### 2.0.5
-
- Fix to avoid saving empty cache when no files are available for caching. ([issue](https://github.com/actions/cache/issues/624))
-
-### 2.0.6
-
- Fix `Tar failed with error: The process '/usr/bin/tar' failed with exit code 1` issue when temp directory where tar is getting created is actually the subdirectory of the path mentioned by the user for caching. ([issue](https://github.com/actions/cache/issues/689))
-
-### 3.0.0
-
- Updated actions/cache to suppress Actions cache server error and log warning for those error  [#1122](https://github.com/actions/toolkit/pull/1122)
-
-### 3.0.1
-
- Fix [#833](https://github.com/actions/cache/issues/833) - cache doesn't work with github workspace directory.
- Fix [#809](https://github.com/actions/cache/issues/809) `zstd -d: no such file or directory` error on AWS self-hosted runners.
-
-### 3.0.2
-
- Added 1 hour timeout for the download stuck issue [#810](https://github.com/actions/cache/issues/810).
-
-### 3.0.3
-
- Bug fixes for download stuck issue [#810](https://github.com/actions/cache/issues/810).
-
-### 3.0.4
-
- Fix zstd not working for windows on gnu tar in issues [#888](https://github.com/actions/cache/issues/888) and [#891](https://github.com/actions/cache/issues/891).
- Allowing users to provide a custom timeout as input for aborting download of a cache segment using an environment variable `SEGMENT_DOWNLOAD_TIMEOUT_MINS`. Default is 60 minutes.
-
-### 3.0.5
-
- Update `@actions/cache` to use `@actions/core@^1.10.0`
-
-### 3.0.6
-
- Added `@azure/abort-controller` to dependencies to fix compatibility issue with ESM [#1208](https://github.com/actions/toolkit/issues/1208)
-
-### 3.1.0-beta.1
-
- Update actions/cache on windows to use gnu tar and zstd by default and fallback to bsdtar and zstd if gnu tar is not available. ([issue](https://github.com/actions/cache/issues/984))
-
-### 3.1.0-beta.2
-
- Added support for fallback to gzip to restore old caches on windows.
-
-### 3.1.0-beta.3
-
- Bug Fixes for fallback to gzip to restore old caches on windows and bsdtar if gnutar is not available.
-
-### 3.1.0
-
- Update actions/cache on windows to use gnu tar and zstd by default
- Update actions/cache on windows to fallback to bsdtar and zstd if gnu tar is not available.
- Added support for fallback to gzip to restore old caches on windows.
-
-### 3.1.1
-
- Reverted changes in 3.1.0 to fix issue with symlink restoration on windows.
- Added support for verbose logging about cache version during cache miss.
-
-### 3.1.2
-
- Fix issue with symlink restoration on windows.
-
-### 3.1.3
-
- Fix to prevent from setting MYSYS environement variable globally [#1329](https://github.com/actions/toolkit/pull/1329).
-
-### 3.1.4
-
- Fix zstd not being used due to `zstd --version` output change in zstd 1.5.4 release. See [#1353](https://github.com/actions/toolkit/pull/1353).
-
-### 3.2.0
-
- Add `lookupOnly` to cache restore `DownloadOptions`.
-
-### 3.2.1
-
- Updated @azure/storage-blob to `v12.13.0`
-
-### 3.2.2
-
- Add new default cache download method to improve performance and reduce hangs [#1484](https://github.com/actions/toolkit/pull/1484)
+- Initial release
@@ -2,6 +2,10 @@ import {promises as fs} from 'fs'
 import * as path from 'path'
 import * as cacheUtils from '../src/internal/cacheUtils'

+beforeEach(() => {
+  jest.resetModules()
+})
+
 test('getArchiveFileSizeInBytes returns file size', () => {
  const filePath = path.join(__dirname, '__fixtures__', 'helloWorld.txt')

@@ -38,3 +42,23 @@ test('resolvePaths works on github workspace directory', async () => {
  const paths = await cacheUtils.resolvePaths([workspace])
  expect(paths.length).toBeGreaterThan(0)
 })
+
+test('isGhes returns false for github.com', async () => {
+  process.env.GITHUB_SERVER_URL = 'https://github.com'
+  expect(cacheUtils.isGhes()).toBe(false)
+})
+
+test('isGhes returns false for ghe.com', async () => {
+  process.env.GITHUB_SERVER_URL = 'https://somedomain.ghe.com'
+  expect(cacheUtils.isGhes()).toBe(false)
+})
+
+test('isGhes returns true for enterprise URL', async () => {
+  process.env.GITHUB_SERVER_URL = 'https://my-enterprise.github.com'
+  expect(cacheUtils.isGhes()).toBe(true)
+})
+
+test('isGhes returns false for ghe.localhost', () => {
+  process.env.GITHUB_SERVER_URL = 'https://my.domain.ghe.localhost'
+  expect(cacheUtils.isGhes()).toBe(false)
+})
@@ -1,12 +1,12 @@
 {
  "name": "@actions/cache",
-  "version": "3.2.2",
+  "version": "3.2.4",
  "lockfileVersion": 2,
  "requires": true,
  "packages": {
    "": {
      "name": "@actions/cache",
-      "version": "3.2.2",
+      "version": "3.2.4",
      "license": "MIT",
      "dependencies": {
        "@actions/core": "^1.10.0",
@@ -1,6 +1,6 @@
 {
  "name": "@actions/cache",
-  "version": "3.2.2",
+  "version": "3.2.4",
  "preview": true,
  "description": "Actions cache lib",
  "keywords": [
@@ -80,7 +80,8 @@ export function getCacheVersion(
  compressionMethod?: CompressionMethod,
  enableCrossOsArchive = false
 ): string {
-  const components = paths
+  // don't pass changes upstream
+  const components = paths.slice()

  // Add compression method to cache version to restore
  // compressed cache as per compression method
@@ -135,5 +135,11 @@ export function isGhes(): boolean {
  const ghUrl = new URL(
    process.env['GITHUB_SERVER_URL'] || 'https://github.com'
  )
-  return ghUrl.hostname.toUpperCase() !== 'GITHUB.COM'
+
+  const hostname = ghUrl.hostname.trimEnd().toUpperCase()
+  const isGitHubHost = hostname === 'GITHUB.COM'
+  const isGheHost =
+    hostname.endsWith('.GHE.COM') || hostname.endsWith('.GHE.LOCALHOST')
+
+  return !isGitHubHost && !isGheHost
 }
@@ -11,6 +11,12 @@ describe('basics', () => {
    _http.dispose()
  })

+  it.each([true, false])('creates Agent with keepAlive %s', keepAlive => {
+    const http = new httpm.HttpClient('http-client-tests', [], {keepAlive})
+    const agent = http.getAgent('http://postman-echo.com')
+    expect(agent).toHaveProperty('keepAlive', keepAlive)
+  })
+
  it('does basic http get request with keepAlive true', async () => {
    const res: httpm.HttpClientResponse = await _http.get(
      'http://postman-echo.com/get'
@@ -1,6 +1,6 @@
 {
  "name": "@actions/http-client",
-  "version": "2.2.0",
+  "version": "2.2.1",
  "lockfileVersion": 2,
  "requires": true,
  "packages": {
@@ -1,6 +1,6 @@
 {
  "name": "@actions/http-client",
-  "version": "2.2.0",
+  "version": "2.2.1",
  "description": "Actions Http Client",
  "keywords": [
    "github",
@@ -48,4 +48,4 @@
    "tunnel": "^0.0.6",
    "undici": "^5.25.4"
  }
-}
+}
@@ -649,7 +649,7 @@ export class HttpClient {
      agent = this._proxyAgent
    }

-    if (this._keepAlive && !useProxy) {
+    if (!useProxy) {
      agent = this._agent
    }

@@ -690,18 +690,13 @@ export class HttpClient {
      this._proxyAgent = agent
    }

-    // if reusing agent across request and tunneling agent isn't assigned create a new agent
-    if (this._keepAlive && !agent) {
+    // if tunneling agent isn't assigned create a new agent
+    if (!agent) {
      const options = {keepAlive: this._keepAlive, maxSockets}
      agent = usingSsl ? new https.Agent(options) : new http.Agent(options)
      this._agent = agent
    }

-    // if not using private agent and tunnel agent isn't setup then use global agent
-    if (!agent) {
-      agent = usingSsl ? https.globalAgent : http.globalAgent
-    }
-
    if (usingSsl && this._ignoreSslError) {
      // we don't want to set NODE_TLS_REJECT_UNAUTHORIZED=0 since that will affect request for entire process
      // http.RequestOptions doesn't expose a way to modify RequestOptions.agent.options
Author	SHA1	Message	Date
Luke Tomlinson	352aff7976	Update http-client to 2.2.1	2024-03-01 15:02:07 -05:00
Bethany	55c7a1e03d	Merge pull request #1678 from actions/bethanyj28/logging Add info level logging for zip extract	2024-03-01 13:09:41 -05:00
bethanyj28	4799020e28	bump version	2024-03-01 13:04:16 -05:00
bethanyj28	bb420e4681	add info level logging for zip extract	2024-03-01 12:54:40 -05:00
Bethany	0c735ba79d	Merge pull request #1677 from actions/bethanyj28/update-releases Flip releases update order	2024-02-29 12:01:04 -05:00
Bethany	e918bf24ae	Update RELEASES.md	2024-02-29 10:41:57 -05:00
Bethany	eea6b7f517	Update RELEASES.md	2024-02-29 10:40:22 -05:00
teatimeguest	ff435e591d	Make sure RequestOptions.keepAlive is applied properly on node20 runtime (#1572 )	2024-02-28 12:10:57 -05:00
Bethany	df3315bbea	Merge pull request #1676 from actions/bethanyj28/flip-releases Flip releases order	2024-02-28 10:46:45 -05:00
Bethany	b7770574c2	flip releases order	2024-02-28 10:35:01 -05:00
Brian DeHamer	29bf378d97	Merge pull request #1675 from actions/provenance-permissions fix permissions for release workflow	2024-02-26 11:40:12 -08:00
Brian DeHamer	68b042febd	fix permissions for release workflow Signed-off-by: Brian DeHamer <bdehamer@github.com>	2024-02-26 11:32:45 -08:00
Brian DeHamer	c366a07d62	Merge pull request #1672 from actions/attest-v1.0.0 bump @actions/attest to 1.0.0	2024-02-26 11:13:48 -08:00
Brian DeHamer	9e5eb95517	Merge pull request #1674 from actions/npm-provenance publish npm packages with build provenance	2024-02-26 11:13:32 -08:00
Brian DeHamer	7f96bd610d	publish npm packages with build provenance Signed-off-by: Brian DeHamer <bdehamer@github.com>	2024-02-26 10:42:33 -08:00
Thomas Boop	8f53a1d37f	Update CODEOWNERS (#1673 )	2024-02-26 13:31:23 -05:00
Brian DeHamer	37a562b194	bump @actions/attest to 1.0.0 Signed-off-by: Brian DeHamer <bdehamer@github.com>	2024-02-26 10:21:47 -08:00
Brian DeHamer	ad1f156c7c	Merge pull request #1667 from actions/bdehamer/attest add new @actions/attest package	2024-02-26 10:15:14 -08:00
Brian DeHamer	6079dea4c4	add new @actions/attest package Signed-off-by: Brian DeHamer <bdehamer@github.com>	2024-02-26 08:52:20 -08:00
Bethany	437f2be56d	Merge pull request #1671 from actions/bethanyj28/update-version Update artifacts to 2.1.3	2024-02-26 10:24:29 -05:00
bethanyj28	97c606b612	update to 2.1.3	2024-02-26 10:18:02 -05:00
Bethany	5a7faf0eb5	Merge pull request #1670 from actions/bethanyj28/fix-callback Ensure callback is only called once	2024-02-26 10:04:37 -05:00
bethanyj28	dcc55dfd04	feedback	2024-02-26 09:56:00 -05:00
bethanyj28	902046e4d8	ensure callback is only called once	2024-02-26 09:36:35 -05:00
Bethany	88f7a7bc65	Merge pull request #1666 from actions/bethanyj28/download-path Use `unzip.Parse` over `unzip.Extract`	2024-02-23 16:22:24 -05:00
bethanyj28	6cf4fbcef8	add a comment	2024-02-23 15:33:24 -05:00
bethanyj28	7fa864a4f4	go back to normalize)	2024-02-23 15:28:25 -05:00
Bethany	f77cbc9ef7	Update packages/artifact/src/internal/download/download-artifact.ts Co-authored-by: Tingluo Huang <tingluohuang@github.com>	2024-02-23 15:20:01 -05:00
bethanyj28	8a1800c5da	use resolve instead of normalize	2024-02-23 15:15:17 -05:00
bethanyj28	90894a8853	bump version	2024-02-23 15:03:09 -05:00
bethanyj28	614f27a4fb	use stream transform	2024-02-23 14:34:39 -05:00
bethanyj28	ac84a9bee3	re-add noop logs and format + lint	2024-02-23 13:46:22 -05:00
bethanyj28	4256ea99c5	update test case and handling	2024-02-23 13:41:40 -05:00
bethanyj28	76489f433b	attempt with comparing index	2024-02-23 11:59:36 -05:00
bethanyj28	e9005f7727	ensure no path traversal	2024-02-23 10:54:12 -05:00
bethanyj28	8d03fb4787	prettier	2024-02-23 08:46:56 -05:00
bethanyj28	d3301c9bc2	update path parsing	2024-02-23 08:42:23 -05:00
bethanyj28	1e326de474	use existing function	2024-02-23 08:28:37 -05:00
bethanyj28	83731e6528	remove awaits from on entry	2024-02-22 22:06:32 -05:00
bethanyj28	a24b9c0184	handle directories	2024-02-22 21:54:54 -05:00
bethanyj28	31c555afda	prettier	2024-02-22 20:31:49 -05:00
bethanyj28	9dea373bba	wait for upload to finish	2024-02-22 20:29:42 -05:00
bethanyj28	b956d8a4dd	audit, lint, format	2024-02-22 17:55:53 -05:00
bethanyj28	81d5e48db0	update tests	2024-02-22 17:51:15 -05:00
bethanyj28	bc5b3a85ae	use on entry	2024-02-22 17:16:32 -05:00
Konrad Pabjan	415c42d27c	Update workflows to use v4 actions (#1652 ) * Update releases.yml to use v4 actions * Bump all workflows	2024-02-01 12:50:47 -05:00
eggyhead	e6c1cd0d8c	Merge pull request #1651 from actions/eggyhead/update-ghescheck-cache-v3.2.4 updating cache version and release to include ghes check change	2024-02-01 09:21:58 -08:00
eggyhead	39621898ff	Merge pull request #1650 from actions/eggyhead/update-ghescheck-artifacts-v2.1.1 updating artifact version and release to include ghes check change	2024-02-01 08:43:20 -08:00
eggyhead	c500de6dea	updating cache version and release to include ghes check change Revert "updating cache version and release to include ghes check change" This reverts commit 7185d8964514361b7b8dcdba1f9dd54ef24b8bdd. updating cache version and release to include ghes check change	2024-01-31 21:23:20 +00:00
eggyhead	c4f4f5ae07	updating artifact version and release to include ghes check change	2024-01-31 21:15:11 +00:00
eggyhead	f1d9b4b985	Merge pull request #1648 from actions/eggyhead/ghescheck-updatehosts Update GHES host check	2024-01-31 10:33:31 -08:00
eggyhead	d134334a38	lint fixes	2024-01-31 16:51:04 +00:00
eggyhead	3b02a6fdc5	updating alowed hosts in isGhes check updating alowed hosts in artifact ghes check using dot prepend ghe host	2024-01-31 16:30:37 +00:00
eggyhead	1fe633e27c	Merge pull request #1627 from actions/eggyhead/hyperlinks-faq adding hyperlinks for new section of artifacts faq	2024-01-19 08:40:40 -08:00
eggyhead	74bca717aa	Update packages/artifact/docs/faq.md Consistent spacing in version table Co-authored-by: Bethany <bethanyj28@users.noreply.github.com>	2024-01-19 08:37:38 -08:00
eggyhead	bb4505e078	yaml formatting	2024-01-18 17:36:26 +00:00
eggyhead	dbfca0275d	removing numbered list	2024-01-18 17:35:08 +00:00
eggyhead	d01372220d	bold text	2024-01-18 17:33:39 +00:00
eggyhead	8e13afa0db	updating language and adding compatibility table	2024-01-18 17:32:19 +00:00
Rob Herley	4e3b068ce1	Merge pull request #1629 from actions/robherley/update-docs-2.1.0 v2.1.0 Generate docs + update release notes	2024-01-18 11:25:50 -05:00
Rob Herley	017d757dd4	update releases.md	2024-01-18 11:07:25 -05:00
eggyhead	5212cb5ed9	Merge pull request #1628 from actions/eggyhead/update-getartifact-errmessage updating artifact not found error message	2024-01-18 08:02:52 -08:00
eggyhead	cca96584eb	removing newline and camelcasing GitHub	2024-01-18 15:57:21 +00:00
Rob Herley	58c2878fce	generate docs + update releases	2024-01-18 09:51:01 -05:00
Rob Herley	daf23ba955	Merge pull request #1626 from actions/robherley/delete-artifacts Add methods to delete artifacts	2024-01-18 09:46:52 -05:00
eggyhead	5016db01fe	update message for internal method	2024-01-18 04:14:39 +00:00
eggyhead	30942cc4ae	updating artifact not found error message to include more information and link to FAQ	2024-01-18 04:10:35 +00:00
eggyhead	98f72c3040	adding hyperlinks for new section of artifacts faq	2024-01-18 04:03:48 +00:00
eggyhead	64c0992283	adding version compatibility and retention to artifacts FAQ	2024-01-18 03:58:06 +00:00
Rob Herley	1852eb2115	more delete examples	2024-01-17 18:58:58 -05:00
Rob Herley	abe0bd98df	delete example	2024-01-17 18:21:25 -05:00
Rob Herley	2ad687a32e	add integration test for delete	2024-01-17 17:54:10 -05:00
Rob Herley	2f5fb3f92b	list for correct backend ids in internal delete	2024-01-17 17:53:49 -05:00
Rob Herley	7fd71a5e13	fix typo	2024-01-17 16:56:34 -05:00
Rob Herley	b62d4c91b6	add public and internal methods to delete artifacts	2024-01-17 16:18:49 -05:00
Rob Herley	1b5a6e26f4	Merge pull request #1623 from actions/robherley/update-cache-release Updates release notes for @actions/cache v3.2.3	2024-01-10 17:40:55 -05:00
Rob Herley	7c27528ab4	Update RELEASES.md Updates release notes for @actions/cache v3.2.3	2024-01-10 17:32:52 -05:00
Rob Herley	82e8bc69b8	Merge pull request #1622 from actions/robherley/bump-cache-version Update cache npm package version	2024-01-10 17:29:16 -05:00
Rob Herley	b9079670eb	Update cache npm package version	2024-01-10 17:05:13 -05:00
Rob Herley	cab491a426	Merge pull request #1378 from MSP-Greg/00-cache-paths-dup cache - getCacheVersion - dup paths array	2024-01-10 17:01:51 -05:00
Vallie Joseph	0389dcd5e4	updating release notes (#1620 )	2024-01-10 10:43:38 -05:00
MSP-Greg	0747ab3577	cache - getCacheVersion - dup paths array	2023-03-20 18:29:46 -05:00