mirror of
https://github.com/actions/toolkit.git
synced 2026-08-07 00:00:18 +02:00
* feat(cache): surface cache read-denied as a distinct restore warning Mirror the existing cache write-denied handling on the restore path. When the receiver refuses a download URL because the run's token has no readable cache scopes, it returns a twirp PermissionDenied (HTTP 403). The twirp client wraps that 403 in a generic Error, so the stable 'cache read denied:' prefix is embedded in the message rather than at the start. - Add CACHE_READ_DENIED_PREFIX and CacheReadDeniedError - Dispatch on the prefix in the restoreCacheV2 catch block (V2 only), log a policy-specific warning, and report a cache miss so the run continues - Add a test mirroring the write-denied coverage * chore(cache): trim comments, bump to 6.2.0, add RELEASES entry * refactor(cache): dispatch read-denied by error name to mirror write path Re-throw CacheReadDeniedError from an inner try/catch around GetCacheEntryDownloadURL and dispatch on typedError.name in the outer catch, matching how saveCacheV2 handles CacheWriteDeniedError. * feat(cache): handle read-denied on the v1 restore path Extend the read-denied handling to Cache Service v1 so GHES (which forces v1 via _apis/artifactcache) is covered when read-scope enforcement ships there. - Surface the receiver's error body message from getCacheEntry instead of a generic status-code error, so the cache read denied: prefix reaches callers - Re-throw CacheReadDeniedError from restoreCacheV1 and dispatch on it in the outer catch, mirroring restoreCacheV2 and the write-denied v1 handling - Add a v1 read-denied test * refactor(cache): only surface receiver body for read-denied on v1 * test(cache): assert getCacheEntry only surfaces body for read-denied * test(cache): cover non-read-denied getCacheEntry passthrough on v1 * refactor(cache): share read-denied prefix via constants to avoid drift * feat(cache): skip restore/save per ACTIONS_CACHE_MODE * test(cache): expand ACTIONS_CACHE_MODE skip coverage across v1/v2 and unknown modes * fix copilot pr feedback Co-authored-by: Copilot Autofix powered by AI <[email protected]> * docs(cache): remove internal reference from cache-mode comment * test(cache): merge redundant cache-mode skip tests and simplify read-denied handling Address PR review feedback: - Merge the duplicate restore/save skip test.each blocks into single blocks parametrized over ACTIONS_CACHE_SERVICE_V2. - Drop the redundant CacheReadDeniedError catch arms; the typed error is not an HttpClientError so it already falls through to a non-fatal warning. - Clarify why read-denied classification happens both in getCacheEntry and cache.ts (dependency-free internal module cannot import the typed error). * refactor(cache): drop redundant CacheWriteDeniedError catch arms Mirror the read-denied simplification on the save path. CacheWriteDeniedError is not an HttpClientError and its name does not match the ReserveCacheError arm, so it falls through to the same non-fatal warning. Logging behavior is unchanged (warns, never fails the run) and the exported type is still thrown internally for consumers and tests. Also refresh stale doc wording. * test(cache): collapse redundant restore getCacheEntry-failure tests The two restoreCache tests exercised the identical warning + cache-miss path now that read-denied is no longer reclassified in the catch, so merge them into one. The read-denied prefix detection that actually branches on the message is covered by getCacheEntry tests in cacheHttpClient.test.ts. --------- Co-authored-by: Copilot Autofix powered by AI <[email protected]>
414 lines
14 KiB
TypeScript
414 lines
14 KiB
TypeScript
import * as core from '@actions/core'
|
|
import * as path from 'path'
|
|
import {restoreCache} from '../src/cache'
|
|
import * as cacheHttpClient from '../src/internal/cacheHttpClient'
|
|
import * as cacheUtils from '../src/internal/cacheUtils'
|
|
import {CacheFilename, CompressionMethod} from '../src/internal/constants'
|
|
import {ArtifactCacheEntry} from '../src/internal/contracts'
|
|
import * as tar from '../src/internal/tar'
|
|
import {HttpClientError} from '@actions/http-client'
|
|
import {CacheServiceClientJSON} from '../src/generated/results/api/v1/cache.twirp-client'
|
|
|
|
jest.mock('../src/internal/cacheHttpClient')
|
|
jest.mock('../src/internal/cacheUtils')
|
|
jest.mock('../src/internal/tar')
|
|
|
|
beforeAll(() => {
|
|
jest.spyOn(console, 'log').mockImplementation(() => {})
|
|
jest.spyOn(core, 'debug').mockImplementation(() => {})
|
|
jest.spyOn(core, 'info').mockImplementation(() => {})
|
|
jest.spyOn(core, 'warning').mockImplementation(() => {})
|
|
jest.spyOn(core, 'error').mockImplementation(() => {})
|
|
|
|
jest.spyOn(cacheUtils, 'getCacheFileName').mockImplementation(cm => {
|
|
const actualUtils = jest.requireActual('../src/internal/cacheUtils')
|
|
return actualUtils.getCacheFileName(cm)
|
|
})
|
|
})
|
|
|
|
test('restore with no path should fail', async () => {
|
|
const paths: string[] = []
|
|
const key = 'node-test'
|
|
await expect(restoreCache(paths, key)).rejects.toThrowError(
|
|
`Path Validation Error: At least one directory or file path is required`
|
|
)
|
|
})
|
|
|
|
test('restore with too many keys should fail', async () => {
|
|
const paths = ['node_modules']
|
|
const key = 'node-test'
|
|
const restoreKeys = [...Array(20).keys()].map(x => x.toString())
|
|
await expect(restoreCache(paths, key, restoreKeys)).rejects.toThrowError(
|
|
`Key Validation Error: Keys are limited to a maximum of 10.`
|
|
)
|
|
})
|
|
|
|
test('restore with large key should fail', async () => {
|
|
const paths = ['node_modules']
|
|
const key = 'foo'.repeat(512) // Over the 512 character limit
|
|
await expect(restoreCache(paths, key)).rejects.toThrowError(
|
|
`Key Validation Error: ${key} cannot be larger than 512 characters.`
|
|
)
|
|
})
|
|
|
|
test('restore with invalid key should fail', async () => {
|
|
const paths = ['node_modules']
|
|
const key = 'comma,comma'
|
|
await expect(restoreCache(paths, key)).rejects.toThrowError(
|
|
`Key Validation Error: ${key} cannot contain commas.`
|
|
)
|
|
})
|
|
|
|
test('restore with no cache found', async () => {
|
|
const paths = ['node_modules']
|
|
const key = 'node-test'
|
|
|
|
jest.spyOn(cacheHttpClient, 'getCacheEntry').mockImplementation(async () => {
|
|
return Promise.resolve(null)
|
|
})
|
|
|
|
const cacheKey = await restoreCache(paths, key)
|
|
|
|
expect(cacheKey).toBe(undefined)
|
|
})
|
|
|
|
test('restore with server error should fail', async () => {
|
|
const paths = ['node_modules']
|
|
const key = 'node-test'
|
|
const logErrorMock = jest.spyOn(core, 'error')
|
|
|
|
// Set cache service to V2 to test error logging for server errors
|
|
process.env['ACTIONS_CACHE_SERVICE_V2'] = 'true'
|
|
process.env['ACTIONS_RESULTS_URL'] = 'https://results.local/'
|
|
|
|
jest
|
|
.spyOn(CacheServiceClientJSON.prototype, 'GetCacheEntryDownloadURL')
|
|
.mockImplementation(() => {
|
|
throw new HttpClientError('HTTP Error Occurred', 500)
|
|
})
|
|
|
|
const cacheKey = await restoreCache(paths, key)
|
|
expect(cacheKey).toBe(undefined)
|
|
expect(logErrorMock).toHaveBeenCalledTimes(1)
|
|
expect(logErrorMock).toHaveBeenCalledWith(
|
|
'Failed to restore: HTTP Error Occurred'
|
|
)
|
|
|
|
// Clean up environment
|
|
delete process.env['ACTIONS_CACHE_SERVICE_V2']
|
|
delete process.env['ACTIONS_RESULTS_URL']
|
|
})
|
|
|
|
test('restore surfaces a getCacheEntry failure as a warning and reports a cache miss', async () => {
|
|
// restoreCache treats any getCacheEntry failure (read-denied or otherwise)
|
|
// as a non-fatal warning and a cache miss so the workflow continues. The
|
|
// read-denied prefix detection itself is covered in cacheHttpClient.test.ts.
|
|
const paths = ['node_modules']
|
|
const key = 'node-test'
|
|
const logErrorMock = jest.spyOn(core, 'error')
|
|
const logWarningMock = jest.spyOn(core, 'warning')
|
|
const message = 'cache read denied: token has no readable scopes'
|
|
|
|
jest.spyOn(cacheHttpClient, 'getCacheEntry').mockImplementation(async () => {
|
|
throw new Error(message)
|
|
})
|
|
|
|
const cacheKey = await restoreCache(paths, key)
|
|
expect(cacheKey).toBe(undefined)
|
|
expect(logErrorMock).not.toHaveBeenCalled()
|
|
expect(logWarningMock).toHaveBeenCalledWith(`Failed to restore: ${message}`)
|
|
expect(logWarningMock).toHaveBeenCalledTimes(1)
|
|
})
|
|
|
|
describe('restore cache-mode gating', () => {
|
|
const originalMode = process.env.ACTIONS_CACHE_MODE
|
|
const originalV2 = process.env.ACTIONS_CACHE_SERVICE_V2
|
|
|
|
const restoreEnv = (key: string, value: string | undefined): void => {
|
|
if (value === undefined) {
|
|
delete process.env[key]
|
|
} else {
|
|
process.env[key] = value
|
|
}
|
|
}
|
|
|
|
afterEach(() => {
|
|
restoreEnv('ACTIONS_CACHE_MODE', originalMode)
|
|
restoreEnv('ACTIONS_CACHE_SERVICE_V2', originalV2)
|
|
})
|
|
|
|
// The skip short-circuits before v1/v2 dispatch, so it applies regardless of
|
|
// the ACTIONS_CACHE_SERVICE_V2 feature flag.
|
|
test.each([
|
|
['none', undefined],
|
|
['none', 'true'],
|
|
['write-only', undefined],
|
|
['write-only', 'true']
|
|
])(
|
|
"mode '%s' skips restore with ACTIONS_CACHE_SERVICE_V2=%s",
|
|
async (mode, v2) => {
|
|
process.env.ACTIONS_CACHE_MODE = mode
|
|
restoreEnv('ACTIONS_CACHE_SERVICE_V2', v2)
|
|
const logInfoMock = jest.spyOn(core, 'info')
|
|
const getCacheEntryMock = jest.spyOn(cacheHttpClient, 'getCacheEntry')
|
|
|
|
const cacheKey = await restoreCache(['node_modules'], 'node-test')
|
|
|
|
expect(cacheKey).toBe(undefined)
|
|
expect(getCacheEntryMock).not.toHaveBeenCalled()
|
|
expect(logInfoMock).toHaveBeenCalledTimes(1)
|
|
expect(logInfoMock).toHaveBeenCalledWith(
|
|
`Cache restore skipped: the effective cache-mode '${mode}' does not permit reads.`
|
|
)
|
|
}
|
|
)
|
|
|
|
test.each(['read', 'write', '', 'garbage'])(
|
|
"mode '%s' does not skip restore",
|
|
async mode => {
|
|
if (mode === '') {
|
|
delete process.env.ACTIONS_CACHE_MODE
|
|
} else {
|
|
process.env.ACTIONS_CACHE_MODE = mode
|
|
}
|
|
const logInfoMock = jest.spyOn(core, 'info')
|
|
const getCacheEntryMock = jest
|
|
.spyOn(cacheHttpClient, 'getCacheEntry')
|
|
.mockResolvedValue(null as never)
|
|
|
|
await restoreCache(['node_modules'], 'node-test')
|
|
|
|
expect(getCacheEntryMock).toHaveBeenCalledTimes(1)
|
|
expect(logInfoMock).not.toHaveBeenCalledWith(
|
|
expect.stringContaining('Cache restore skipped')
|
|
)
|
|
}
|
|
)
|
|
})
|
|
|
|
test('restore with restore keys and no cache found', async () => {
|
|
const paths = ['node_modules']
|
|
const key = 'node-test'
|
|
const restoreKey = 'node-'
|
|
|
|
jest.spyOn(cacheHttpClient, 'getCacheEntry').mockImplementation(async () => {
|
|
return Promise.resolve(null)
|
|
})
|
|
|
|
const cacheKey = await restoreCache(paths, key, [restoreKey])
|
|
|
|
expect(cacheKey).toBe(undefined)
|
|
})
|
|
|
|
test('restore with gzip compressed cache found', async () => {
|
|
const paths = ['node_modules']
|
|
const key = 'node-test'
|
|
|
|
const cacheEntry: ArtifactCacheEntry = {
|
|
cacheKey: key,
|
|
scope: 'refs/heads/main',
|
|
archiveLocation: 'www.actionscache.test/download'
|
|
}
|
|
const getCacheMock = jest.spyOn(cacheHttpClient, 'getCacheEntry')
|
|
getCacheMock.mockImplementation(async () => {
|
|
return Promise.resolve(cacheEntry)
|
|
})
|
|
|
|
const tempPath = '/foo/bar'
|
|
|
|
const createTempDirectoryMock = jest.spyOn(cacheUtils, 'createTempDirectory')
|
|
createTempDirectoryMock.mockImplementation(async () => {
|
|
return Promise.resolve(tempPath)
|
|
})
|
|
|
|
const archivePath = path.join(tempPath, CacheFilename.Gzip)
|
|
const downloadCacheMock = jest.spyOn(cacheHttpClient, 'downloadCache')
|
|
|
|
const fileSize = 142
|
|
const getArchiveFileSizeInBytesMock = jest
|
|
.spyOn(cacheUtils, 'getArchiveFileSizeInBytes')
|
|
.mockReturnValue(fileSize)
|
|
|
|
const extractTarMock = jest.spyOn(tar, 'extractTar')
|
|
const unlinkFileMock = jest.spyOn(cacheUtils, 'unlinkFile')
|
|
|
|
const compression = CompressionMethod.Gzip
|
|
const getCompressionMock = jest
|
|
.spyOn(cacheUtils, 'getCompressionMethod')
|
|
.mockReturnValue(Promise.resolve(compression))
|
|
|
|
const cacheKey = await restoreCache(paths, key)
|
|
|
|
expect(cacheKey).toBe(key)
|
|
expect(getCacheMock).toHaveBeenCalledWith([key], paths, {
|
|
compressionMethod: compression,
|
|
enableCrossOsArchive: false
|
|
})
|
|
expect(createTempDirectoryMock).toHaveBeenCalledTimes(1)
|
|
expect(downloadCacheMock).toHaveBeenCalledWith(
|
|
cacheEntry.archiveLocation,
|
|
archivePath,
|
|
undefined
|
|
)
|
|
expect(getArchiveFileSizeInBytesMock).toHaveBeenCalledWith(archivePath)
|
|
|
|
expect(extractTarMock).toHaveBeenCalledTimes(1)
|
|
expect(extractTarMock).toHaveBeenCalledWith(archivePath, compression)
|
|
|
|
expect(unlinkFileMock).toHaveBeenCalledTimes(1)
|
|
expect(unlinkFileMock).toHaveBeenCalledWith(archivePath)
|
|
|
|
expect(getCompressionMock).toHaveBeenCalledTimes(1)
|
|
})
|
|
|
|
test('restore with zstd compressed cache found', async () => {
|
|
const paths = ['node_modules']
|
|
const key = 'node-test'
|
|
|
|
const infoMock = jest.spyOn(core, 'info')
|
|
|
|
const cacheEntry: ArtifactCacheEntry = {
|
|
cacheKey: key,
|
|
scope: 'refs/heads/main',
|
|
archiveLocation: 'www.actionscache.test/download'
|
|
}
|
|
const getCacheMock = jest.spyOn(cacheHttpClient, 'getCacheEntry')
|
|
getCacheMock.mockImplementation(async () => {
|
|
return Promise.resolve(cacheEntry)
|
|
})
|
|
const tempPath = '/foo/bar'
|
|
|
|
const createTempDirectoryMock = jest.spyOn(cacheUtils, 'createTempDirectory')
|
|
createTempDirectoryMock.mockImplementation(async () => {
|
|
return Promise.resolve(tempPath)
|
|
})
|
|
|
|
const archivePath = path.join(tempPath, CacheFilename.Zstd)
|
|
const downloadCacheMock = jest.spyOn(cacheHttpClient, 'downloadCache')
|
|
|
|
const fileSize = 62915000
|
|
const getArchiveFileSizeInBytesMock = jest
|
|
.spyOn(cacheUtils, 'getArchiveFileSizeInBytes')
|
|
.mockReturnValue(fileSize)
|
|
|
|
const extractTarMock = jest.spyOn(tar, 'extractTar')
|
|
const compression = CompressionMethod.Zstd
|
|
const getCompressionMock = jest
|
|
.spyOn(cacheUtils, 'getCompressionMethod')
|
|
.mockReturnValue(Promise.resolve(compression))
|
|
|
|
const cacheKey = await restoreCache(paths, key)
|
|
|
|
expect(cacheKey).toBe(key)
|
|
expect(getCacheMock).toHaveBeenCalledWith([key], paths, {
|
|
compressionMethod: compression,
|
|
enableCrossOsArchive: false
|
|
})
|
|
expect(createTempDirectoryMock).toHaveBeenCalledTimes(1)
|
|
expect(downloadCacheMock).toHaveBeenCalledWith(
|
|
cacheEntry.archiveLocation,
|
|
archivePath,
|
|
undefined
|
|
)
|
|
expect(getArchiveFileSizeInBytesMock).toHaveBeenCalledWith(archivePath)
|
|
expect(infoMock).toHaveBeenCalledWith(`Cache Size: ~60 MB (62915000 B)`)
|
|
|
|
expect(extractTarMock).toHaveBeenCalledTimes(1)
|
|
expect(extractTarMock).toHaveBeenCalledWith(archivePath, compression)
|
|
expect(getCompressionMock).toHaveBeenCalledTimes(1)
|
|
})
|
|
|
|
test('restore with cache found for restore key', async () => {
|
|
const paths = ['node_modules']
|
|
const key = 'node-test'
|
|
const restoreKey = 'node-'
|
|
|
|
const infoMock = jest.spyOn(core, 'info')
|
|
|
|
const cacheEntry: ArtifactCacheEntry = {
|
|
cacheKey: restoreKey,
|
|
scope: 'refs/heads/main',
|
|
archiveLocation: 'www.actionscache.test/download'
|
|
}
|
|
const getCacheMock = jest.spyOn(cacheHttpClient, 'getCacheEntry')
|
|
getCacheMock.mockImplementation(async () => {
|
|
return Promise.resolve(cacheEntry)
|
|
})
|
|
const tempPath = '/foo/bar'
|
|
|
|
const createTempDirectoryMock = jest.spyOn(cacheUtils, 'createTempDirectory')
|
|
createTempDirectoryMock.mockImplementation(async () => {
|
|
return Promise.resolve(tempPath)
|
|
})
|
|
|
|
const archivePath = path.join(tempPath, CacheFilename.Zstd)
|
|
const downloadCacheMock = jest.spyOn(cacheHttpClient, 'downloadCache')
|
|
|
|
const fileSize = 142
|
|
const getArchiveFileSizeInBytesMock = jest
|
|
.spyOn(cacheUtils, 'getArchiveFileSizeInBytes')
|
|
.mockReturnValue(fileSize)
|
|
|
|
const extractTarMock = jest.spyOn(tar, 'extractTar')
|
|
const compression = CompressionMethod.Zstd
|
|
const getCompressionMock = jest
|
|
.spyOn(cacheUtils, 'getCompressionMethod')
|
|
.mockReturnValue(Promise.resolve(compression))
|
|
|
|
const cacheKey = await restoreCache(paths, key, [restoreKey])
|
|
|
|
expect(cacheKey).toBe(restoreKey)
|
|
expect(getCacheMock).toHaveBeenCalledWith([key, restoreKey], paths, {
|
|
compressionMethod: compression,
|
|
enableCrossOsArchive: false
|
|
})
|
|
expect(createTempDirectoryMock).toHaveBeenCalledTimes(1)
|
|
expect(downloadCacheMock).toHaveBeenCalledWith(
|
|
cacheEntry.archiveLocation,
|
|
archivePath,
|
|
undefined
|
|
)
|
|
expect(getArchiveFileSizeInBytesMock).toHaveBeenCalledWith(archivePath)
|
|
expect(infoMock).toHaveBeenCalledWith(`Cache Size: ~0 MB (142 B)`)
|
|
|
|
expect(extractTarMock).toHaveBeenCalledTimes(1)
|
|
expect(extractTarMock).toHaveBeenCalledWith(archivePath, compression)
|
|
expect(getCompressionMock).toHaveBeenCalledTimes(1)
|
|
})
|
|
|
|
test('restore with dry run', async () => {
|
|
const paths = ['node_modules']
|
|
const key = 'node-test'
|
|
const options = {lookupOnly: true}
|
|
|
|
const cacheEntry: ArtifactCacheEntry = {
|
|
cacheKey: key,
|
|
scope: 'refs/heads/main',
|
|
archiveLocation: 'www.actionscache.test/download'
|
|
}
|
|
const getCacheMock = jest.spyOn(cacheHttpClient, 'getCacheEntry')
|
|
getCacheMock.mockImplementation(async () => {
|
|
return Promise.resolve(cacheEntry)
|
|
})
|
|
|
|
const createTempDirectoryMock = jest.spyOn(cacheUtils, 'createTempDirectory')
|
|
const downloadCacheMock = jest.spyOn(cacheHttpClient, 'downloadCache')
|
|
|
|
const compression = CompressionMethod.Gzip
|
|
const getCompressionMock = jest
|
|
.spyOn(cacheUtils, 'getCompressionMethod')
|
|
.mockReturnValue(Promise.resolve(compression))
|
|
|
|
const cacheKey = await restoreCache(paths, key, undefined, options)
|
|
|
|
expect(cacheKey).toBe(key)
|
|
expect(getCompressionMock).toHaveBeenCalledTimes(1)
|
|
expect(getCacheMock).toHaveBeenCalledWith([key], paths, {
|
|
compressionMethod: compression,
|
|
enableCrossOsArchive: false
|
|
})
|
|
// creating a tempDir and downloading the cache are skipped
|
|
expect(createTempDirectoryMock).toHaveBeenCalledTimes(0)
|
|
expect(downloadCacheMock).toHaveBeenCalledTimes(0)
|
|
})
|