From e8c242695d65487b9182a14c1b74f18371c09e9f Mon Sep 17 00:00:00 2001 From: Meredith Lancaster Date: Mon, 8 Dec 2025 10:49:24 -0800 Subject: [PATCH 01/32] add function for creating storage record Signed-off-by: Meredith Lancaster --- packages/attest/src/artifact-metadata.ts | 48 ++++++++++++++++++++++++ 1 file changed, 48 insertions(+) create mode 100644 packages/attest/src/artifact-metadata.ts diff --git a/packages/attest/src/artifact-metadata.ts b/packages/attest/src/artifact-metadata.ts new file mode 100644 index 00000000..6aa11a96 --- /dev/null +++ b/packages/attest/src/artifact-metadata.ts @@ -0,0 +1,48 @@ +import * as github from '@actions/github' +import {retry} from '@octokit/plugin-retry' +import {RequestHeaders} from '@octokit/types' + +const CREATE_STORAGE_RECORD_REQUEST = 'POST /orgs/{owner}/artifacts/metadata/storage-record' +const DEFAULT_RETRY_COUNT = 5 + +export type WriteOptions = { + retry?: number + headers?: RequestHeaders +} + +/** + * Writes a storage record on behalf of an artifact + * @param artifactName - The name of the artifact. + * @param artifactDigest - The digest of the artifact. + * @param token - The GitHub token for authentication. + * @returns The ID of the storage record. + * @throws Error if the storage record fails to persist. + */ +export const createStorageRecord = async ( + artifactName: string, + artifactDigest: string, + token: string, + options: WriteOptions = {} +): Promise => { + const retries = options.retry ?? DEFAULT_RETRY_COUNT + const octokit = github.getOctokit(token, {retry: {retries}}, retry) + + try { + const response = await octokit.request(CREATE_STORAGE_RECORD_REQUEST, { + owner: github.context.repo.owner, + repo: github.context.repo.repo, + headers: options.headers, + artifact_name: artifactName, + artifact_digest: artifactDigest, + }) + + const data = + typeof response.data == 'string' + ? JSON.parse(response.data) + : response.data + return data?.id + } catch (err) { + const message = err instanceof Error ? err.message : err + throw new Error(`Failed to persist storage record: ${message}`) + } +} From 79efd648ac1bd41fee581d6d01cf8ed8c1aceb14 Mon Sep 17 00:00:00 2001 From: Meredith Lancaster Date: Mon, 8 Dec 2025 11:02:59 -0800 Subject: [PATCH 02/32] condense parameters Signed-off-by: Meredith Lancaster --- packages/attest/src/artifact-metadata.ts | 35 +++++++++++++++++++----- 1 file changed, 28 insertions(+), 7 deletions(-) diff --git a/packages/attest/src/artifact-metadata.ts b/packages/attest/src/artifact-metadata.ts index 6aa11a96..95519b85 100644 --- a/packages/attest/src/artifact-metadata.ts +++ b/packages/attest/src/artifact-metadata.ts @@ -5,22 +5,37 @@ import {RequestHeaders} from '@octokit/types' const CREATE_STORAGE_RECORD_REQUEST = 'POST /orgs/{owner}/artifacts/metadata/storage-record' const DEFAULT_RETRY_COUNT = 5 +export type ArtifactParams = { + name: string + digest: string + version?: string + status?: string +} + +export type PackageRegistryParams = { + registryUrl: string + artifactUrl?: string + registryRepo?: string + path?: string +} + export type WriteOptions = { retry?: number headers?: RequestHeaders } /** - * Writes a storage record on behalf of an artifact - * @param artifactName - The name of the artifact. - * @param artifactDigest - The digest of the artifact. + * Writes a storage record on behalf of an artifact that has been attested + * @param artifactParams - parameters for the artifact. + * @param packageRegistryParams - parameters for the package registry. * @param token - The GitHub token for authentication. + * @param options - Optional parameters for the write operation. * @returns The ID of the storage record. * @throws Error if the storage record fails to persist. */ export const createStorageRecord = async ( - artifactName: string, - artifactDigest: string, + artifactParams: ArtifactParams, + packageRegistryParams: PackageRegistryParams, token: string, options: WriteOptions = {} ): Promise => { @@ -32,8 +47,14 @@ export const createStorageRecord = async ( owner: github.context.repo.owner, repo: github.context.repo.repo, headers: options.headers, - artifact_name: artifactName, - artifact_digest: artifactDigest, + artifact_name: artifactParams.name, + artifact_digest: artifactParams.digest, + artifact_version: artifactParams.version, + artifact_status: artifactParams.status, + registry_url: packageRegistryParams.registryUrl, + artifact_url: packageRegistryParams.artifactUrl, + registry_repo: packageRegistryParams.registryRepo, + path: packageRegistryParams.path }) const data = From 417dbfff73c380d816193eee9afaaf1e0806d77d Mon Sep 17 00:00:00 2001 From: Meredith Lancaster Date: Mon, 8 Dec 2025 13:17:08 -0800 Subject: [PATCH 03/32] use parameter objects and add tests Signed-off-by: Meredith Lancaster --- .../__tests__/artifact-metadata.test.ts | 112 ++++++++++++++++++ packages/attest/src/artifact-metadata.ts | 13 +- 2 files changed, 119 insertions(+), 6 deletions(-) create mode 100644 packages/attest/__tests__/artifact-metadata.test.ts diff --git a/packages/attest/__tests__/artifact-metadata.test.ts b/packages/attest/__tests__/artifact-metadata.test.ts new file mode 100644 index 00000000..0ce309bc --- /dev/null +++ b/packages/attest/__tests__/artifact-metadata.test.ts @@ -0,0 +1,112 @@ +import {MockAgent, setGlobalDispatcher} from 'undici' +import {createStorageRecord} from '../src/attest' + +describe('createStorageRecord', () => { + const originalEnv = process.env + const attestation = {foo: 'bar '} + const token = 'token' + const headers = {'X-GitHub-Foo': 'true'} + const artifactParams = { + name: "my-lib", + version: "1.0.0", + digest: "sha256:1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef", + } + const registryParams = { + registry_url: "https://my-registry.org", + } + + + const mockAgent = new MockAgent() + setGlobalDispatcher(mockAgent) + + beforeEach(() => { + process.env = { + ...originalEnv, + GITHUB_REPOSITORY: 'foo/bar' + } + }) + + afterEach(() => { + process.env = originalEnv + }) + + describe('when the api call is successful', () => { + beforeEach(() => { + mockAgent + .get('https://api.github.com') + .intercept({ + path: '/orgs/foo/artifacts/metadata/storage-record', + method: 'POST', + headers: {authorization: `token ${token}`, ...headers}, + body: JSON.stringify({ + name: "my-lib", + version: "1.0.0", + digest: "sha256:1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef", + registry_url: "https://my-registry.org" + }) + }) + .reply(201, {storage_records: [{id: '123'}, {id: '456'}]}) + }) + + it('persists the storage record', async () => { + await expect( + createStorageRecord(artifactParams, registryParams, token, {headers}) + ).resolves.toEqual(['123', '456']) + }) + }) + + describe('when the api call fails', () => { + beforeEach(() => { + mockAgent + .get('https://api.github.com') + .intercept({ + path: '/orgs/foo/artifacts/metadata/storage-record', + method: 'POST', + headers: {authorization: `token ${token}`}, + body: JSON.stringify({ + name: "my-lib", + version: "1.0.0", + digest: "sha256:1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef", + registry_url: "https://my-registry.org" + }) + }) + .reply(500, 'oops') + }) + + it('throws an error', async () => { + await expect( + createStorageRecord(artifactParams, registryParams, token, {retry: 0}) + ).rejects.toThrow(/oops/) + }) + }) + + describe('when the api call fails but succeeds on retry', () => { + beforeEach(() => { + const pool = mockAgent.get('https://api.github.com') + + pool + .intercept({ + path: '/repos/foo/bar/attestations', + method: 'POST', + headers: {authorization: `token ${token}`}, + body: JSON.stringify({...artifactParams, ...registryParams}) + }) + .reply(500, 'oops') + .times(1) + + pool + .intercept({ + path: '/repos/foo/bar/attestations', + method: 'POST', + headers: {authorization: `token ${token}`}, + body: JSON.stringify({}) + }) + .reply(201, {id: '123'}) + .times(1) + }) + + it('persists the attestation', async () => { + await expect(createStorageRecord(artifactParams, registryParams, token)).resolves.toEqual('123') + }) + }) +}) diff --git a/packages/attest/src/artifact-metadata.ts b/packages/attest/src/artifact-metadata.ts index 95519b85..d1b867c4 100644 --- a/packages/attest/src/artifact-metadata.ts +++ b/packages/attest/src/artifact-metadata.ts @@ -38,7 +38,7 @@ export const createStorageRecord = async ( packageRegistryParams: PackageRegistryParams, token: string, options: WriteOptions = {} -): Promise => { +): Promise> => { const retries = options.retry ?? DEFAULT_RETRY_COUNT const octokit = github.getOctokit(token, {retry: {retries}}, retry) @@ -47,21 +47,22 @@ export const createStorageRecord = async ( owner: github.context.repo.owner, repo: github.context.repo.repo, headers: options.headers, - artifact_name: artifactParams.name, artifact_digest: artifactParams.digest, - artifact_version: artifactParams.version, + artifact_name: artifactParams.name, artifact_status: artifactParams.status, - registry_url: packageRegistryParams.registryUrl, artifact_url: packageRegistryParams.artifactUrl, + artifact_version: artifactParams.version, + path: packageRegistryParams.path, registry_repo: packageRegistryParams.registryRepo, - path: packageRegistryParams.path + registry_url: packageRegistryParams.registryUrl, }) const data = typeof response.data == 'string' ? JSON.parse(response.data) : response.data - return data?.id + + return data?.storage_records.map((r: { id: any }) => r.id) } catch (err) { const message = err instanceof Error ? err.message : err throw new Error(`Failed to persist storage record: ${message}`) From 9ca26d49468bbca8f00d6d3eb97b8b0f2862abfa Mon Sep 17 00:00:00 2001 From: Meredith Lancaster Date: Mon, 8 Dec 2025 13:17:18 -0800 Subject: [PATCH 04/32] regenerate package lock Signed-off-by: Meredith Lancaster --- packages/attest/package-lock.json | 1 - 1 file changed, 1 deletion(-) diff --git a/packages/attest/package-lock.json b/packages/attest/package-lock.json index 985d44c4..97242457 100644 --- a/packages/attest/package-lock.json +++ b/packages/attest/package-lock.json @@ -192,7 +192,6 @@ "resolved": "https://registry.npmjs.org/@octokit/core/-/core-5.2.2.tgz", "integrity": "sha512-/g2d4sW9nUDJOMz3mabVQvOGhVa4e/BN/Um7yca9Bb2XTzPPnfTWHWQg+IsEYO7M3Vx+EXvaM/I2pJWIMun1bg==", "license": "MIT", - "peer": true, "dependencies": { "@octokit/auth-token": "^4.0.0", "@octokit/graphql": "^7.1.0", From c034e764881b18c5f7e0575da1d27d1fa29341ba Mon Sep 17 00:00:00 2001 From: Meredith Lancaster Date: Mon, 8 Dec 2025 13:49:54 -0800 Subject: [PATCH 05/32] fix function exporting and test results Signed-off-by: Meredith Lancaster --- .../__tests__/artifact-metadata.test.ts | 8 +++--- packages/attest/src/artifact-metadata.ts | 27 ++++++++++--------- 2 files changed, 19 insertions(+), 16 deletions(-) diff --git a/packages/attest/__tests__/artifact-metadata.test.ts b/packages/attest/__tests__/artifact-metadata.test.ts index 0ce309bc..c1a15025 100644 --- a/packages/attest/__tests__/artifact-metadata.test.ts +++ b/packages/attest/__tests__/artifact-metadata.test.ts @@ -1,5 +1,5 @@ import {MockAgent, setGlobalDispatcher} from 'undici' -import {createStorageRecord} from '../src/attest' +import {createStorageRecord} from '../src/artifact-metadata' describe('createStorageRecord', () => { const originalEnv = process.env @@ -12,7 +12,7 @@ describe('createStorageRecord', () => { digest: "sha256:1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef", } const registryParams = { - registry_url: "https://my-registry.org", + registryUrl: 'https://my-registry.org', } @@ -89,7 +89,7 @@ describe('createStorageRecord', () => { path: '/repos/foo/bar/attestations', method: 'POST', headers: {authorization: `token ${token}`}, - body: JSON.stringify({...artifactParams, ...registryParams}) + body: JSON.stringify({...artifactParams, registry_url: registryParams.registryUrl}) }) .reply(500, 'oops') .times(1) @@ -101,7 +101,7 @@ describe('createStorageRecord', () => { headers: {authorization: `token ${token}`}, body: JSON.stringify({}) }) - .reply(201, {id: '123'}) + .reply(201, {storage_records: [{id: '123'}, {id: '456'}]}) .times(1) }) diff --git a/packages/attest/src/artifact-metadata.ts b/packages/attest/src/artifact-metadata.ts index d1b867c4..bbe267b0 100644 --- a/packages/attest/src/artifact-metadata.ts +++ b/packages/attest/src/artifact-metadata.ts @@ -15,7 +15,7 @@ export type ArtifactParams = { export type PackageRegistryParams = { registryUrl: string artifactUrl?: string - registryRepo?: string + repo?: string path?: string } @@ -33,28 +33,20 @@ export type WriteOptions = { * @returns The ID of the storage record. * @throws Error if the storage record fails to persist. */ -export const createStorageRecord = async ( +export async function createStorageRecord( artifactParams: ArtifactParams, packageRegistryParams: PackageRegistryParams, token: string, options: WriteOptions = {} -): Promise> => { +): Promise> { const retries = options.retry ?? DEFAULT_RETRY_COUNT const octokit = github.getOctokit(token, {retry: {retries}}, retry) try { const response = await octokit.request(CREATE_STORAGE_RECORD_REQUEST, { owner: github.context.repo.owner, - repo: github.context.repo.repo, headers: options.headers, - artifact_digest: artifactParams.digest, - artifact_name: artifactParams.name, - artifact_status: artifactParams.status, - artifact_url: packageRegistryParams.artifactUrl, - artifact_version: artifactParams.version, - path: packageRegistryParams.path, - registry_repo: packageRegistryParams.registryRepo, - registry_url: packageRegistryParams.registryUrl, + ...buildRequestParams(artifactParams, packageRegistryParams), }) const data = @@ -68,3 +60,14 @@ export const createStorageRecord = async ( throw new Error(`Failed to persist storage record: ${message}`) } } + +const buildRequestParams = (artifactParams: ArtifactParams, registryParams: PackageRegistryParams) => { + const { registryUrl, artifactUrl, ...rest } = registryParams + return { + ...artifactParams, + ...rest, + // rename parameters to match API expectations + artifact_url: artifactUrl, + registry_url: registryUrl, + } +} From f01262913d4563d27696d9bf7ff1551e1e6e1a3f Mon Sep 17 00:00:00 2001 From: Meredith Lancaster Date: Mon, 8 Dec 2025 13:55:24 -0800 Subject: [PATCH 06/32] table of contents Signed-off-by: Meredith Lancaster --- packages/attest/README.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/packages/attest/README.md b/packages/attest/README.md index e6761ea6..c75b78b7 100644 --- a/packages/attest/README.md +++ b/packages/attest/README.md @@ -15,6 +15,14 @@ initiated. See [Using artifact attestations to establish provenance for builds](https://docs.github.com/en/actions/security-guides/using-artifact-attestations-to-establish-provenance-for-builds) for more information on artifact attestations. +## Table of Contents +- [Usage](#usage) + - [attest](#attest) + - [attestProvenance](#attest-provenance) + - [Attestation](#attestation) +- [Sigstore Instance](#sigstore-instance) +- [Storage](#storage) + ## Usage ### `attest` From dd097c7f4e83d9cd5f0601fc9e2bae03769f4549 Mon Sep 17 00:00:00 2001 From: Meredith Lancaster Date: Mon, 8 Dec 2025 13:57:00 -0800 Subject: [PATCH 07/32] add section on createStorageRecord func Signed-off-by: Meredith Lancaster --- packages/attest/README.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/packages/attest/README.md b/packages/attest/README.md index c75b78b7..33639b29 100644 --- a/packages/attest/README.md +++ b/packages/attest/README.md @@ -173,6 +173,13 @@ export type Attestation = { For details about the Sigstore bundle format, see the [Bundle protobuf specification](https://github.com/sigstore/protobuf-specs/blob/main/protos/sigstore_bundle.proto). +### createStorageRecord + +The `createStorageRecord` function accepts parameters defining artifact +and package registry details and creates a storage record on behalf of the artifact. +The storage record contains metadata about where the artifact is stored on a given +package registry. + ## Sigstore Instance When generating the signed attestation there are two different Sigstore From ed78411ffba53680068d7b3d313d3c7f06b58a5a Mon Sep 17 00:00:00 2001 From: Meredith Lancaster Date: Mon, 8 Dec 2025 14:03:23 -0800 Subject: [PATCH 08/32] fix expected response Signed-off-by: Meredith Lancaster --- packages/attest/__tests__/artifact-metadata.test.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/attest/__tests__/artifact-metadata.test.ts b/packages/attest/__tests__/artifact-metadata.test.ts index c1a15025..af4b1144 100644 --- a/packages/attest/__tests__/artifact-metadata.test.ts +++ b/packages/attest/__tests__/artifact-metadata.test.ts @@ -106,7 +106,7 @@ describe('createStorageRecord', () => { }) it('persists the attestation', async () => { - await expect(createStorageRecord(artifactParams, registryParams, token)).resolves.toEqual('123') + await expect(createStorageRecord(artifactParams, registryParams, token)).resolves.toEqual(['123', '456']) }) }) }) From 136f9dfe376649d76527ff5ff77af9e2fd08d8c2 Mon Sep 17 00:00:00 2001 From: Meredith Lancaster Date: Mon, 8 Dec 2025 14:07:17 -0800 Subject: [PATCH 09/32] fix header link Signed-off-by: Meredith Lancaster --- packages/attest/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/attest/README.md b/packages/attest/README.md index 33639b29..b157d5a1 100644 --- a/packages/attest/README.md +++ b/packages/attest/README.md @@ -18,7 +18,7 @@ for more information on artifact attestations. ## Table of Contents - [Usage](#usage) - [attest](#attest) - - [attestProvenance](#attest-provenance) + - [attestProvenance](#attestprovenance) - [Attestation](#attestation) - [Sigstore Instance](#sigstore-instance) - [Storage](#storage) From 0a988d204ed418d48b4d8a9ecb5db04f1932476d Mon Sep 17 00:00:00 2001 From: Meredith Lancaster Date: Mon, 8 Dec 2025 15:16:26 -0800 Subject: [PATCH 10/32] rename file Signed-off-by: Meredith Lancaster --- .../{artifact-metadata.test.ts => artifactMetadata.test.ts} | 2 +- .../attest/src/{artifact-metadata.ts => artifactMetadata.ts} | 0 packages/attest/src/index.ts | 1 + 3 files changed, 2 insertions(+), 1 deletion(-) rename packages/attest/__tests__/{artifact-metadata.test.ts => artifactMetadata.test.ts} (98%) rename packages/attest/src/{artifact-metadata.ts => artifactMetadata.ts} (100%) diff --git a/packages/attest/__tests__/artifact-metadata.test.ts b/packages/attest/__tests__/artifactMetadata.test.ts similarity index 98% rename from packages/attest/__tests__/artifact-metadata.test.ts rename to packages/attest/__tests__/artifactMetadata.test.ts index af4b1144..192978af 100644 --- a/packages/attest/__tests__/artifact-metadata.test.ts +++ b/packages/attest/__tests__/artifactMetadata.test.ts @@ -1,5 +1,5 @@ import {MockAgent, setGlobalDispatcher} from 'undici' -import {createStorageRecord} from '../src/artifact-metadata' +import {createStorageRecord} from '../src/artifactMetadata' describe('createStorageRecord', () => { const originalEnv = process.env diff --git a/packages/attest/src/artifact-metadata.ts b/packages/attest/src/artifactMetadata.ts similarity index 100% rename from packages/attest/src/artifact-metadata.ts rename to packages/attest/src/artifactMetadata.ts diff --git a/packages/attest/src/index.ts b/packages/attest/src/index.ts index 43c0a472..54846dbf 100644 --- a/packages/attest/src/index.ts +++ b/packages/attest/src/index.ts @@ -1,3 +1,4 @@ +export {createStorageRecord} from '.artifactMetadata' export {AttestOptions, attest} from './attest' export { AttestProvenanceOptions, From b8933d04957cf25df1332829104ff6cf36470d7b Mon Sep 17 00:00:00 2001 From: Meredith Lancaster Date: Mon, 8 Dec 2025 15:25:34 -0800 Subject: [PATCH 11/32] reorganize function options and document Signed-off-by: Meredith Lancaster --- packages/attest/README.md | 69 +++++++++++++++++-- .../attest/__tests__/artifactMetadata.test.ts | 22 ++++-- packages/attest/src/artifactMetadata.ts | 67 ++++++++++-------- 3 files changed, 123 insertions(+), 35 deletions(-) diff --git a/packages/attest/README.md b/packages/attest/README.md index b157d5a1..6331d86a 100644 --- a/packages/attest/README.md +++ b/packages/attest/README.md @@ -175,10 +175,71 @@ specification](https://github.com/sigstore/protobuf-specs/blob/main/protos/sigst ### createStorageRecord -The `createStorageRecord` function accepts parameters defining artifact -and package registry details and creates a storage record on behalf of the artifact. -The storage record contains metadata about where the artifact is stored on a given -package registry. +The `createStorageRecord` function creates an +[artifact metadata storage record](https://docs.github.com/en/rest/orgs/artifact-metadata?apiVersion=2022-11-28#create-artifact-metadata-storage-record) +on behalf of an attested artifact. It accepts parameters defining artifact +and package registry details. The storage record contains metadata about where the artifact is stored on a given package registry. + +```js +const { createStorageRecord } = require('@actions/attest'); +const core = require('@actions/core'); + +async function run() { + // In order to persist attestations to the repo, this should be a token with + // repository write permissions. + const ghToken = core.getInput('gh-token'); + + const record = await createStorageRecord({ + name: 'my-artifact-name', + digest: { 'sha256': '36ab4667...'}, + version: "v1.0.0", + registry_url: "https://my-fave-pkg-registry.com", + token: ghToken + }); + + console.log(record); +} + +run(); +``` + +The `createStorageRecord` function supports the following options: + +```typescript +export type StorageRecordOptions = { + // Includes details about the attested artifact + artifactOptions: { + // The name of the artifact + name: string + // The digest of the artifact + digest: string + // The version of the artifact + version?: string + // The status of the artifact + status?: string + }, + // Includes details about the package registry the artifact was published to + packageRegistryOptions: { + // The URL of the package registry + registryUrl: string + // The URL of the artifact in the package registry + artifactUrl?: string + // The package registry repository the artifact was published to. + repo?: string + // The path of the artifact in the package registry repository. + path?: string + }, + // GitHub token for writing attestations. + token: string + // Optional parameters for the write operation. + writeOptions: { + // The number of times to retry the request. + retry?: number + // HTTP headers to include in request to Artifact Metadata API. + headers?: RequestHeaders + } +} +``` ## Sigstore Instance diff --git a/packages/attest/__tests__/artifactMetadata.test.ts b/packages/attest/__tests__/artifactMetadata.test.ts index 192978af..ab63c3f1 100644 --- a/packages/attest/__tests__/artifactMetadata.test.ts +++ b/packages/attest/__tests__/artifactMetadata.test.ts @@ -15,7 +15,6 @@ describe('createStorageRecord', () => { registryUrl: 'https://my-registry.org', } - const mockAgent = new MockAgent() setGlobalDispatcher(mockAgent) @@ -50,7 +49,12 @@ describe('createStorageRecord', () => { it('persists the storage record', async () => { await expect( - createStorageRecord(artifactParams, registryParams, token, {headers}) + createStorageRecord({ + artifactOptions: artifactParams, + packageRegistryOptions: registryParams, + token, + writeOptions: {headers}, + }) ).resolves.toEqual(['123', '456']) }) }) @@ -75,7 +79,12 @@ describe('createStorageRecord', () => { it('throws an error', async () => { await expect( - createStorageRecord(artifactParams, registryParams, token, {retry: 0}) + createStorageRecord({ + artifactOptions: artifactParams, + packageRegistryOptions: registryParams, + token, + writeOptions: {retry: 0}, + }) ).rejects.toThrow(/oops/) }) }) @@ -106,7 +115,12 @@ describe('createStorageRecord', () => { }) it('persists the attestation', async () => { - await expect(createStorageRecord(artifactParams, registryParams, token)).resolves.toEqual(['123', '456']) + await expect(createStorageRecord({ + artifactOptions: artifactParams, + packageRegistryOptions: registryParams, + token, + writeOptions: {}, + })).resolves.toEqual(['123', '456']) }) }) }) diff --git a/packages/attest/src/artifactMetadata.ts b/packages/attest/src/artifactMetadata.ts index bbe267b0..5e4bf10f 100644 --- a/packages/attest/src/artifactMetadata.ts +++ b/packages/attest/src/artifactMetadata.ts @@ -5,23 +5,41 @@ import {RequestHeaders} from '@octokit/types' const CREATE_STORAGE_RECORD_REQUEST = 'POST /orgs/{owner}/artifacts/metadata/storage-record' const DEFAULT_RETRY_COUNT = 5 -export type ArtifactParams = { - name: string - digest: string - version?: string - status?: string -} - -export type PackageRegistryParams = { - registryUrl: string - artifactUrl?: string - repo?: string - path?: string -} - -export type WriteOptions = { - retry?: number - headers?: RequestHeaders +/** + * Options for creating a storage record for an attested artifact. + */ +export type StorageRecordOptions = { + // Includes details about the attested artifact + artifactOptions: { + // The name of the artifact + name: string + // The digest of the artifact + digest: string + // The version of the artifact + version?: string + // The status of the artifact + status?: string + }, + // Includes details about the package registry the artifact was published to + packageRegistryOptions: { + // The URL of the package registry + registryUrl: string + // The URL of the artifact in the package registry + artifactUrl?: string + // The package registry repository the artifact was published to. + repo?: string + // The path of the artifact in the package registry repository. + path?: string + }, + // GitHub token for writing attestations. + token: string + // Optional parameters for the write operation. + writeOptions: { + // The number of times to retry the request. + retry?: number + // HTTP headers to include in request to Artifact Metadata API. + headers?: RequestHeaders + } } /** @@ -33,20 +51,15 @@ export type WriteOptions = { * @returns The ID of the storage record. * @throws Error if the storage record fails to persist. */ -export async function createStorageRecord( - artifactParams: ArtifactParams, - packageRegistryParams: PackageRegistryParams, - token: string, - options: WriteOptions = {} -): Promise> { - const retries = options.retry ?? DEFAULT_RETRY_COUNT - const octokit = github.getOctokit(token, {retry: {retries}}, retry) +export async function createStorageRecord(options: StorageRecordOptions): Promise> { + const retries = options.writeOptions.retry ?? DEFAULT_RETRY_COUNT + const octokit = github.getOctokit(options.token, {retry: {retries}}, retry) try { const response = await octokit.request(CREATE_STORAGE_RECORD_REQUEST, { owner: github.context.repo.owner, - headers: options.headers, - ...buildRequestParams(artifactParams, packageRegistryParams), + headers: options.writeOptions.headers, + ...buildRequestParams(options.artifactOptions, options.packageRegistryOptions), }) const data = From d1f9584cda66ff4509437966e843a1bc43348ad3 Mon Sep 17 00:00:00 2001 From: Meredith Lancaster Date: Mon, 8 Dec 2025 15:33:01 -0800 Subject: [PATCH 12/32] fix test calls Signed-off-by: Meredith Lancaster --- .../attest/__tests__/artifactMetadata.test.ts | 20 ++++++++++--------- packages/attest/src/artifactMetadata.ts | 16 +-------------- packages/attest/src/index.ts | 2 +- 3 files changed, 13 insertions(+), 25 deletions(-) diff --git a/packages/attest/__tests__/artifactMetadata.test.ts b/packages/attest/__tests__/artifactMetadata.test.ts index ab63c3f1..b3cf6542 100644 --- a/packages/attest/__tests__/artifactMetadata.test.ts +++ b/packages/attest/__tests__/artifactMetadata.test.ts @@ -6,12 +6,12 @@ describe('createStorageRecord', () => { const attestation = {foo: 'bar '} const token = 'token' const headers = {'X-GitHub-Foo': 'true'} - const artifactParams = { + const artifactOptions = { name: "my-lib", version: "1.0.0", digest: "sha256:1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef", } - const registryParams = { + const registryOptions = { registryUrl: 'https://my-registry.org', } @@ -50,8 +50,8 @@ describe('createStorageRecord', () => { it('persists the storage record', async () => { await expect( createStorageRecord({ - artifactOptions: artifactParams, - packageRegistryOptions: registryParams, + artifactOptions: artifactOptions, + packageRegistryOptions: registryOptions, token, writeOptions: {headers}, }) @@ -80,8 +80,8 @@ describe('createStorageRecord', () => { it('throws an error', async () => { await expect( createStorageRecord({ - artifactOptions: artifactParams, - packageRegistryOptions: registryParams, + artifactOptions: artifactOptions, + packageRegistryOptions: registryOptions, token, writeOptions: {retry: 0}, }) @@ -98,7 +98,7 @@ describe('createStorageRecord', () => { path: '/repos/foo/bar/attestations', method: 'POST', headers: {authorization: `token ${token}`}, - body: JSON.stringify({...artifactParams, registry_url: registryParams.registryUrl}) + body: JSON.stringify({...artifactOptions, registry_url: registryOptions.registryUrl}) }) .reply(500, 'oops') .times(1) @@ -115,9 +115,11 @@ describe('createStorageRecord', () => { }) it('persists the attestation', async () => { + const { registryUrl, ...rest } = registryOptions await expect(createStorageRecord({ - artifactOptions: artifactParams, - packageRegistryOptions: registryParams, + ...artifactOptions, + ...rest, + registry_url: registryUrl, token, writeOptions: {}, })).resolves.toEqual(['123', '456']) diff --git a/packages/attest/src/artifactMetadata.ts b/packages/attest/src/artifactMetadata.ts index 5e4bf10f..26c4fc4a 100644 --- a/packages/attest/src/artifactMetadata.ts +++ b/packages/attest/src/artifactMetadata.ts @@ -44,10 +44,7 @@ export type StorageRecordOptions = { /** * Writes a storage record on behalf of an artifact that has been attested - * @param artifactParams - parameters for the artifact. - * @param packageRegistryParams - parameters for the package registry. - * @param token - The GitHub token for authentication. - * @param options - Optional parameters for the write operation. + * @param StorageRecordOptions - parameters for the storage record API request. * @returns The ID of the storage record. * @throws Error if the storage record fails to persist. */ @@ -73,14 +70,3 @@ export async function createStorageRecord(options: StorageRecordOptions): Promis throw new Error(`Failed to persist storage record: ${message}`) } } - -const buildRequestParams = (artifactParams: ArtifactParams, registryParams: PackageRegistryParams) => { - const { registryUrl, artifactUrl, ...rest } = registryParams - return { - ...artifactParams, - ...rest, - // rename parameters to match API expectations - artifact_url: artifactUrl, - registry_url: registryUrl, - } -} diff --git a/packages/attest/src/index.ts b/packages/attest/src/index.ts index 54846dbf..78384d32 100644 --- a/packages/attest/src/index.ts +++ b/packages/attest/src/index.ts @@ -1,4 +1,4 @@ -export {createStorageRecord} from '.artifactMetadata' +export {createStorageRecord} from './artifactMetadata' export {AttestOptions, attest} from './attest' export { AttestProvenanceOptions, From 6ec87f46b72f0c38c48a4d8aa62c737eb4d18fde Mon Sep 17 00:00:00 2001 From: Meredith Lancaster Date: Mon, 8 Dec 2025 15:39:26 -0800 Subject: [PATCH 13/32] add back param parsing function Signed-off-by: Meredith Lancaster --- packages/attest/src/artifactMetadata.ts | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/packages/attest/src/artifactMetadata.ts b/packages/attest/src/artifactMetadata.ts index 26c4fc4a..40f1705d 100644 --- a/packages/attest/src/artifactMetadata.ts +++ b/packages/attest/src/artifactMetadata.ts @@ -70,3 +70,13 @@ export async function createStorageRecord(options: StorageRecordOptions): Promis throw new Error(`Failed to persist storage record: ${message}`) } } + +const buildRequestParams = (options: StorageRecordOptions) => { + const { registryUrl, artifactUrl, ...rest } = options.packageRegistryOptions + return { + ...options.artifactOptions, + registry_url: registryUrl, + artifact_url: artifactUrl, + ...rest, + } +} From 8eca440361a4a26069246e00efcd84ad619ebb9e Mon Sep 17 00:00:00 2001 From: Meredith Lancaster Date: Mon, 8 Dec 2025 15:59:25 -0800 Subject: [PATCH 14/32] fix test and function calls Signed-off-by: Meredith Lancaster --- .../attest/__tests__/artifactMetadata.test.ts | 50 +++++++++---------- packages/attest/src/artifactMetadata.ts | 2 +- 2 files changed, 26 insertions(+), 26 deletions(-) diff --git a/packages/attest/__tests__/artifactMetadata.test.ts b/packages/attest/__tests__/artifactMetadata.test.ts index b3cf6542..3416eed1 100644 --- a/packages/attest/__tests__/artifactMetadata.test.ts +++ b/packages/attest/__tests__/artifactMetadata.test.ts @@ -6,13 +6,18 @@ describe('createStorageRecord', () => { const attestation = {foo: 'bar '} const token = 'token' const headers = {'X-GitHub-Foo': 'true'} - const artifactOptions = { - name: "my-lib", - version: "1.0.0", - digest: "sha256:1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef", - } - const registryOptions = { - registryUrl: 'https://my-registry.org', + + const options = { + artifactOptions: { + name: "my-lib", + version: "1.0.0", + digest: "sha256:1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef", + }, + packageRegistryOptions: { + registryUrl: 'https://my-registry.org', + }, + token, + writeOptions: {headers}, } const mockAgent = new MockAgent() @@ -49,12 +54,7 @@ describe('createStorageRecord', () => { it('persists the storage record', async () => { await expect( - createStorageRecord({ - artifactOptions: artifactOptions, - packageRegistryOptions: registryOptions, - token, - writeOptions: {headers}, - }) + createStorageRecord(options) ).resolves.toEqual(['123', '456']) }) }) @@ -80,9 +80,7 @@ describe('createStorageRecord', () => { it('throws an error', async () => { await expect( createStorageRecord({ - artifactOptions: artifactOptions, - packageRegistryOptions: registryOptions, - token, + ...options, writeOptions: {retry: 0}, }) ).rejects.toThrow(/oops/) @@ -95,32 +93,34 @@ describe('createStorageRecord', () => { pool .intercept({ - path: '/repos/foo/bar/attestations', + path: '/orgs/foo/artifacts/metadata/storage-record', method: 'POST', headers: {authorization: `token ${token}`}, - body: JSON.stringify({...artifactOptions, registry_url: registryOptions.registryUrl}) + body: JSON.stringify({ + ...options.artifactOptions, + registry_url: options.packageRegistryOptions.registryUrl, + }) }) .reply(500, 'oops') .times(1) pool .intercept({ - path: '/repos/foo/bar/attestations', + path: '/orgs/foo/artifacts/metadata/storage-record', method: 'POST', headers: {authorization: `token ${token}`}, - body: JSON.stringify({}) + body: JSON.stringify({ + ...options.artifactOptions, + registry_url: options.packageRegistryOptions.registryUrl, + }) }) .reply(201, {storage_records: [{id: '123'}, {id: '456'}]}) .times(1) }) it('persists the attestation', async () => { - const { registryUrl, ...rest } = registryOptions await expect(createStorageRecord({ - ...artifactOptions, - ...rest, - registry_url: registryUrl, - token, + ...options, writeOptions: {}, })).resolves.toEqual(['123', '456']) }) diff --git a/packages/attest/src/artifactMetadata.ts b/packages/attest/src/artifactMetadata.ts index 40f1705d..6b94dc20 100644 --- a/packages/attest/src/artifactMetadata.ts +++ b/packages/attest/src/artifactMetadata.ts @@ -56,7 +56,7 @@ export async function createStorageRecord(options: StorageRecordOptions): Promis const response = await octokit.request(CREATE_STORAGE_RECORD_REQUEST, { owner: github.context.repo.owner, headers: options.writeOptions.headers, - ...buildRequestParams(options.artifactOptions, options.packageRegistryOptions), + ...buildRequestParams(options), }) const data = From 10d3b034e071972608dbd4dd0f25c5edcde154f7 Mon Sep 17 00:00:00 2001 From: Meredith Lancaster Date: Mon, 8 Dec 2025 16:22:59 -0800 Subject: [PATCH 15/32] fix linter issues Signed-off-by: Meredith Lancaster --- .../attest/__tests__/artifactMetadata.test.ts | 52 ++++++++++--------- packages/attest/src/artifactMetadata.ts | 23 ++++---- 2 files changed, 40 insertions(+), 35 deletions(-) diff --git a/packages/attest/__tests__/artifactMetadata.test.ts b/packages/attest/__tests__/artifactMetadata.test.ts index 3416eed1..051ea314 100644 --- a/packages/attest/__tests__/artifactMetadata.test.ts +++ b/packages/attest/__tests__/artifactMetadata.test.ts @@ -3,21 +3,20 @@ import {createStorageRecord} from '../src/artifactMetadata' describe('createStorageRecord', () => { const originalEnv = process.env - const attestation = {foo: 'bar '} const token = 'token' const headers = {'X-GitHub-Foo': 'true'} const options = { artifactOptions: { - name: "my-lib", - version: "1.0.0", - digest: "sha256:1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef", + name: 'my-lib', + version: '1.0.0', + digest: `sha256:${'a'.repeat(64)}` }, packageRegistryOptions: { - registryUrl: 'https://my-registry.org', + registryUrl: 'https://my-registry.org' }, token, - writeOptions: {headers}, + writeOptions: {headers} } const mockAgent = new MockAgent() @@ -43,19 +42,20 @@ describe('createStorageRecord', () => { method: 'POST', headers: {authorization: `token ${token}`, ...headers}, body: JSON.stringify({ - name: "my-lib", - version: "1.0.0", - digest: "sha256:1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef", - registry_url: "https://my-registry.org" + name: 'my-lib', + version: '1.0.0', + digest: `sha256:${'a'.repeat(64)}`, + registry_url: 'https://my-registry.org' }) }) .reply(201, {storage_records: [{id: '123'}, {id: '456'}]}) }) it('persists the storage record', async () => { - await expect( - createStorageRecord(options) - ).resolves.toEqual(['123', '456']) + await expect(createStorageRecord(options)).resolves.toEqual([ + '123', + '456' + ]) }) }) @@ -68,10 +68,10 @@ describe('createStorageRecord', () => { method: 'POST', headers: {authorization: `token ${token}`}, body: JSON.stringify({ - name: "my-lib", - version: "1.0.0", - digest: "sha256:1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef", - registry_url: "https://my-registry.org" + name: 'my-lib', + version: '1.0.0', + digest: `sha256:${'a'.repeat(64)}`, + registry_url: 'https://my-registry.org' }) }) .reply(500, 'oops') @@ -81,7 +81,7 @@ describe('createStorageRecord', () => { await expect( createStorageRecord({ ...options, - writeOptions: {retry: 0}, + writeOptions: {retry: 0} }) ).rejects.toThrow(/oops/) }) @@ -98,7 +98,7 @@ describe('createStorageRecord', () => { headers: {authorization: `token ${token}`}, body: JSON.stringify({ ...options.artifactOptions, - registry_url: options.packageRegistryOptions.registryUrl, + registry_url: options.packageRegistryOptions.registryUrl }) }) .reply(500, 'oops') @@ -111,18 +111,20 @@ describe('createStorageRecord', () => { headers: {authorization: `token ${token}`}, body: JSON.stringify({ ...options.artifactOptions, - registry_url: options.packageRegistryOptions.registryUrl, + registry_url: options.packageRegistryOptions.registryUrl }) }) .reply(201, {storage_records: [{id: '123'}, {id: '456'}]}) .times(1) }) - it('persists the attestation', async () => { - await expect(createStorageRecord({ - ...options, - writeOptions: {}, - })).resolves.toEqual(['123', '456']) + it('persists the storage record', async () => { + await expect( + createStorageRecord({ + ...options, + writeOptions: {} + }) + ).resolves.toEqual(['123', '456']) }) }) }) diff --git a/packages/attest/src/artifactMetadata.ts b/packages/attest/src/artifactMetadata.ts index 6b94dc20..f24b6806 100644 --- a/packages/attest/src/artifactMetadata.ts +++ b/packages/attest/src/artifactMetadata.ts @@ -2,7 +2,8 @@ import * as github from '@actions/github' import {retry} from '@octokit/plugin-retry' import {RequestHeaders} from '@octokit/types' -const CREATE_STORAGE_RECORD_REQUEST = 'POST /orgs/{owner}/artifacts/metadata/storage-record' +const CREATE_STORAGE_RECORD_REQUEST = + 'POST /orgs/{owner}/artifacts/metadata/storage-record' const DEFAULT_RETRY_COUNT = 5 /** @@ -19,7 +20,7 @@ export type StorageRecordOptions = { version?: string // The status of the artifact status?: string - }, + } // Includes details about the package registry the artifact was published to packageRegistryOptions: { // The URL of the package registry @@ -30,14 +31,14 @@ export type StorageRecordOptions = { repo?: string // The path of the artifact in the package registry repository. path?: string - }, + } // GitHub token for writing attestations. token: string // Optional parameters for the write operation. writeOptions: { // The number of times to retry the request. retry?: number - // HTTP headers to include in request to Artifact Metadata API. + // HTTP headers to include in request to Artifact Metadata API. headers?: RequestHeaders } } @@ -48,7 +49,9 @@ export type StorageRecordOptions = { * @returns The ID of the storage record. * @throws Error if the storage record fails to persist. */ -export async function createStorageRecord(options: StorageRecordOptions): Promise> { +export async function createStorageRecord( + options: StorageRecordOptions +): Promise { const retries = options.writeOptions.retry ?? DEFAULT_RETRY_COUNT const octokit = github.getOctokit(options.token, {retry: {retries}}, retry) @@ -56,7 +59,7 @@ export async function createStorageRecord(options: StorageRecordOptions): Promis const response = await octokit.request(CREATE_STORAGE_RECORD_REQUEST, { owner: github.context.repo.owner, headers: options.writeOptions.headers, - ...buildRequestParams(options), + ...buildRequestParams(options) }) const data = @@ -64,19 +67,19 @@ export async function createStorageRecord(options: StorageRecordOptions): Promis ? JSON.parse(response.data) : response.data - return data?.storage_records.map((r: { id: any }) => r.id) + return data?.storage_records.map((r: {id: number}) => String(r.id)) } catch (err) { const message = err instanceof Error ? err.message : err throw new Error(`Failed to persist storage record: ${message}`) } } -const buildRequestParams = (options: StorageRecordOptions) => { - const { registryUrl, artifactUrl, ...rest } = options.packageRegistryOptions +function buildRequestParams(options: StorageRecordOptions): Object { + const {registryUrl, artifactUrl, ...rest} = options.packageRegistryOptions return { ...options.artifactOptions, registry_url: registryUrl, artifact_url: artifactUrl, - ...rest, + ...rest } } From 7847d316962c080a2ed9b865704f4af2c6841536 Mon Sep 17 00:00:00 2001 From: Meredith Lancaster Date: Mon, 8 Dec 2025 16:30:25 -0800 Subject: [PATCH 16/32] Update packages/attest/README.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --- packages/attest/README.md | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/packages/attest/README.md b/packages/attest/README.md index 6331d86a..49903437 100644 --- a/packages/attest/README.md +++ b/packages/attest/README.md @@ -190,10 +190,14 @@ async function run() { const ghToken = core.getInput('gh-token'); const record = await createStorageRecord({ - name: 'my-artifact-name', - digest: { 'sha256': '36ab4667...'}, - version: "v1.0.0", - registry_url: "https://my-fave-pkg-registry.com", + artifactOptions: { + name: 'my-artifact-name', + digest: { 'sha256': '36ab4667...'}, + version: "v1.0.0" + }, + packageRegistryOptions: { + registryUrl: "https://my-fave-pkg-registry.com" + }, token: ghToken }); From dc9f635a0d93dc81c58566b1eaae743eb046064d Mon Sep 17 00:00:00 2001 From: Meredith Lancaster Date: Mon, 8 Dec 2025 16:30:37 -0800 Subject: [PATCH 17/32] Update packages/attest/src/artifactMetadata.ts Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --- packages/attest/src/artifactMetadata.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/attest/src/artifactMetadata.ts b/packages/attest/src/artifactMetadata.ts index f24b6806..503606af 100644 --- a/packages/attest/src/artifactMetadata.ts +++ b/packages/attest/src/artifactMetadata.ts @@ -74,7 +74,7 @@ export async function createStorageRecord( } } -function buildRequestParams(options: StorageRecordOptions): Object { +function buildRequestParams(options: StorageRecordOptions): Record { const {registryUrl, artifactUrl, ...rest} = options.packageRegistryOptions return { ...options.artifactOptions, From c40fa0d905f48bebdc6706f377da2e776caf4f15 Mon Sep 17 00:00:00 2001 From: Meredith Lancaster Date: Mon, 8 Dec 2025 19:19:11 -0800 Subject: [PATCH 18/32] formatting Signed-off-by: Meredith Lancaster --- packages/attest/src/artifactMetadata.ts | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/packages/attest/src/artifactMetadata.ts b/packages/attest/src/artifactMetadata.ts index 503606af..bb20bf68 100644 --- a/packages/attest/src/artifactMetadata.ts +++ b/packages/attest/src/artifactMetadata.ts @@ -74,7 +74,9 @@ export async function createStorageRecord( } } -function buildRequestParams(options: StorageRecordOptions): Record { +function buildRequestParams( + options: StorageRecordOptions +): Record { const {registryUrl, artifactUrl, ...rest} = options.packageRegistryOptions return { ...options.artifactOptions, From 87afd16bb24271ad8fcb5d88ab37939e8d8b9247 Mon Sep 17 00:00:00 2001 From: Meredith Lancaster Date: Mon, 8 Dec 2025 19:19:29 -0800 Subject: [PATCH 19/32] bump to next minor version Signed-off-by: Meredith Lancaster --- packages/attest/package.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/packages/attest/package.json b/packages/attest/package.json index d8b70ee8..371c553f 100644 --- a/packages/attest/package.json +++ b/packages/attest/package.json @@ -1,6 +1,6 @@ { "name": "@actions/attest", - "version": "2.0.0", + "version": "2.1.0", "description": "Actions attestation lib", "keywords": [ "github", @@ -55,4 +55,4 @@ "@octokit/core": "^5.2.0" } } -} \ No newline at end of file +} From 97b7fa81c896cb070bc1a2294cdc1b9abc9878a2 Mon Sep 17 00:00:00 2001 From: Meredith Lancaster Date: Mon, 8 Dec 2025 19:22:04 -0800 Subject: [PATCH 20/32] regenerate package lock Signed-off-by: Meredith Lancaster --- packages/attest/package-lock.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/packages/attest/package-lock.json b/packages/attest/package-lock.json index 97242457..a3309fcd 100644 --- a/packages/attest/package-lock.json +++ b/packages/attest/package-lock.json @@ -1,12 +1,12 @@ { "name": "@actions/attest", - "version": "2.0.0", + "version": "2.1.0", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "@actions/attest", - "version": "2.0.0", + "version": "2.1.0", "license": "MIT", "dependencies": { "@actions/core": "^1.11.1", From 0380590fdd9cc05882974277c52b8647873fb676 Mon Sep 17 00:00:00 2001 From: Meredith Lancaster Date: Tue, 9 Dec 2025 08:02:38 -0800 Subject: [PATCH 21/32] fix expected endpoint response Signed-off-by: Meredith Lancaster --- packages/attest/__tests__/artifactMetadata.test.ts | 10 +++++----- packages/attest/src/artifactMetadata.ts | 4 ++-- 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/packages/attest/__tests__/artifactMetadata.test.ts b/packages/attest/__tests__/artifactMetadata.test.ts index 051ea314..0b578945 100644 --- a/packages/attest/__tests__/artifactMetadata.test.ts +++ b/packages/attest/__tests__/artifactMetadata.test.ts @@ -48,13 +48,13 @@ describe('createStorageRecord', () => { registry_url: 'https://my-registry.org' }) }) - .reply(201, {storage_records: [{id: '123'}, {id: '456'}]}) + .reply(200, {storage_records: [{id: 123}, {id: 456}]}) }) it('persists the storage record', async () => { await expect(createStorageRecord(options)).resolves.toEqual([ - '123', - '456' + 123, + 456 ]) }) }) @@ -114,7 +114,7 @@ describe('createStorageRecord', () => { registry_url: options.packageRegistryOptions.registryUrl }) }) - .reply(201, {storage_records: [{id: '123'}, {id: '456'}]}) + .reply(200, {storage_records: [{id: 123}, {id: 456}]}) .times(1) }) @@ -124,7 +124,7 @@ describe('createStorageRecord', () => { ...options, writeOptions: {} }) - ).resolves.toEqual(['123', '456']) + ).resolves.toEqual([123, 456]) }) }) }) diff --git a/packages/attest/src/artifactMetadata.ts b/packages/attest/src/artifactMetadata.ts index bb20bf68..6a5c514f 100644 --- a/packages/attest/src/artifactMetadata.ts +++ b/packages/attest/src/artifactMetadata.ts @@ -51,7 +51,7 @@ export type StorageRecordOptions = { */ export async function createStorageRecord( options: StorageRecordOptions -): Promise { +): Promise { const retries = options.writeOptions.retry ?? DEFAULT_RETRY_COUNT const octokit = github.getOctokit(options.token, {retry: {retries}}, retry) @@ -67,7 +67,7 @@ export async function createStorageRecord( ? JSON.parse(response.data) : response.data - return data?.storage_records.map((r: {id: number}) => String(r.id)) + return data?.storage_records.map((r: {id: number}) => r.id) } catch (err) { const message = err instanceof Error ? err.message : err throw new Error(`Failed to persist storage record: ${message}`) From d795a0ad0d7cc17a81a616dcafd59a250ced66d9 Mon Sep 17 00:00:00 2001 From: Meredith Lancaster Date: Tue, 9 Dec 2025 08:32:31 -0800 Subject: [PATCH 22/32] linter fix Signed-off-by: Meredith Lancaster --- packages/attest/__tests__/artifactMetadata.test.ts | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/packages/attest/__tests__/artifactMetadata.test.ts b/packages/attest/__tests__/artifactMetadata.test.ts index 0b578945..c447ba55 100644 --- a/packages/attest/__tests__/artifactMetadata.test.ts +++ b/packages/attest/__tests__/artifactMetadata.test.ts @@ -52,10 +52,7 @@ describe('createStorageRecord', () => { }) it('persists the storage record', async () => { - await expect(createStorageRecord(options)).resolves.toEqual([ - 123, - 456 - ]) + await expect(createStorageRecord(options)).resolves.toEqual([123, 456]) }) }) From d75223fd4a412def20d25bfbdff285a110990e89 Mon Sep 17 00:00:00 2001 From: Meredith Lancaster Date: Tue, 9 Dec 2025 11:37:04 -0800 Subject: [PATCH 23/32] split mega param into several different ones Signed-off-by: Meredith Lancaster --- packages/attest/README.md | 64 +++++++-------- .../attest/__tests__/artifactMetadata.test.ts | 50 ++++++------ packages/attest/src/artifactMetadata.ts | 78 +++++++++---------- 3 files changed, 94 insertions(+), 98 deletions(-) diff --git a/packages/attest/README.md b/packages/attest/README.md index 49903437..12e75306 100644 --- a/packages/attest/README.md +++ b/packages/attest/README.md @@ -189,7 +189,7 @@ async function run() { // repository write permissions. const ghToken = core.getInput('gh-token'); - const record = await createStorageRecord({ + const record = await createStorageRecord( artifactOptions: { name: 'my-artifact-name', digest: { 'sha256': '36ab4667...'}, @@ -199,7 +199,7 @@ async function run() { registryUrl: "https://my-fave-pkg-registry.com" }, token: ghToken - }); + ); console.log(record); } @@ -210,39 +210,35 @@ run(); The `createStorageRecord` function supports the following options: ```typescript -export type StorageRecordOptions = { - // Includes details about the attested artifact - artifactOptions: { - // The name of the artifact - name: string - // The digest of the artifact - digest: string - // The version of the artifact - version?: string - // The status of the artifact - status?: string - }, - // Includes details about the package registry the artifact was published to - packageRegistryOptions: { - // The URL of the package registry - registryUrl: string - // The URL of the artifact in the package registry - artifactUrl?: string - // The package registry repository the artifact was published to. - repo?: string - // The path of the artifact in the package registry repository. - path?: string - }, - // GitHub token for writing attestations. - token: string - // Optional parameters for the write operation. - writeOptions: { - // The number of times to retry the request. - retry?: number - // HTTP headers to include in request to Artifact Metadata API. - headers?: RequestHeaders - } +// Artifact details to associate the record with +export type ArtifactOptions = { + // The name of the artifact + name: string + // The digest of the artifact + digest: string + // The version of the artifact + version?: string + // The status of the artifact + status?: string } +// Includes details about the package registry the artifact was published to +export type PackageRegistryOptions = { + // The URL of the package registry + registryUrl: string + // The URL of the artifact in the package registry + artifactUrl?: string + // The package registry repository the artifact was published to. + repo?: string + // The path of the artifact in the package registry repository. + path?: string +} +// GitHub token for writing attestations. +token: string +// Optional parameters for the write operation. +// The number of times to retry the request. +cusomtRetry?: number +// HTTP headers to include in request to Artifact Metadata API. +headers?: RequestHeaders ``` ## Sigstore Instance diff --git a/packages/attest/__tests__/artifactMetadata.test.ts b/packages/attest/__tests__/artifactMetadata.test.ts index c447ba55..b3f781c6 100644 --- a/packages/attest/__tests__/artifactMetadata.test.ts +++ b/packages/attest/__tests__/artifactMetadata.test.ts @@ -6,17 +6,13 @@ describe('createStorageRecord', () => { const token = 'token' const headers = {'X-GitHub-Foo': 'true'} - const options = { - artifactOptions: { - name: 'my-lib', - version: '1.0.0', - digest: `sha256:${'a'.repeat(64)}` - }, - packageRegistryOptions: { - registryUrl: 'https://my-registry.org' - }, - token, - writeOptions: {headers} + const artifactOptions = { + name: 'my-lib', + version: '1.0.0', + digest: `sha256:${'a'.repeat(64)}` + } + const packageRegistryOptions = { + registryUrl: 'https://my-registry.org' } const mockAgent = new MockAgent() @@ -52,7 +48,7 @@ describe('createStorageRecord', () => { }) it('persists the storage record', async () => { - await expect(createStorageRecord(options)).resolves.toEqual([123, 456]) + await expect(createStorageRecord(artifactOptions, packageRegistryOptions, token, undefined, headers)).resolves.toEqual([123, 456]) }) }) @@ -76,10 +72,13 @@ describe('createStorageRecord', () => { it('throws an error', async () => { await expect( - createStorageRecord({ - ...options, - writeOptions: {retry: 0} - }) + createStorageRecord( + artifactOptions, + packageRegistryOptions, + token, + 0, + headers + ) ).rejects.toThrow(/oops/) }) }) @@ -94,8 +93,8 @@ describe('createStorageRecord', () => { method: 'POST', headers: {authorization: `token ${token}`}, body: JSON.stringify({ - ...options.artifactOptions, - registry_url: options.packageRegistryOptions.registryUrl + ...artifactOptions, + registry_url: packageRegistryOptions.registryUrl }) }) .reply(500, 'oops') @@ -107,8 +106,8 @@ describe('createStorageRecord', () => { method: 'POST', headers: {authorization: `token ${token}`}, body: JSON.stringify({ - ...options.artifactOptions, - registry_url: options.packageRegistryOptions.registryUrl + ...artifactOptions, + registry_url: packageRegistryOptions.registryUrl }) }) .reply(200, {storage_records: [{id: 123}, {id: 456}]}) @@ -117,10 +116,13 @@ describe('createStorageRecord', () => { it('persists the storage record', async () => { await expect( - createStorageRecord({ - ...options, - writeOptions: {} - }) + createStorageRecord( + artifactOptions, + packageRegistryOptions, + token, + undefined, + headers + ) ).resolves.toEqual([123, 456]) }) }) diff --git a/packages/attest/src/artifactMetadata.ts b/packages/attest/src/artifactMetadata.ts index 6a5c514f..e7e5a5bc 100644 --- a/packages/attest/src/artifactMetadata.ts +++ b/packages/attest/src/artifactMetadata.ts @@ -9,57 +9,54 @@ const DEFAULT_RETRY_COUNT = 5 /** * Options for creating a storage record for an attested artifact. */ -export type StorageRecordOptions = { +export type ArtifactOptions = { // Includes details about the attested artifact - artifactOptions: { - // The name of the artifact - name: string - // The digest of the artifact - digest: string - // The version of the artifact - version?: string - // The status of the artifact - status?: string - } + // The name of the artifact + name: string + // The digest of the artifact + digest: string + // The version of the artifact + version?: string + // The status of the artifact + status?: string +} // Includes details about the package registry the artifact was published to - packageRegistryOptions: { - // The URL of the package registry - registryUrl: string - // The URL of the artifact in the package registry - artifactUrl?: string - // The package registry repository the artifact was published to. - repo?: string - // The path of the artifact in the package registry repository. - path?: string - } - // GitHub token for writing attestations. - token: string - // Optional parameters for the write operation. - writeOptions: { - // The number of times to retry the request. - retry?: number - // HTTP headers to include in request to Artifact Metadata API. - headers?: RequestHeaders - } +export type PackageRegistryOptions = { + // The URL of the package registry + registryUrl: string + // The URL of the artifact in the package registry + artifactUrl?: string + // The package registry repository the artifact was published to. + repo?: string + // The path of the artifact in the package registry repository. + path?: string } /** * Writes a storage record on behalf of an artifact that has been attested - * @param StorageRecordOptions - parameters for the storage record API request. + * @param artifactOptions - parameters for the storage record API request. + * @param packageRegistryOptions - parameters for the package registry API request. + * @param token - GitHub token used to authenticate the request. + * @param retry - The number of retries to attempt if the request fails. + * @param headers - Additional headers to include in the request. + * * @returns The ID of the storage record. * @throws Error if the storage record fails to persist. */ export async function createStorageRecord( - options: StorageRecordOptions + artifactOptions: ArtifactOptions, + packageRegistryOptions: PackageRegistryOptions, + token: string, + customRetry?: number, + headers?: RequestHeaders ): Promise { - const retries = options.writeOptions.retry ?? DEFAULT_RETRY_COUNT - const octokit = github.getOctokit(options.token, {retry: {retries}}, retry) - + const retries = customRetry ?? DEFAULT_RETRY_COUNT + const octokit = github.getOctokit(token, {retry: {retries}}, retry) try { const response = await octokit.request(CREATE_STORAGE_RECORD_REQUEST, { owner: github.context.repo.owner, - headers: options.writeOptions.headers, - ...buildRequestParams(options) + headers: headers, + ...buildRequestParams(artifactOptions, packageRegistryOptions) }) const data = @@ -75,11 +72,12 @@ export async function createStorageRecord( } function buildRequestParams( - options: StorageRecordOptions + artifactOptions: ArtifactOptions, + packageRegistryOptions: PackageRegistryOptions ): Record { - const {registryUrl, artifactUrl, ...rest} = options.packageRegistryOptions + const {registryUrl, artifactUrl, ...rest} = packageRegistryOptions return { - ...options.artifactOptions, + ...artifactOptions, registry_url: registryUrl, artifact_url: artifactUrl, ...rest From 3d01d7ed694dc9ddc86a3d531643293322690df3 Mon Sep 17 00:00:00 2001 From: Meredith Lancaster Date: Tue, 9 Dec 2025 11:38:06 -0800 Subject: [PATCH 24/32] Update packages/attest/README.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> --- packages/attest/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/attest/README.md b/packages/attest/README.md index 12e75306..9cd0ccaa 100644 --- a/packages/attest/README.md +++ b/packages/attest/README.md @@ -236,7 +236,7 @@ export type PackageRegistryOptions = { token: string // Optional parameters for the write operation. // The number of times to retry the request. -cusomtRetry?: number +customRetry?: number // HTTP headers to include in request to Artifact Metadata API. headers?: RequestHeaders ``` From 539724611c6103a9f079834632dff243269b2977 Mon Sep 17 00:00:00 2001 From: Meredith Lancaster Date: Tue, 9 Dec 2025 11:39:12 -0800 Subject: [PATCH 25/32] param name Signed-off-by: Meredith Lancaster --- packages/attest/README.md | 2 +- packages/attest/src/artifactMetadata.ts | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/packages/attest/README.md b/packages/attest/README.md index 9cd0ccaa..22a087b3 100644 --- a/packages/attest/README.md +++ b/packages/attest/README.md @@ -236,7 +236,7 @@ export type PackageRegistryOptions = { token: string // Optional parameters for the write operation. // The number of times to retry the request. -customRetry?: number +retryAttempts?: number // HTTP headers to include in request to Artifact Metadata API. headers?: RequestHeaders ``` diff --git a/packages/attest/src/artifactMetadata.ts b/packages/attest/src/artifactMetadata.ts index e7e5a5bc..d6a24780 100644 --- a/packages/attest/src/artifactMetadata.ts +++ b/packages/attest/src/artifactMetadata.ts @@ -37,7 +37,7 @@ export type PackageRegistryOptions = { * @param artifactOptions - parameters for the storage record API request. * @param packageRegistryOptions - parameters for the package registry API request. * @param token - GitHub token used to authenticate the request. - * @param retry - The number of retries to attempt if the request fails. + * @param retryAttempts - The number of retries to attempt if the request fails. * @param headers - Additional headers to include in the request. * * @returns The ID of the storage record. @@ -47,10 +47,10 @@ export async function createStorageRecord( artifactOptions: ArtifactOptions, packageRegistryOptions: PackageRegistryOptions, token: string, - customRetry?: number, + retryAttempts?: number, headers?: RequestHeaders ): Promise { - const retries = customRetry ?? DEFAULT_RETRY_COUNT + const retries = retryAttempts ?? DEFAULT_RETRY_COUNT const octokit = github.getOctokit(token, {retry: {retries}}, retry) try { const response = await octokit.request(CREATE_STORAGE_RECORD_REQUEST, { From 701191f50edf17b38f97f1bca1422c41dbd80a74 Mon Sep 17 00:00:00 2001 From: Meredith Lancaster Date: Tue, 9 Dec 2025 11:40:40 -0800 Subject: [PATCH 26/32] fix linter issues Signed-off-by: Meredith Lancaster --- packages/attest/__tests__/artifactMetadata.test.ts | 10 +++++++++- packages/attest/src/artifactMetadata.ts | 6 +++--- 2 files changed, 12 insertions(+), 4 deletions(-) diff --git a/packages/attest/__tests__/artifactMetadata.test.ts b/packages/attest/__tests__/artifactMetadata.test.ts index b3f781c6..50d89dd6 100644 --- a/packages/attest/__tests__/artifactMetadata.test.ts +++ b/packages/attest/__tests__/artifactMetadata.test.ts @@ -48,7 +48,15 @@ describe('createStorageRecord', () => { }) it('persists the storage record', async () => { - await expect(createStorageRecord(artifactOptions, packageRegistryOptions, token, undefined, headers)).resolves.toEqual([123, 456]) + await expect( + createStorageRecord( + artifactOptions, + packageRegistryOptions, + token, + undefined, + headers + ) + ).resolves.toEqual([123, 456]) }) }) diff --git a/packages/attest/src/artifactMetadata.ts b/packages/attest/src/artifactMetadata.ts index d6a24780..a01d4b39 100644 --- a/packages/attest/src/artifactMetadata.ts +++ b/packages/attest/src/artifactMetadata.ts @@ -20,7 +20,7 @@ export type ArtifactOptions = { // The status of the artifact status?: string } - // Includes details about the package registry the artifact was published to +// Includes details about the package registry the artifact was published to export type PackageRegistryOptions = { // The URL of the package registry registryUrl: string @@ -39,7 +39,7 @@ export type PackageRegistryOptions = { * @param token - GitHub token used to authenticate the request. * @param retryAttempts - The number of retries to attempt if the request fails. * @param headers - Additional headers to include in the request. - * + * * @returns The ID of the storage record. * @throws Error if the storage record fails to persist. */ @@ -55,7 +55,7 @@ export async function createStorageRecord( try { const response = await octokit.request(CREATE_STORAGE_RECORD_REQUEST, { owner: github.context.repo.owner, - headers: headers, + headers, ...buildRequestParams(artifactOptions, packageRegistryOptions) }) From 8a2701f328e32f606b988bcc2e4a83a5375d1a55 Mon Sep 17 00:00:00 2001 From: Salman Muin Kayser Chishti Date: Wed, 10 Dec 2025 11:23:06 +0000 Subject: [PATCH 27/32] fix(cache): replace @azure/ms-rest-js with @azure/core-rest-pipeline Remove abandoned @azure/ms-rest-js dependency which pulls in node-fetch@v2, causing punycode deprecation warnings on Node.js 24+. The TransferProgressEvent type is now imported from @azure/core-rest-pipeline instead. --- packages/cache/__tests__/uploadUtils.test.ts | 2 +- packages/cache/package-lock.json | 511 ++----------------- packages/cache/package.json | 2 +- packages/cache/src/internal/downloadUtils.ts | 2 +- packages/cache/src/internal/uploadUtils.ts | 2 +- 5 files changed, 43 insertions(+), 476 deletions(-) diff --git a/packages/cache/__tests__/uploadUtils.test.ts b/packages/cache/__tests__/uploadUtils.test.ts index 2f0b8b55..2af567b7 100644 --- a/packages/cache/__tests__/uploadUtils.test.ts +++ b/packages/cache/__tests__/uploadUtils.test.ts @@ -1,5 +1,5 @@ import * as uploadUtils from '../src/internal/uploadUtils' -import {TransferProgressEvent} from '@azure/ms-rest-js' +import {TransferProgressEvent} from '@azure/core-rest-pipeline' test('upload progress tracked correctly', () => { const progress = new uploadUtils.UploadProgress(1000) diff --git a/packages/cache/package-lock.json b/packages/cache/package-lock.json index ba0d00a5..8b0b8c04 100644 --- a/packages/cache/package-lock.json +++ b/packages/cache/package-lock.json @@ -15,7 +15,7 @@ "@actions/http-client": "^2.1.1", "@actions/io": "^1.0.1", "@azure/abort-controller": "^1.1.0", - "@azure/ms-rest-js": "^2.6.0", + "@azure/core-rest-pipeline": "^1.22.0", "@azure/storage-blob": "^12.13.0", "@protobuf-ts/runtime-rpc": "^2.11.1", "semver": "^6.3.1" @@ -206,9 +206,9 @@ } }, "node_modules/@azure/core-rest-pipeline": { - "version": "1.22.1", - "resolved": "https://registry.npmjs.org/@azure/core-rest-pipeline/-/core-rest-pipeline-1.22.1.tgz", - "integrity": "sha512-UVZlVLfLyz6g3Hy7GNDpooMQonUygH7ghdiSASOOHy97fKj/mPLqgDX7aidOijn+sCMU+WU8NjlPlNTgnvbcGA==", + "version": "1.22.2", + "resolved": "https://registry.npmjs.org/@azure/core-rest-pipeline/-/core-rest-pipeline-1.22.2.tgz", + "integrity": "sha512-MzHym+wOi8CLUlKCQu12de0nwcq9k9Kuv43j4Wa++CsCpJwps2eeBQwD2Bu8snkxTtDKDx4GwjuR9E8yC8LNrg==", "license": "MIT", "dependencies": { "@azure/abort-controller": "^2.1.2", @@ -299,32 +299,10 @@ "node": ">=20.0.0" } }, - "node_modules/@azure/ms-rest-js": { - "version": "2.7.0", - "resolved": "https://registry.npmjs.org/@azure/ms-rest-js/-/ms-rest-js-2.7.0.tgz", - "integrity": "sha512-ngbzWbqF+NmztDOpLBVDxYM+XLcUj7nKhxGbSU9WtIsXfRB//cf2ZbAG5HkOrhU9/wd/ORRB6lM/d69RKVjiyA==", - "license": "MIT", - "dependencies": { - "@azure/core-auth": "^1.1.4", - "abort-controller": "^3.0.0", - "form-data": "^2.5.0", - "node-fetch": "^2.6.7", - "tslib": "^1.10.0", - "tunnel": "0.0.6", - "uuid": "^8.3.2", - "xml2js": "^0.5.0" - } - }, - "node_modules/@azure/ms-rest-js/node_modules/tslib": { - "version": "1.14.1", - "resolved": "https://registry.npmjs.org/tslib/-/tslib-1.14.1.tgz", - "integrity": "sha512-Xni35NKzjgMrwevysHTCArtLDpPvye8zV/0E4EyYn43P7/7qvQwPh9BGkHewbMulVntbigmcT7rdX3BNo9wRJg==", - "license": "0BSD" - }, "node_modules/@azure/storage-blob": { - "version": "12.28.0", - "resolved": "https://registry.npmjs.org/@azure/storage-blob/-/storage-blob-12.28.0.tgz", - "integrity": "sha512-VhQHITXXO03SURhDiGuHhvc/k/sD2WvJUS7hqhiVNbErVCuQoLtWql7r97fleBlIRKHJaa9R7DpBjfE0pfLYcA==", + "version": "12.29.1", + "resolved": "https://registry.npmjs.org/@azure/storage-blob/-/storage-blob-12.29.1.tgz", + "integrity": "sha512-7ktyY0rfTM0vo7HvtK6E3UvYnI9qfd6Oz6z/+92VhGRveWng3kJwMKeUpqmW/NmwcDNbxHpSlldG+vsUnRFnBg==", "license": "MIT", "dependencies": { "@azure/abort-controller": "^2.1.2", @@ -338,7 +316,7 @@ "@azure/core-util": "^1.11.0", "@azure/core-xml": "^1.4.5", "@azure/logger": "^1.1.4", - "@azure/storage-common": "^12.0.0-beta.2", + "@azure/storage-common": "^12.1.1", "events": "^3.0.0", "tslib": "^2.8.1" }, @@ -359,9 +337,9 @@ } }, "node_modules/@azure/storage-common": { - "version": "12.0.0", - "resolved": "https://registry.npmjs.org/@azure/storage-common/-/storage-common-12.0.0.tgz", - "integrity": "sha512-QyEWXgi4kdRo0wc1rHum9/KnaWZKCdQGZK1BjU4fFL6Jtedp7KLbQihgTTVxldFy1z1ZPtuDPx8mQ5l3huPPbA==", + "version": "12.1.1", + "resolved": "https://registry.npmjs.org/@azure/storage-common/-/storage-common-12.1.1.tgz", + "integrity": "sha512-eIOH1pqFwI6UmVNnDQvmFeSg0XppuzDLFeUNO/Xht7ODAzRLgGDh7h550pSxoA+lPDxBl1+D2m/KG3jWzCUjTg==", "license": "MIT", "dependencies": { "@azure/abort-controller": "^2.1.2", @@ -391,21 +369,21 @@ } }, "node_modules/@bufbuild/protobuf": { - "version": "2.9.0", - "resolved": "https://registry.npmjs.org/@bufbuild/protobuf/-/protobuf-2.9.0.tgz", - "integrity": "sha512-rnJenoStJ8nvmt9Gzye8nkYd6V22xUAnu4086ER7h1zJ508vStko4pMvDeQ446ilDTFpV5wnoc5YS7XvMwwMqA==", + "version": "2.10.1", + "resolved": "https://registry.npmjs.org/@bufbuild/protobuf/-/protobuf-2.10.1.tgz", + "integrity": "sha512-ckS3+vyJb5qGpEYv/s1OebUHDi/xSNtfgw1wqKZo7MR9F2z+qXr0q5XagafAG/9O0QPVIUfST0smluYSTpYFkg==", "dev": true, "license": "(Apache-2.0 AND BSD-3-Clause)" }, "node_modules/@bufbuild/protoplugin": { - "version": "2.9.0", - "resolved": "https://registry.npmjs.org/@bufbuild/protoplugin/-/protoplugin-2.9.0.tgz", - "integrity": "sha512-uoiwNVYoTq+AyqaV1L6pBazGx5fXOO89L0NSR9/7hEfo0Y8n9T1jsKGu4mkitLmP3z+8gJREaule1mMuKBPyYw==", + "version": "2.10.1", + "resolved": "https://registry.npmjs.org/@bufbuild/protoplugin/-/protoplugin-2.10.1.tgz", + "integrity": "sha512-imB8dKEjrOnG5+XqVS+CeYn924WGLU/g3wogKhk11XtX9y9NJ7432OS6h24asuBbLrQcPdEZ6QkfM7KeOCeeyQ==", "dev": true, "license": "Apache-2.0", "dependencies": { - "@bufbuild/protobuf": "2.9.0", - "@typescript/vfs": "^1.5.2", + "@bufbuild/protobuf": "2.10.1", + "@typescript/vfs": "^1.6.2", "typescript": "5.4.5" } }, @@ -491,13 +469,13 @@ } }, "node_modules/@types/node": { - "version": "24.5.2", - "resolved": "https://registry.npmjs.org/@types/node/-/node-24.5.2.tgz", - "integrity": "sha512-FYxk1I7wPv3K2XBaoyH2cTnocQEu8AOZ60hPbsyukMPLv5/5qr7V1i8PLHdl6Zf87I+xZXFvPCXYjiTFq+YSDQ==", + "version": "24.10.2", + "resolved": "https://registry.npmjs.org/@types/node/-/node-24.10.2.tgz", + "integrity": "sha512-WOhQTZ4G8xZ1tjJTvKOpyEVSGgOTvJAfDK3FNFgELyaTpzhdgHVHeqW8V+UJvzF5BT+/B54T/1S2K6gd9c7bbA==", "dev": true, "license": "MIT", "dependencies": { - "undici-types": "~7.12.0" + "undici-types": "~7.16.0" } }, "node_modules/@types/semver": { @@ -508,9 +486,9 @@ "license": "MIT" }, "node_modules/@typescript/vfs": { - "version": "1.6.1", - "resolved": "https://registry.npmjs.org/@typescript/vfs/-/vfs-1.6.1.tgz", - "integrity": "sha512-JwoxboBh7Oz1v38tPbkrZ62ZXNHAk9bJ7c9x0eI5zBfBnBYGhURdbnh7Z4smN/MV48Y5OCcZb58n972UtbazsA==", + "version": "1.6.2", + "resolved": "https://registry.npmjs.org/@typescript/vfs/-/vfs-1.6.2.tgz", + "integrity": "sha512-hoBwJwcbKHmvd2QVebiytN1aELvpk9B74B4L1mFm/XT1Q/VOYAWl2vQ9AWRFtQq8zmz6enTpfTV8WRc4ATjW/g==", "dev": true, "license": "MIT", "dependencies": { @@ -521,9 +499,9 @@ } }, "node_modules/@typespec/ts-http-runtime": { - "version": "0.3.1", - "resolved": "https://registry.npmjs.org/@typespec/ts-http-runtime/-/ts-http-runtime-0.3.1.tgz", - "integrity": "sha512-SnbaqayTVFEA6/tYumdF0UmybY0KHyKwGPBXnyckFlrrKdhWFrL3a2HIPXHjht5ZOElKGcXfD2D63P36btb+ww==", + "version": "0.3.2", + "resolved": "https://registry.npmjs.org/@typespec/ts-http-runtime/-/ts-http-runtime-0.3.2.tgz", + "integrity": "sha512-IlqQ/Gv22xUC1r/WQm4StLkYQmaaTsXAhUVsNE0+xiyf0yRFiH5++q78U3bw6bLKDCTmh0uqKB9eG9+Bt75Dkg==", "license": "MIT", "dependencies": { "http-proxy-agent": "^7.0.0", @@ -534,18 +512,6 @@ "node": ">=20.0.0" } }, - "node_modules/abort-controller": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/abort-controller/-/abort-controller-3.0.0.tgz", - "integrity": "sha512-h8lQ8tacZYnR3vNQTgibj+tODHI5/+l06Au2Pcriv/Gmet0eaj4TwWH41sO9wnHDiQsEj19q0drzdWdeAHtweg==", - "license": "MIT", - "dependencies": { - "event-target-shim": "^5.0.0" - }, - "engines": { - "node": ">=6.5" - } - }, "node_modules/agent-base": { "version": "7.1.4", "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.4.tgz", @@ -555,12 +521,6 @@ "node": ">= 14" } }, - "node_modules/asynckit": { - "version": "0.4.0", - "resolved": "https://registry.npmjs.org/asynckit/-/asynckit-0.4.0.tgz", - "integrity": "sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==", - "license": "MIT" - }, "node_modules/balanced-match": { "version": "1.0.2", "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz", @@ -577,46 +537,12 @@ "concat-map": "0.0.1" } }, - "node_modules/call-bind-apply-helpers": { - "version": "1.0.2", - "resolved": "https://registry.npmjs.org/call-bind-apply-helpers/-/call-bind-apply-helpers-1.0.2.tgz", - "integrity": "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ==", - "license": "MIT", - "dependencies": { - "es-errors": "^1.3.0", - "function-bind": "^1.1.2" - }, - "engines": { - "node": ">= 0.4" - } - }, - "node_modules/combined-stream": { - "version": "1.0.8", - "resolved": "https://registry.npmjs.org/combined-stream/-/combined-stream-1.0.8.tgz", - "integrity": "sha512-FQN4MRfuJeHf7cBbBMJFXhKSDq+2kAArBlmRBvcvFE5BB1HZKXtSFASDhdlz9zOYwxh8lDdnvmMOe/+5cdoEdg==", - "license": "MIT", - "dependencies": { - "delayed-stream": "~1.0.0" - }, - "engines": { - "node": ">= 0.8" - } - }, "node_modules/concat-map": { "version": "0.0.1", "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz", "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==", "license": "MIT" }, - "node_modules/data-uri-to-buffer": { - "version": "4.0.1", - "resolved": "https://registry.npmjs.org/data-uri-to-buffer/-/data-uri-to-buffer-4.0.1.tgz", - "integrity": "sha512-0R9ikRb668HB7QDxT1vkpuUBtqc53YyAwMwGeUFKRojY/NWKvdZ+9UYtRfGmhqNbRkTSVpMbmyhXipFFv2cb/A==", - "license": "MIT", - "engines": { - "node": ">= 12" - } - }, "node_modules/debug": { "version": "4.4.3", "resolved": "https://registry.npmjs.org/debug/-/debug-4.4.3.tgz", @@ -634,83 +560,6 @@ } } }, - "node_modules/delayed-stream": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/delayed-stream/-/delayed-stream-1.0.0.tgz", - "integrity": "sha512-ZySD7Nf91aLB0RxL4KGrKHBXl7Eds1DAmEdcoVawXnLD7SDhpNgtuII2aAkg7a7QS41jxPSZ17p4VdGnMHk3MQ==", - "license": "MIT", - "engines": { - "node": ">=0.4.0" - } - }, - "node_modules/dunder-proto": { - "version": "1.0.1", - "resolved": "https://registry.npmjs.org/dunder-proto/-/dunder-proto-1.0.1.tgz", - "integrity": "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A==", - "license": "MIT", - "dependencies": { - "call-bind-apply-helpers": "^1.0.1", - "es-errors": "^1.3.0", - "gopd": "^1.2.0" - }, - "engines": { - "node": ">= 0.4" - } - }, - "node_modules/es-define-property": { - "version": "1.0.1", - "resolved": "https://registry.npmjs.org/es-define-property/-/es-define-property-1.0.1.tgz", - "integrity": "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g==", - "license": "MIT", - "engines": { - "node": ">= 0.4" - } - }, - "node_modules/es-errors": { - "version": "1.3.0", - "resolved": "https://registry.npmjs.org/es-errors/-/es-errors-1.3.0.tgz", - "integrity": "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw==", - "license": "MIT", - "engines": { - "node": ">= 0.4" - } - }, - "node_modules/es-object-atoms": { - "version": "1.1.1", - "resolved": "https://registry.npmjs.org/es-object-atoms/-/es-object-atoms-1.1.1.tgz", - "integrity": "sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA==", - "license": "MIT", - "dependencies": { - "es-errors": "^1.3.0" - }, - "engines": { - "node": ">= 0.4" - } - }, - "node_modules/es-set-tostringtag": { - "version": "2.1.0", - "resolved": "https://registry.npmjs.org/es-set-tostringtag/-/es-set-tostringtag-2.1.0.tgz", - "integrity": "sha512-j6vWzfrGVfyXxge+O0x5sh6cvxAog0a/4Rdd2K36zCMV5eJ+/+tOAngRO8cODMNWbVRdVlmGZQL2YS3yR8bIUA==", - "license": "MIT", - "dependencies": { - "es-errors": "^1.3.0", - "get-intrinsic": "^1.2.6", - "has-tostringtag": "^1.0.2", - "hasown": "^2.0.2" - }, - "engines": { - "node": ">= 0.4" - } - }, - "node_modules/event-target-shim": { - "version": "5.0.1", - "resolved": "https://registry.npmjs.org/event-target-shim/-/event-target-shim-5.0.1.tgz", - "integrity": "sha512-i/2XbnSz/uxRCU6+NdVJgKWDTM427+MqYbkQzD321DuCQJUqOuJKIA0IM2+W2xtYHdKOmZ4dR6fExsd4SXL+WQ==", - "license": "MIT", - "engines": { - "node": ">=6" - } - }, "node_modules/events": { "version": "3.3.0", "resolved": "https://registry.npmjs.org/events/-/events-3.3.0.tgz", @@ -721,9 +570,9 @@ } }, "node_modules/fast-xml-parser": { - "version": "5.2.5", - "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.2.5.tgz", - "integrity": "sha512-pfX9uG9Ki0yekDHx2SiuRIyFdyAr1kMIMitPvb0YBo8SUfKvia7w7FIyd/l6av85pFYRhZscS75MwMnbvY+hcQ==", + "version": "5.3.2", + "resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.3.2.tgz", + "integrity": "sha512-n8v8b6p4Z1sMgqRmqLJm3awW4NX7NkaKPfb3uJIBTSH7Pdvufi3PQ3/lJLQrvxcMYl7JI2jnDO90siPEpD8JBA==", "funding": [ { "type": "github", @@ -738,155 +587,6 @@ "fxparser": "src/cli/cli.js" } }, - "node_modules/fetch-blob": { - "version": "3.2.0", - "resolved": "https://registry.npmjs.org/fetch-blob/-/fetch-blob-3.2.0.tgz", - "integrity": "sha512-7yAQpD2UMJzLi1Dqv7qFYnPbaPx7ZfFK6PiIxQ4PfkGPyNyl2Ugx+a/umUonmKqjhM4DnfbMvdX6otXq83soQQ==", - "funding": [ - { - "type": "github", - "url": "https://github.com/sponsors/jimmywarting" - }, - { - "type": "paypal", - "url": "https://paypal.me/jimmywarting" - } - ], - "license": "MIT", - "dependencies": { - "node-domexception": "^1.0.0", - "web-streams-polyfill": "^3.0.3" - }, - "engines": { - "node": "^12.20 || >= 14.13" - } - }, - "node_modules/form-data": { - "version": "2.5.5", - "resolved": "https://registry.npmjs.org/form-data/-/form-data-2.5.5.tgz", - "integrity": "sha512-jqdObeR2rxZZbPSGL+3VckHMYtu+f9//KXBsVny6JSX/pa38Fy+bGjuG8eW/H6USNQWhLi8Num++cU2yOCNz4A==", - "license": "MIT", - "dependencies": { - "asynckit": "^0.4.0", - "combined-stream": "^1.0.8", - "es-set-tostringtag": "^2.1.0", - "hasown": "^2.0.2", - "mime-types": "^2.1.35", - "safe-buffer": "^5.2.1" - }, - "engines": { - "node": ">= 0.12" - } - }, - "node_modules/formdata-polyfill": { - "version": "4.0.10", - "resolved": "https://registry.npmjs.org/formdata-polyfill/-/formdata-polyfill-4.0.10.tgz", - "integrity": "sha512-buewHzMvYL29jdeQTVILecSaZKnt/RJWjoZCF5OW60Z67/GmSLBkOFM7qh1PI3zFNtJbaZL5eQu1vLfazOwj4g==", - "license": "MIT", - "dependencies": { - "fetch-blob": "^3.1.2" - }, - "engines": { - "node": ">=12.20.0" - } - }, - "node_modules/function-bind": { - "version": "1.1.2", - "resolved": "https://registry.npmjs.org/function-bind/-/function-bind-1.1.2.tgz", - "integrity": "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA==", - "license": "MIT", - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/get-intrinsic": { - "version": "1.3.0", - "resolved": "https://registry.npmjs.org/get-intrinsic/-/get-intrinsic-1.3.0.tgz", - "integrity": "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ==", - "license": "MIT", - "dependencies": { - "call-bind-apply-helpers": "^1.0.2", - "es-define-property": "^1.0.1", - "es-errors": "^1.3.0", - "es-object-atoms": "^1.1.1", - "function-bind": "^1.1.2", - "get-proto": "^1.0.1", - "gopd": "^1.2.0", - "has-symbols": "^1.1.0", - "hasown": "^2.0.2", - "math-intrinsics": "^1.1.0" - }, - "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/get-proto": { - "version": "1.0.1", - "resolved": "https://registry.npmjs.org/get-proto/-/get-proto-1.0.1.tgz", - "integrity": "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g==", - "license": "MIT", - "dependencies": { - "dunder-proto": "^1.0.1", - "es-object-atoms": "^1.0.0" - }, - "engines": { - "node": ">= 0.4" - } - }, - "node_modules/gopd": { - "version": "1.2.0", - "resolved": "https://registry.npmjs.org/gopd/-/gopd-1.2.0.tgz", - "integrity": "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg==", - "license": "MIT", - "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/has-symbols": { - "version": "1.1.0", - "resolved": "https://registry.npmjs.org/has-symbols/-/has-symbols-1.1.0.tgz", - "integrity": "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ==", - "license": "MIT", - "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/has-tostringtag": { - "version": "1.0.2", - "resolved": "https://registry.npmjs.org/has-tostringtag/-/has-tostringtag-1.0.2.tgz", - "integrity": "sha512-NqADB8VjPFLM2V0VvHUewwwsw0ZWBaIdgo+ieHtK3hasLz4qeCRjYcqfB6AQrBggRKppKF8L52/VqdVsO47Dlw==", - "license": "MIT", - "dependencies": { - "has-symbols": "^1.0.3" - }, - "engines": { - "node": ">= 0.4" - }, - "funding": { - "url": "https://github.com/sponsors/ljharb" - } - }, - "node_modules/hasown": { - "version": "2.0.2", - "resolved": "https://registry.npmjs.org/hasown/-/hasown-2.0.2.tgz", - "integrity": "sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ==", - "license": "MIT", - "dependencies": { - "function-bind": "^1.1.2" - }, - "engines": { - "node": ">= 0.4" - } - }, "node_modules/http-proxy-agent": { "version": "7.0.2", "resolved": "https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-7.0.2.tgz", @@ -913,36 +613,6 @@ "node": ">= 14" } }, - "node_modules/math-intrinsics": { - "version": "1.1.0", - "resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz", - "integrity": "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==", - "license": "MIT", - "engines": { - "node": ">= 0.4" - } - }, - "node_modules/mime-db": { - "version": "1.52.0", - "resolved": "https://registry.npmjs.org/mime-db/-/mime-db-1.52.0.tgz", - "integrity": "sha512-sPU4uV7dYlvtWJxwwxHD0PuihVNiE7TyAbQ5SWxDCB9mUYvOgroQOwYQQOKPJ8CIbE+1ETVlOoK1UC2nU3gYvg==", - "license": "MIT", - "engines": { - "node": ">= 0.6" - } - }, - "node_modules/mime-types": { - "version": "2.1.35", - "resolved": "https://registry.npmjs.org/mime-types/-/mime-types-2.1.35.tgz", - "integrity": "sha512-ZDY+bPm5zTTF+YpCrAU9nK0UgICYPT0QtT1NZWFv4s++TNkcgVaT0g6+4R2uI4MjQjzysHB1zxuWL50hzaeXiw==", - "license": "MIT", - "dependencies": { - "mime-db": "1.52.0" - }, - "engines": { - "node": ">= 0.6" - } - }, "node_modules/minimatch": { "version": "3.1.2", "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz", @@ -961,70 +631,6 @@ "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==", "license": "MIT" }, - "node_modules/node-domexception": { - "version": "1.0.0", - "resolved": "https://registry.npmjs.org/node-domexception/-/node-domexception-1.0.0.tgz", - "integrity": "sha512-/jKZoMpw0F8GRwl4/eLROPA3cfcXtLApP0QzLmUT/HuPCZWyB7IY9ZrMeKw2O/nFIqPQB3PVM9aYm0F312AXDQ==", - "deprecated": "Use your platform's native DOMException instead", - "funding": [ - { - "type": "github", - "url": "https://github.com/sponsors/jimmywarting" - }, - { - "type": "github", - "url": "https://paypal.me/jimmywarting" - } - ], - "license": "MIT", - "engines": { - "node": ">=10.5.0" - } - }, - "node_modules/node-fetch": { - "version": "3.3.2", - "resolved": "https://registry.npmjs.org/node-fetch/-/node-fetch-3.3.2.tgz", - "integrity": "sha512-dRB78srN/l6gqWulah9SrxeYnxeddIG30+GOqK/9OlLVyLg3HPnr6SqOWTWOXKRwC2eGYCkZ59NNuSgvSrpgOA==", - "license": "MIT", - "dependencies": { - "data-uri-to-buffer": "^4.0.0", - "fetch-blob": "^3.1.4", - "formdata-polyfill": "^4.0.10" - }, - "engines": { - "node": "^12.20.0 || ^14.13.1 || >=16.0.0" - }, - "funding": { - "type": "opencollective", - "url": "https://opencollective.com/node-fetch" - } - }, - "node_modules/safe-buffer": { - "version": "5.2.1", - "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz", - "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==", - "funding": [ - { - "type": "github", - "url": "https://github.com/sponsors/feross" - }, - { - "type": "patreon", - "url": "https://www.patreon.com/feross" - }, - { - "type": "consulting", - "url": "https://feross.org/support" - } - ], - "license": "MIT" - }, - "node_modules/sax": { - "version": "1.4.1", - "resolved": "https://registry.npmjs.org/sax/-/sax-1.4.1.tgz", - "integrity": "sha512-+aWOz7yVScEGoKNd4PA10LZ8sk0A/z5+nXQG5giUO5rprX9jgYsTdov9qCchZiPIZezbZH+jRut8nPodFAX4Jg==", - "license": "ISC" - }, "node_modules/semver": { "version": "6.3.1", "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.1.tgz", @@ -1062,11 +668,12 @@ } }, "node_modules/typescript": { - "version": "5.9.2", - "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.2.tgz", - "integrity": "sha512-CWBzXQrc/qOkhidw1OzBTQuYRbfyxDXJMVJ1XNwUHGROVmuaeiEm3OslpZ1RV96d7SKKjZKrSJu3+t/xlw3R9A==", + "version": "5.9.3", + "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.9.3.tgz", + "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==", "dev": true, "license": "Apache-2.0", + "peer": true, "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver" @@ -1088,51 +695,11 @@ } }, "node_modules/undici-types": { - "version": "7.12.0", - "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.12.0.tgz", - "integrity": "sha512-goOacqME2GYyOZZfb5Lgtu+1IDmAlAEu5xnD3+xTzS10hT0vzpf0SPjkXwAw9Jm+4n/mQGDP3LO8CPbYROeBfQ==", + "version": "7.16.0", + "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-7.16.0.tgz", + "integrity": "sha512-Zz+aZWSj8LE6zoxD+xrjh4VfkIG8Ya6LvYkZqtUQGJPZjYl53ypCaUwWqo7eI0x66KBGeRo+mlBEkMSeSZ38Nw==", "dev": true, "license": "MIT" - }, - "node_modules/uuid": { - "version": "8.3.2", - "resolved": "https://registry.npmjs.org/uuid/-/uuid-8.3.2.tgz", - "integrity": "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==", - "license": "MIT", - "bin": { - "uuid": "dist/bin/uuid" - } - }, - "node_modules/web-streams-polyfill": { - "version": "3.3.3", - "resolved": "https://registry.npmjs.org/web-streams-polyfill/-/web-streams-polyfill-3.3.3.tgz", - "integrity": "sha512-d2JWLCivmZYTSIoge9MsgFCZrt571BikcWGYkjC1khllbTeDlGqZ2D8vD8E/lJa8WGWbb7Plm8/XJYV7IJHZZw==", - "license": "MIT", - "engines": { - "node": ">= 8" - } - }, - "node_modules/xml2js": { - "version": "0.5.0", - "resolved": "https://registry.npmjs.org/xml2js/-/xml2js-0.5.0.tgz", - "integrity": "sha512-drPFnkQJik/O+uPKpqSgr22mpuFHqKdbS835iAQrUC73L2F5WkboIRd63ai/2Yg6I1jzifPFKH2NTK+cfglkIA==", - "license": "MIT", - "dependencies": { - "sax": ">=0.6.0", - "xmlbuilder": "~11.0.0" - }, - "engines": { - "node": ">=4.0.0" - } - }, - "node_modules/xmlbuilder": { - "version": "11.0.1", - "resolved": "https://registry.npmjs.org/xmlbuilder/-/xmlbuilder-11.0.1.tgz", - "integrity": "sha512-fDlsI/kFEx7gLvbecc0/ohLG50fugQp8ryHzMTuW9vSa1GJ0XYWKnhsUx7oie3G98+r56aTQIUB4kht42R3JvA==", - "license": "MIT", - "engines": { - "node": ">=4.0" - } } } } diff --git a/packages/cache/package.json b/packages/cache/package.json index 5db55185..bc433af8 100644 --- a/packages/cache/package.json +++ b/packages/cache/package.json @@ -44,7 +44,7 @@ "@actions/http-client": "^2.1.1", "@actions/io": "^1.0.1", "@azure/abort-controller": "^1.1.0", - "@azure/ms-rest-js": "^2.6.0", + "@azure/core-rest-pipeline": "^1.22.0", "@azure/storage-blob": "^12.13.0", "semver": "^6.3.1" }, diff --git a/packages/cache/src/internal/downloadUtils.ts b/packages/cache/src/internal/downloadUtils.ts index de57ed78..3eda63b5 100644 --- a/packages/cache/src/internal/downloadUtils.ts +++ b/packages/cache/src/internal/downloadUtils.ts @@ -1,7 +1,7 @@ import * as core from '@actions/core' import {HttpClient, HttpClientResponse} from '@actions/http-client' import {BlockBlobClient} from '@azure/storage-blob' -import {TransferProgressEvent} from '@azure/ms-rest-js' +import {TransferProgressEvent} from '@azure/core-rest-pipeline' import * as buffer from 'buffer' import * as fs from 'fs' import * as stream from 'stream' diff --git a/packages/cache/src/internal/uploadUtils.ts b/packages/cache/src/internal/uploadUtils.ts index 1b4f7af0..a0e4961d 100644 --- a/packages/cache/src/internal/uploadUtils.ts +++ b/packages/cache/src/internal/uploadUtils.ts @@ -5,7 +5,7 @@ import { BlockBlobClient, BlockBlobParallelUploadOptions } from '@azure/storage-blob' -import {TransferProgressEvent} from '@azure/ms-rest-js' +import {TransferProgressEvent} from '@azure/core-rest-pipeline' import {InvalidResponseError} from './shared/errors' import {UploadOptions} from '../options' From e48877e66c8c8dd19de83d937f6ae6bb1e2b98c2 Mon Sep 17 00:00:00 2001 From: Salman Muin Kayser Chishti Date: Wed, 10 Dec 2025 11:27:38 +0000 Subject: [PATCH 28/32] chore(cache): bump @actions/* dependencies to v2/v3 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - @actions/core: ^1.11.1 → ^2.0.0 - @actions/exec: ^1.0.1 → ^2.0.0 - @actions/glob: ^0.1.0 → ^0.5.0 - @actions/http-client: ^2.1.1 → ^3.0.0 - @actions/io: ^1.0.1 → ^2.0.0 --- packages/cache/package-lock.json | 86 +++++++++++++++++++++++++------- packages/cache/package.json | 10 ++-- 2 files changed, 73 insertions(+), 23 deletions(-) diff --git a/packages/cache/package-lock.json b/packages/cache/package-lock.json index 8b0b8c04..80a4f370 100644 --- a/packages/cache/package-lock.json +++ b/packages/cache/package-lock.json @@ -9,11 +9,11 @@ "version": "5.0.0", "license": "MIT", "dependencies": { - "@actions/core": "^1.11.1", - "@actions/exec": "^1.0.1", - "@actions/glob": "^0.1.0", - "@actions/http-client": "^2.1.1", - "@actions/io": "^1.0.1", + "@actions/core": "^2.0.0", + "@actions/exec": "^2.0.0", + "@actions/glob": "^0.5.0", + "@actions/http-client": "^3.0.0", + "@actions/io": "^2.0.0", "@azure/abort-controller": "^1.1.0", "@azure/core-rest-pipeline": "^1.22.0", "@azure/storage-blob": "^12.13.0", @@ -28,6 +28,50 @@ } }, "node_modules/@actions/core": { + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/@actions/core/-/core-2.0.0.tgz", + "integrity": "sha512-iGW52/zqhPUFnYl0s1ioXfJu86LGs7b+GYuO38JMPpsh14FQrNj3n2JBpC+vZ2CFS4lERQyn5koLDopY+6V/PQ==", + "license": "MIT", + "dependencies": { + "@actions/exec": "^1.1.1", + "@actions/http-client": "^3.0.0" + } + }, + "node_modules/@actions/core/node_modules/@actions/exec": { + "version": "1.1.1", + "resolved": "https://registry.npmjs.org/@actions/exec/-/exec-1.1.1.tgz", + "integrity": "sha512-+sCcHHbVdk93a0XT19ECtO/gIXoxvdsgQLzb2fE2/5sIZmWQuluYyjPQtrtTHdU1YzTZ7bAPN4sITq2xi1679w==", + "license": "MIT", + "dependencies": { + "@actions/io": "^1.0.1" + } + }, + "node_modules/@actions/core/node_modules/@actions/io": { + "version": "1.1.3", + "resolved": "https://registry.npmjs.org/@actions/io/-/io-1.1.3.tgz", + "integrity": "sha512-wi9JjgKLYS7U/z8PPbco+PvTb/nRWjeoFlJ1Qer83k/3C5PHQi28hiVdeE2kHXmIL99mQFawx8qt/JPjZilJ8Q==", + "license": "MIT" + }, + "node_modules/@actions/exec": { + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/@actions/exec/-/exec-2.0.0.tgz", + "integrity": "sha512-k8ngrX2voJ/RIN6r9xB82NVqKpnMRtxDoiO+g3olkIUpQNqjArXrCQceduQZCQj3P3xm32pChRLqRrtXTlqhIw==", + "license": "MIT", + "dependencies": { + "@actions/io": "^2.0.0" + } + }, + "node_modules/@actions/glob": { + "version": "0.5.0", + "resolved": "https://registry.npmjs.org/@actions/glob/-/glob-0.5.0.tgz", + "integrity": "sha512-tST2rjPvJLRZLuT9NMUtyBjvj9Yo0MiJS3ow004slMvm8GFM+Zv9HvMJ7HWzfUyJnGrJvDsYkWBaaG3YKXRtCw==", + "license": "MIT", + "dependencies": { + "@actions/core": "^1.9.1", + "minimatch": "^3.0.4" + } + }, + "node_modules/@actions/glob/node_modules/@actions/core": { "version": "1.11.1", "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.11.1.tgz", "integrity": "sha512-hXJCSrkwfA46Vd9Z3q4cpEpHB1rL5NG04+/rbqW9d3+CSvtB1tYe8UTpAlixa1vj0m/ULglfEK2UKxMGxCxv5A==", @@ -37,7 +81,7 @@ "@actions/http-client": "^2.0.1" } }, - "node_modules/@actions/exec": { + "node_modules/@actions/glob/node_modules/@actions/exec": { "version": "1.1.1", "resolved": "https://registry.npmjs.org/@actions/exec/-/exec-1.1.1.tgz", "integrity": "sha512-+sCcHHbVdk93a0XT19ECtO/gIXoxvdsgQLzb2fE2/5sIZmWQuluYyjPQtrtTHdU1YzTZ7bAPN4sITq2xi1679w==", @@ -46,17 +90,7 @@ "@actions/io": "^1.0.1" } }, - "node_modules/@actions/glob": { - "version": "0.1.2", - "resolved": "https://registry.npmjs.org/@actions/glob/-/glob-0.1.2.tgz", - "integrity": "sha512-SclLR7Ia5sEqjkJTPs7Sd86maMDw43p769YxBOxvPvEWuPEhpAnBsQfENOpXjFYMmhCqd127bmf+YdvJqVqR4A==", - "license": "MIT", - "dependencies": { - "@actions/core": "^1.2.6", - "minimatch": "^3.0.4" - } - }, - "node_modules/@actions/http-client": { + "node_modules/@actions/glob/node_modules/@actions/http-client": { "version": "2.2.3", "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-2.2.3.tgz", "integrity": "sha512-mx8hyJi/hjFvbPokCg4uRd4ZX78t+YyRPtnKWwIl+RzNaVuFpQHfmlGVfsKEJN8LwTCvL+DfVgAM04XaHkm6bA==", @@ -66,12 +100,28 @@ "undici": "^5.25.4" } }, - "node_modules/@actions/io": { + "node_modules/@actions/glob/node_modules/@actions/io": { "version": "1.1.3", "resolved": "https://registry.npmjs.org/@actions/io/-/io-1.1.3.tgz", "integrity": "sha512-wi9JjgKLYS7U/z8PPbco+PvTb/nRWjeoFlJ1Qer83k/3C5PHQi28hiVdeE2kHXmIL99mQFawx8qt/JPjZilJ8Q==", "license": "MIT" }, + "node_modules/@actions/http-client": { + "version": "3.0.0", + "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-3.0.0.tgz", + "integrity": "sha512-1s3tXAfVMSz9a4ZEBkXXRQD4QhY3+GAsWSbaYpeknPOKEeyRiU3lH+bHiLMZdo2x/fIeQ/hscL1wCkDLVM2DZQ==", + "license": "MIT", + "dependencies": { + "tunnel": "^0.0.6", + "undici": "^5.28.5" + } + }, + "node_modules/@actions/io": { + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/@actions/io/-/io-2.0.0.tgz", + "integrity": "sha512-Jv33IN09XLO+0HS79aaODsvIRyduiF7NY/F6LYeK5oeUmrsz7aFdRphQjFoESF4jS7lMauDOttKALcpapVDIAg==", + "license": "MIT" + }, "node_modules/@azure/abort-controller": { "version": "1.1.0", "resolved": "https://registry.npmjs.org/@azure/abort-controller/-/abort-controller-1.1.0.tgz", diff --git a/packages/cache/package.json b/packages/cache/package.json index bc433af8..ea5077f1 100644 --- a/packages/cache/package.json +++ b/packages/cache/package.json @@ -37,12 +37,12 @@ "url": "https://github.com/actions/toolkit/issues" }, "dependencies": { - "@actions/core": "^1.11.1", - "@actions/exec": "^1.0.1", - "@actions/glob": "^0.1.0", + "@actions/core": "^2.0.0", + "@actions/exec": "^2.0.0", + "@actions/glob": "^0.5.0", "@protobuf-ts/runtime-rpc": "^2.11.1", - "@actions/http-client": "^2.1.1", - "@actions/io": "^1.0.1", + "@actions/http-client": "^3.0.0", + "@actions/io": "^2.0.0", "@azure/abort-controller": "^1.1.0", "@azure/core-rest-pipeline": "^1.22.0", "@azure/storage-blob": "^12.13.0", From b2e6a5a28443cecb974b5b430fc2d2b54c291c63 Mon Sep 17 00:00:00 2001 From: Salman Muin Kayser Chishti Date: Wed, 10 Dec 2025 11:48:55 +0000 Subject: [PATCH 29/32] chore(core): bump @actions/exec from ^1.1.1 to ^2.0.0 Aligns with cache package which already uses exec@2.0.0, avoiding nested duplicate dependencies. --- packages/core/RELEASES.md | 3 ++ packages/core/package-lock.json | 82 ++++++++------------------------- packages/core/package.json | 4 +- 3 files changed, 24 insertions(+), 65 deletions(-) diff --git a/packages/core/RELEASES.md b/packages/core/RELEASES.md index 3afc9050..47e30ea7 100644 --- a/packages/core/RELEASES.md +++ b/packages/core/RELEASES.md @@ -1,5 +1,8 @@ # @actions/core Releases +## 2.0.1 +- Bump @actions/exec from 1.1.1 to 2.0.0 [#2199](https://github.com/actions/toolkit/pull/2199) + ## 2.0.0 - Add support for Node 24 [#2110](https://github.com/actions/toolkit/pull/2110) - Bump @actions/http-client from 2.0.1 to 3.0.0 diff --git a/packages/core/package-lock.json b/packages/core/package-lock.json index 924750d6..68c87516 100644 --- a/packages/core/package-lock.json +++ b/packages/core/package-lock.json @@ -1,15 +1,15 @@ { "name": "@actions/core", - "version": "2.0.0", - "lockfileVersion": 2, + "version": "2.0.1", + "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "@actions/core", - "version": "2.0.0", + "version": "2.0.1", "license": "MIT", "dependencies": { - "@actions/exec": "^1.1.1", + "@actions/exec": "^2.0.0", "@actions/http-client": "^3.0.0" }, "devDependencies": { @@ -17,11 +17,12 @@ } }, "node_modules/@actions/exec": { - "version": "1.1.1", - "resolved": "https://registry.npmjs.org/@actions/exec/-/exec-1.1.1.tgz", - "integrity": "sha512-+sCcHHbVdk93a0XT19ECtO/gIXoxvdsgQLzb2fE2/5sIZmWQuluYyjPQtrtTHdU1YzTZ7bAPN4sITq2xi1679w==", + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/@actions/exec/-/exec-2.0.0.tgz", + "integrity": "sha512-k8ngrX2voJ/RIN6r9xB82NVqKpnMRtxDoiO+g3olkIUpQNqjArXrCQceduQZCQj3P3xm32pChRLqRrtXTlqhIw==", + "license": "MIT", "dependencies": { - "@actions/io": "^1.0.1" + "@actions/io": "^2.0.0" } }, "node_modules/@actions/http-client": { @@ -35,9 +36,10 @@ } }, "node_modules/@actions/io": { - "version": "1.1.3", - "resolved": "https://registry.npmjs.org/@actions/io/-/io-1.1.3.tgz", - "integrity": "sha512-wi9JjgKLYS7U/z8PPbco+PvTb/nRWjeoFlJ1Qer83k/3C5PHQi28hiVdeE2kHXmIL99mQFawx8qt/JPjZilJ8Q==" + "version": "2.0.0", + "resolved": "https://registry.npmjs.org/@actions/io/-/io-2.0.0.tgz", + "integrity": "sha512-Jv33IN09XLO+0HS79aaODsvIRyduiF7NY/F6LYeK5oeUmrsz7aFdRphQjFoESF4jS7lMauDOttKALcpapVDIAg==", + "license": "MIT" }, "node_modules/@fastify/busboy": { "version": "2.1.1", @@ -49,15 +51,17 @@ } }, "node_modules/@types/node": { - "version": "16.18.112", - "resolved": "https://registry.npmjs.org/@types/node/-/node-16.18.112.tgz", - "integrity": "sha512-EKrbKUGJROm17+dY/gMi31aJlGLJ75e1IkTojt9n6u+hnaTBDs+M1bIdOawpk2m6YUAXq/R2W0SxCng1tndHCg==", - "dev": true + "version": "16.18.126", + "resolved": "https://registry.npmjs.org/@types/node/-/node-16.18.126.tgz", + "integrity": "sha512-OTcgaiwfGFBKacvfwuHzzn1KLxH/er8mluiy8/uM3sGXHaRe73RrSIj01jow9t4kJEW633Ov+cOexXeiApTyAw==", + "dev": true, + "license": "MIT" }, "node_modules/tunnel": { "version": "0.0.6", "resolved": "https://registry.npmjs.org/tunnel/-/tunnel-0.0.6.tgz", "integrity": "sha512-1h/Lnq9yajKY2PEbBadPXj3VxsDDu844OnaAo52UVmIzIvwwtBPIuNvkjuzBlTWpfJyUbG3ez0KSBibQkj4ojg==", + "license": "MIT", "engines": { "node": ">=0.6.11 <=0.7.0 || >=0.7.3" } @@ -74,53 +78,5 @@ "node": ">=14.0" } } - }, - "dependencies": { - "@actions/exec": { - "version": "1.1.1", - "resolved": "https://registry.npmjs.org/@actions/exec/-/exec-1.1.1.tgz", - "integrity": "sha512-+sCcHHbVdk93a0XT19ECtO/gIXoxvdsgQLzb2fE2/5sIZmWQuluYyjPQtrtTHdU1YzTZ7bAPN4sITq2xi1679w==", - "requires": { - "@actions/io": "^1.0.1" - } - }, - "@actions/http-client": { - "version": "3.0.0", - "resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-3.0.0.tgz", - "integrity": "sha512-1s3tXAfVMSz9a4ZEBkXXRQD4QhY3+GAsWSbaYpeknPOKEeyRiU3lH+bHiLMZdo2x/fIeQ/hscL1wCkDLVM2DZQ==", - "requires": { - "tunnel": "^0.0.6", - "undici": "^5.28.5" - } - }, - "@actions/io": { - "version": "1.1.3", - "resolved": "https://registry.npmjs.org/@actions/io/-/io-1.1.3.tgz", - "integrity": "sha512-wi9JjgKLYS7U/z8PPbco+PvTb/nRWjeoFlJ1Qer83k/3C5PHQi28hiVdeE2kHXmIL99mQFawx8qt/JPjZilJ8Q==" - }, - "@fastify/busboy": { - "version": "2.1.1", - "resolved": "https://registry.npmjs.org/@fastify/busboy/-/busboy-2.1.1.tgz", - "integrity": "sha512-vBZP4NlzfOlerQTnba4aqZoMhE/a9HY7HRqoOPaETQcSQuWEIyZMHGfVu6w9wGtGK5fED5qRs2DteVCjOH60sA==" - }, - "@types/node": { - "version": "16.18.112", - "resolved": "https://registry.npmjs.org/@types/node/-/node-16.18.112.tgz", - "integrity": "sha512-EKrbKUGJROm17+dY/gMi31aJlGLJ75e1IkTojt9n6u+hnaTBDs+M1bIdOawpk2m6YUAXq/R2W0SxCng1tndHCg==", - "dev": true - }, - "tunnel": { - "version": "0.0.6", - "resolved": "https://registry.npmjs.org/tunnel/-/tunnel-0.0.6.tgz", - "integrity": "sha512-1h/Lnq9yajKY2PEbBadPXj3VxsDDu844OnaAo52UVmIzIvwwtBPIuNvkjuzBlTWpfJyUbG3ez0KSBibQkj4ojg==" - }, - "undici": { - "version": "5.29.0", - "resolved": "https://registry.npmjs.org/undici/-/undici-5.29.0.tgz", - "integrity": "sha512-raqeBD6NQK4SkWhQzeYKd1KmIG6dllBOTt55Rmkt4HtI9mwdWtJljnrXjAFUBLTSN67HWrOIZ3EPF4kjUw80Bg==", - "requires": { - "@fastify/busboy": "^2.0.0" - } - } } } diff --git a/packages/core/package.json b/packages/core/package.json index e8eae164..ae9270fb 100644 --- a/packages/core/package.json +++ b/packages/core/package.json @@ -1,6 +1,6 @@ { "name": "@actions/core", - "version": "2.0.0", + "version": "2.0.1", "description": "Actions core lib", "keywords": [ "github", @@ -36,7 +36,7 @@ "url": "https://github.com/actions/toolkit/issues" }, "dependencies": { - "@actions/exec": "^1.1.1", + "@actions/exec": "^2.0.0", "@actions/http-client": "^3.0.0" }, "devDependencies": { From d9f9074fee298dbfd3fcadf4c98b7d1c44375e6b Mon Sep 17 00:00:00 2001 From: Brian DeHamer Date: Wed, 10 Dec 2025 13:27:16 -0800 Subject: [PATCH 30/32] npm trusted publishing Signed-off-by: Brian DeHamer --- .github/workflows/releases.yml | 5 ----- 1 file changed, 5 deletions(-) diff --git a/.github/workflows/releases.yml b/.github/workflows/releases.yml index 97114540..8bb71d2f 100644 --- a/.github/workflows/releases.yml +++ b/.github/workflows/releases.yml @@ -74,11 +74,6 @@ jobs: with: name: ${{ github.event.inputs.package }} - - name: setup authentication - run: echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" >> .npmrc - env: - NPM_TOKEN: ${{ secrets.TOKEN }} - - name: publish run: npm publish --provenance *.tgz From c043714a35777f03fffe595075c0e981f8225cf1 Mon Sep 17 00:00:00 2001 From: Brian DeHamer Date: Wed, 10 Dec 2025 14:14:15 -0800 Subject: [PATCH 31/32] use node24 for publishing Signed-off-by: Brian DeHamer --- .github/workflows/releases.yml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.github/workflows/releases.yml b/.github/workflows/releases.yml index 8bb71d2f..778d5506 100644 --- a/.github/workflows/releases.yml +++ b/.github/workflows/releases.yml @@ -69,6 +69,11 @@ jobs: id-token: write steps: + - name: Set Node.js 24.x + uses: actions/setup-node@v5 + with: + node-version: 24.x + - name: download artifact uses: actions/download-artifact@v4 with: From 369aa55cdccce0d142bb62fc1b05aaba46ec816f Mon Sep 17 00:00:00 2001 From: Salman Muin Kayser Chishti Date: Thu, 11 Dec 2025 13:54:17 +0000 Subject: [PATCH 32/32] update to core 2.0.1 which has exec 2.0.0 --- packages/cache/package-lock.json | 24 ++++-------------------- 1 file changed, 4 insertions(+), 20 deletions(-) diff --git a/packages/cache/package-lock.json b/packages/cache/package-lock.json index 80a4f370..1d9f9ce9 100644 --- a/packages/cache/package-lock.json +++ b/packages/cache/package-lock.json @@ -28,30 +28,15 @@ } }, "node_modules/@actions/core": { - "version": "2.0.0", - "resolved": "https://registry.npmjs.org/@actions/core/-/core-2.0.0.tgz", - "integrity": "sha512-iGW52/zqhPUFnYl0s1ioXfJu86LGs7b+GYuO38JMPpsh14FQrNj3n2JBpC+vZ2CFS4lERQyn5koLDopY+6V/PQ==", + "version": "2.0.1", + "resolved": "https://registry.npmjs.org/@actions/core/-/core-2.0.1.tgz", + "integrity": "sha512-oBfqT3GwkvLlo1fjvhQLQxuwZCGTarTE5OuZ2Wg10hvhBj7LRIlF611WT4aZS6fDhO5ZKlY7lCAZTlpmyaHaeg==", "license": "MIT", "dependencies": { - "@actions/exec": "^1.1.1", + "@actions/exec": "^2.0.0", "@actions/http-client": "^3.0.0" } }, - "node_modules/@actions/core/node_modules/@actions/exec": { - "version": "1.1.1", - "resolved": "https://registry.npmjs.org/@actions/exec/-/exec-1.1.1.tgz", - "integrity": "sha512-+sCcHHbVdk93a0XT19ECtO/gIXoxvdsgQLzb2fE2/5sIZmWQuluYyjPQtrtTHdU1YzTZ7bAPN4sITq2xi1679w==", - "license": "MIT", - "dependencies": { - "@actions/io": "^1.0.1" - } - }, - "node_modules/@actions/core/node_modules/@actions/io": { - "version": "1.1.3", - "resolved": "https://registry.npmjs.org/@actions/io/-/io-1.1.3.tgz", - "integrity": "sha512-wi9JjgKLYS7U/z8PPbco+PvTb/nRWjeoFlJ1Qer83k/3C5PHQi28hiVdeE2kHXmIL99mQFawx8qt/JPjZilJ8Q==", - "license": "MIT" - }, "node_modules/@actions/exec": { "version": "2.0.0", "resolved": "https://registry.npmjs.org/@actions/exec/-/exec-2.0.0.tgz", @@ -723,7 +708,6 @@ "integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==", "dev": true, "license": "Apache-2.0", - "peer": true, "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver"