actions/toolkit
2
0
Fork 0
mirror of https://github.com/actions/toolkit.git synced 2026-08-07 00:00:18 +02:00
Code Issues Packages Projects Releases Wiki Activity
1,893 Commits 280 Branches 19 Tags
jasongin/cache-path-validation
Commit Graph
1423 Commits
Author SHA1 Message Date
Jason Ginchereau 3690eeb098 Fix GNU tar path matching issue 2026-06-22 09:48:00 -10:00
Jason Ginchereau a41517f52a Improve path validations and test coverage 2026-06-19 15:35:16 -10:00
Jason Ginchereau bb827dbfd4 Bump minor version, update test plan 2026-06-19 09:34:38 -10:00
Jason Ginchereau 6e8379ea7a Implement PAX header validation and path safety checks in tar extraction 
- Added a new test suite for parser-differential bypass detection in tar archives.
- Introduced length-correct PAX extended-header re-parsing to catch discrepancies between node-tar and system tar.
- Enhanced the listAndValidate function to return approved names alongside violations for better extraction control.
- Implemented checks for unsafe characters and glob metacharacters in entry paths.
- Updated the tar extraction logic to utilize an allow-list for approved entries when path validation is in error mode.
- Added utility functions for writing temporary allow-list files for system tar extraction.
 2026-06-19 09:17:41 -10:00
Jason Ginchereau b2734aba36 Remove suppressions that don't work 2026-06-17 14:39:18 -10:00
Jason Ginchereau 6cdcf724e2 Update dependencies to resolve audit issues 2026-06-17 14:39:18 -10:00
Jason Ginchereau cc4da7ddff Fix lint issues 2026-06-17 14:39:18 -10:00
Jason Ginchereau 59a9650ce0 Address copilot review feedback 2026-06-17 14:39:18 -10:00
Jason Ginchereau d14cd0e722 Suppress polynomial-redos warning 2026-06-17 14:39:18 -10:00
Jason GinchereauJason GinchereauCopilot Autofix powered by AI
 		62e4d31b22 Update test plan doc regarding warn behavior 
Co-authored-by: Copilot Autofix powered by AI <[email protected]>
 2026-06-17 14:39:18 -10:00
Jason Ginchereau 998c5ad7fd feat: optional path validation during cache restore 2026-06-17 14:39:14 -10:00
Jason GinchereauandGitHub 0786132e6a Bump cache package to v6.1.0, update RELEASES.md (#2436) 2026-06-17 11:25:12 -10:00
Jason Ginchereau 5fb375f061 Audit fix packages/cache 2026-06-11 17:24:11 -07:00
Jason Ginchereau 4d255d08df Audit fix packages 2026-06-11 17:22:31 -07:00
Jason Ginchereau 26e77e9341 Adit fix, address copilot comments 2026-06-11 17:17:55 -07:00
Jason Ginchereau 78e3d71e19 Handle cache write error due to read-only token 2026-06-11 17:02:12 -07:00
Meredith LancasterandGitHub 4b9afa4c89 Merge pull request #2368 from actions/dependabot/npm_and_yarn/packages/attest/brace-expansion-2.0.3 
chore(deps): bump brace-expansion from 2.0.2 to 2.0.3 in /packages/attest
 2026-06-08 15:21:00 -07:00
Meredith LancasterandGitHub 4073a41e46 Merge pull request #2395 from actions/dependabot/npm_and_yarn/packages/attest/ip-address-10.2.0 
chore(deps): bump ip-address from 10.0.1 to 10.2.0 in /packages/attest
 2026-06-08 15:19:07 -07:00
dependabot[bot]andGitHub 5dc5ba43d0 chore(deps): bump ip-address from 10.0.1 to 10.2.0 in /packages/attest 
Bumps [ip-address](https://github.com/beaugunderson/ip-address) from 10.0.1 to 10.2.0.
- [Commits](https://github.com/beaugunderson/ip-address/commits)

---
updated-dependencies:
- dependency-name: ip-address
  dependency-version: 10.2.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
 2026-05-06 23:08:09 +00:00
Joshua Brooks ad7d6fb853 Bump toolkit version, add release notes 2026-05-01 17:38:16 +00:00
Joshua Brooks f6e2bb745a Move @protobuf-ts/plugin to devDependencies 2026-05-01 16:38:16 +00:00
Joshua Brooks 785fffe22d Audit tool-cache 2026-05-01 16:36:55 +00:00
Joshua Brooks 2f08a036a6 Audit npm packages 2026-05-01 16:33:28 +00:00
Joshua Brooks 17e04b5199 Update minor versions of cache and artifact dependencies 2026-05-01 16:27:55 +00:00
Aiqiao Yan 0607d7a54b release new versions for a few packages 2026-04-21 17:15:02 +00:00
Aiqiao YanandGitHub 4ee32849b4 Merge pull request #2346 from actions/dependabot/npm_and_yarn/packages/github/undici-6.24.0 
chore(deps): bump undici from 6.23.0 to 6.24.0 in /packages/github
 2026-04-21 12:55:26 -04:00
Aiqiao YanandGitHub d76f9fe99a Merge pull request #2348 from actions/dependabot/npm_and_yarn/packages/core/undici-6.24.1 
chore(deps): bump undici from 6.23.0 to 6.24.1 in /packages/core
 2026-04-21 12:54:48 -04:00
Aiqiao YanandGitHub 7e08d73d76 Merge pull request #2345 from actions/dependabot/npm_and_yarn/packages/glob/undici-6.24.0 
chore(deps): bump undici from 6.23.0 to 6.24.0 in /packages/glob
 2026-04-21 12:42:56 -04:00
ICHINOSE Shogo 16cd46c365 Merge branch 'main' into bump-minimatch-v10 2026-04-21 21:43:27 +09:00
dependabot[bot]andGitHub b3818383be chore(deps): bump brace-expansion in /packages/attest 
Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 2.0.2 to 2.0.3.
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](https://github.com/juliangruber/brace-expansion/compare/v2.0.2...v2.0.3)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 2.0.3
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
 2026-04-20 21:46:32 +00:00
Aiqiao YanandGitHub 75b8dd1009 Merge pull request #2369 from actions/dependabot/npm_and_yarn/packages/glob/brace-expansion-1.1.13 
chore(deps): bump brace-expansion from 1.1.12 to 1.1.13 in /packages/glob
 2026-04-20 17:44:57 -04:00
Aiqiao YanandGitHub 54ad3ca9ba Merge pull request #2347 from actions/dependabot/npm_and_yarn/packages/http-client/undici-6.24.0 
chore(deps): bump undici from 6.23.0 to 6.24.0 in /packages/http-client
 2026-04-20 17:34:56 -04:00
dependabot[bot]andGitHub 140509034c chore(deps): bump brace-expansion in /packages/glob 
Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 1.1.12 to 1.1.13.
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](https://github.com/juliangruber/brace-expansion/compare/v1.1.12...v1.1.13)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 1.1.13
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
 2026-04-08 20:54:11 +00:00
Salman ChishtiandGitHub e4598e374b chore: bump @actions/github to 9.1.0 for release 
- Version bump 9.0.0 → 9.1.0 in package.json
- Update RELEASES.md with idempotency guard note and PR link
 2026-04-08 20:07:19 +00:00
Salman ChishtiandGitHub 3643ce2db4 style: fix prettier formatting in orchestration tests 2026-04-08 19:38:31 +00:00
Salman ChishtiandGitHub ffeb50bd02 fix: prevent duplicate orchestration ID in user-agent 
Add idempotency check to getUserAgentWithOrchestrationId — if the
tag is already present in baseUserAgent, return it unchanged. This
prevents doubling when both the exported helper and getOctokitOptions
run for the same client.
 2026-04-08 16:49:32 +00:00
Salman ChishtiandGitHub b0917c5a37 style: fix prettier formatting in orchestration tests 2026-04-07 16:35:32 +00:00
Salman ChishtiandGitHub a8ea745713 feat(github): append orchestration ID to user-agent in getOctokitOptions 
When ACTIONS_ORCHESTRATION_ID is set, appends
actions_orchestration_id/{sanitizedId} to the user-agent string.

- Add getUserAgentWithOrchestrationId() to internal/utils.ts
- Wire into getOctokitOptions() so all getOctokit() calls include it
- Re-export helper from @actions/github/lib/utils for downstream consumers
- 14 deterministic unit tests covering helper, integration, edge cases
 2026-04-07 16:16:11 +00:00
ICHINOSE ShogoGitHubCopilot
 		74fcfdbd10 @actions/glob: add some comments for the regression testing 
Co-authored-by: Copilot <[email protected]>
 2026-03-20 19:56:02 +09:00
ICHINOSE Shogo 20647b6bcf @actions/core: update regression test with minimatch v3 2026-03-20 19:24:19 +09:00
ICHINOSE Shogo 6bd5e50ee1 @actions/glob: bump minimatch from v3.0.4 to v10.2.4 2026-03-20 18:00:34 +09:00
dependabot[bot]andGitHub 7c6cc28ed5 chore(deps): bump undici from 6.23.0 to 6.24.1 in /packages/core 
Bumps [undici](https://github.com/nodejs/undici) from 6.23.0 to 6.24.1.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](https://github.com/nodejs/undici/compare/v6.23.0...v6.24.1)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 6.24.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
 2026-03-14 09:09:41 +00:00
dependabot[bot]andGitHub 8f62bc23d1 chore(deps): bump undici from 6.23.0 to 6.24.0 in /packages/http-client 
Bumps [undici](https://github.com/nodejs/undici) from 6.23.0 to 6.24.0.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](https://github.com/nodejs/undici/compare/v6.23.0...v6.24.0)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 6.24.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
 2026-03-14 05:22:04 +00:00
dependabot[bot]andGitHub bbaffb4bb3 chore(deps): bump undici from 6.23.0 to 6.24.0 in /packages/github 
Bumps [undici](https://github.com/nodejs/undici) from 6.23.0 to 6.24.0.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](https://github.com/nodejs/undici/compare/v6.23.0...v6.24.0)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 6.24.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>
 2026-03-14 04:56:28 +00:00
dependabot[bot]andGitHub c23cc6e61c chore(deps): bump undici from 6.23.0 to 6.24.0 in /packages/glob 
Bumps [undici](https://github.com/nodejs/undici) from 6.23.0 to 6.24.0.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](https://github.com/nodejs/undici/compare/v6.23.0...v6.24.0)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 6.24.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
 2026-03-14 04:40:06 +00:00
dependabot[bot]andGitHub 06bca4509d chore(deps): bump undici from 6.23.0 to 6.24.0 in /packages/artifact 
Bumps [undici](https://github.com/nodejs/undici) from 6.23.0 to 6.24.0.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](https://github.com/nodejs/undici/compare/v6.23.0...v6.24.0)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 6.24.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
 2026-03-14 04:17:32 +00:00
Daniel KennedyandGitHub 21229dc09e Artifact: support downloading artifacts with CJK characters in their name (#2341) 
* Artifact: support downloading artifacts with CJK characters in their name

* Fix some linting/PR comments

* One more linting fix
 2026-03-11 09:30:15 -04:00
dependabot[bot]andGitHub 89f01c9125 chore(deps): bump tar from 7.5.7 to 7.5.10 in /packages/attest 
Bumps [tar](https://github.com/isaacs/node-tar) from 7.5.7 to 7.5.10.
- [Release notes](https://github.com/isaacs/node-tar/releases)
- [Changelog](https://github.com/isaacs/node-tar/blob/main/CHANGELOG.md)
- [Commits](https://github.com/isaacs/node-tar/compare/v7.5.7...v7.5.10)

---
updated-dependencies:
- dependency-name: tar
  dependency-version: 7.5.10
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <[email protected]>
 2026-03-06 13:29:24 +00:00
Zachary TaylorandGitHub bd4fb086f1 Update UsageError in cache 2026-02-26 14:31:12 -05:00
Zachary TaylorandGitHub 49c3d09c01 Update error message 2026-02-26 14:28:46 -05:00