Skip to content

[pull] main from actions:main - #2

Open
pull[bot] wants to merge 84 commits into
Graysonbarton:mainfrom
actions:main
Open

[pull] main from actions:main#2
pull[bot] wants to merge 84 commits into
Graysonbarton:mainfrom
actions:main

Conversation

@pull

@pullpullBot commented Oct 15, 2024

Copy link
Copy Markdown

See Commits and Changes for more details.


Created by pull[bot] (v2.0.0-alpha.4)

Can you help keep this open source service alive? 💖 Please sponsor : )

v-HarithaVattikutiand others added 10 commits May 22, 2024 08:12
* Update latest node versions
* Update latest node versions
* Update test data
* Update test data
* Update test data
* Update test data
* Update test data
* macos lts failure fix
* Update macos-13
* Bump braces from 3.0.2 to 3.0.3
Bumps [braces](https://github.com/micromatch/braces) from 3.0.2 to 3.0.3.
- [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md)
- [Commits](micromatch/braces@3.0.2...3.0.3)
---
updated-dependencies:
- dependency-name: braces
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
* Bump undici from 5.28.3 to 5.28.4
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: HarithaVattikuti <73516759+HarithaVattikuti@users.noreply.github.com>
* first commit on using setup node
* Delete .github/workflows/helloWorld.yml
* Create main.yml
* Rename main.yml to helloworld.yml
* goodbye world added
* name changed to goodbye
* updated README
---------
Co-authored-by: Suyash Gaonkar <39784472+suyashrg18@users.noreply.github.com>
* Add condition to ensure ZIP extraction targets only Windows ARM64 official archives
* Bumps micromatch from 4.0.5 to 4.0.8
Add workflow file for publishing releases to immutable action package
* db-alerts-fix
* npm run format
* db-alert-fix
* failure check fix
* check- filaure fix
@sourcery-ai

sourcery-aiBot commented Oct 15, 2024

Copy link
Copy Markdown

Reviewer's Guide by Sourcery

This pull request updates the setup-node action to support newer Node.js versions and makes several improvements to the codebase. The changes include updating dependencies, modifying workflows to use more recent Node.js versions, and enhancing the functionality of the action.

Class diagram for BaseDistribution changes

classDiagram
class BaseDistribution {
+extractArchive(downloadPath: string, info: INodeVersionInfo | null, isOfficialArchive?: boolean)
}
note for BaseDistribution "Added isOfficialArchive parameter to extractArchive method"
Loading

File-Level Changes

ChangeDetailsFiles
Updated Node.js version support in workflows
  • Changed Node.js versions from 10, 12, 14 to 18, 20, 22 in various workflow files
  • Updated nightly and RC version checks to use more recent versions
  • Modified macOS runner version to macOS-13 in some workflows
.github/workflows/versions.yml
.github/workflows/e2e-cache.yml
Enhanced archive extraction process
  • Added a new parameter 'isOfficialArchive' to the extractArchive method
  • Modified the condition for extracting .zip files to consider if it's an official archive
src/distributions/base-distribution.ts
src/distributions/official_builds/official_builds.ts
Updated dependencies and improved HTTP handling
  • Updated undici to version 5.28.4
  • Added new headerNameLowerCasedRecord functionality for efficient header name handling
  • Improved the bytesMatch function for better performance and compatibility
dist/setup/index.js
dist/cache-save/index.js
.licenses/npm/undici.dep.yml
Added new workflow for publishing immutable action versions
  • Created a new workflow file for publishing immutable action versions on release
.github/workflows/publish-immutable-actions.yml
Updated documentation and test data
  • Modified README.md to correct a typo and update example versions
  • Updated package-volta.json test data to use Node.js 20.0.0
README.md
__tests__/data/package-volta.json

Tips and commands

Interacting with Sourcery

  • Trigger a new review: Comment @sourcery-ai review on the pull request.
  • Continue discussions: Reply directly to Sourcery's review comments.
  • Generate a GitHub issue from a review comment: Ask Sourcery to create an
    issue from a review comment by replying to it.
  • Generate a pull request title: Write @sourcery-ai anywhere in the pull
    request title to generate a title at any time.
  • Generate a pull request summary: Write @sourcery-ai summary anywhere in
    the pull request body to generate a PR summary at any time. You can also use
    this command to specify where the summary should be inserted.

Customizing Your Experience

Access your dashboard to:

  • Enable or disable review features such as the Sourcery-generated pull request
    summary, the reviewer's guide, and others.
  • Change the review language.
  • Add, remove or edit custom review instructions.
  • Adjust other review settings.

Getting Help

@sourcery-aisourcery-aiBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We have skipped reviewing this pull request. It seems to have been created by a bot (hey, pull[bot]!). We assume it knows what it's doing!

jww3and others added 10 commits October 21, 2024 11:41
* Revise `isGhes` logic
* ran 'npm run format'
* added unit test
* fix: add arch to cached path
* fix: change from using env to os module
* fix: use process.env.RUNNER_OS instead of os.platform()
* fix: remove unused var
…to 0.3.0 (#1174)
* Update versions.yml
* Update versions.yml
* ubuntu-24, macos-13 updates
* check -failure fix
* upgrade `@actions/cache` to `^4.0.0`
* Review licenses & update types
* updated package-lock.json
Bumps [pnpm/action-setup](https://github.com/pnpm/action-setup) from 2 to 4.
- [Release notes](https://github.com/pnpm/action-setup/releases)
- [Commits](pnpm/action-setup@v2...v4)
---
updated-dependencies:
- dependency-name: pnpm/action-setup
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Bumps [actions/publish-immutable-action](https://github.com/actions/publish-immutable-action) from 0.0.3 to 0.0.4.
- [Release notes](https://github.com/actions/publish-immutable-action/releases)
- [Commits](actions/publish-immutable-action@0.0.3...v0.0.4)
---
updated-dependencies:
- dependency-name: actions/publish-immutable-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Bump semver from 7.6.0 to 7.6.3
Bumps [semver](https://github.com/npm/node-semver) from 7.6.0 to 7.6.3.
- [Release notes](https://github.com/npm/node-semver/releases)
- [Changelog](https://github.com/npm/node-semver/blob/main/CHANGELOG.md)
- [Commits](npm/node-semver@v7.6.0...v7.6.3)
---
updated-dependencies:
- dependency-name: semver
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
* fix for check-dist & license check failures
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Aparna Jyothi <aparnajyothi-y@github.com>
Bumps [@types/jest](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/jest) from 29.5.12 to 29.5.14.
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/jest)
---
updated-dependencies:
- dependency-name: "@types/jest"
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@pullpullBot added the merge-conflict Resolve conflicts manually label Jan 22, 2025
dependabotBotand others added 6 commits January 22, 2025 13:15
* Bump undici from 5.28.4 to 5.28.5
Bumps [undici](https://github.com/nodejs/undici) from 5.28.4 to 5.28.5.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v5.28.4...v5.28.5)
---
updated-dependencies:
- dependency-name: undici
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
* fix for check-dist and license failures
* npm run updates
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Aparna Jyothi <aparnajyothi-y@github.com>
* Bump @actions/glob from 0.4.0 to 0.5.0
Bumps [@actions/glob](https://github.com/actions/toolkit/tree/HEAD/packages/glob) from 0.4.0 to 0.5.0.
- [Changelog](https://github.com/actions/toolkit/blob/main/packages/glob/RELEASES.md)
- [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/glob)
---
updated-dependencies:
- dependency-name: "@actions/glob"
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
* fix for check-dist and license failures
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Aparna Jyothi <aparnajyothi-y@github.com>
Co-authored-by: “gowridurgad” <“hgowridurgad@github.com>
* Bump @vercel/ncc from 0.38.1 to 0.38.3
Bumps [@vercel/ncc](https://github.com/vercel/ncc) from 0.38.1 to 0.38.3.
- [Release notes](https://github.com/vercel/ncc/releases)
- [Commits](vercel/ncc@0.38.1...0.38.3)
---
updated-dependencies:
- dependency-name: "@vercel/ncc"
dependency-type: direct:development
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
* fix for check failures
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Aparna Jyothi <aparnajyothi-y@github.com>
* Bump @actions/tool-cache from 2.0.1 to 2.0.2
Bumps [@actions/tool-cache](https://github.com/actions/toolkit/tree/HEAD/packages/tool-cache) from 2.0.1 to 2.0.2.
- [Changelog](https://github.com/actions/toolkit/blob/main/packages/tool-cache/RELEASES.md)
- [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/tool-cache)
---
updated-dependencies:
- dependency-name: "@actions/tool-cache"
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
* check failures fix
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Aparna Jyothi <aparnajyothi-y@github.com>
trivikrand others added 30 commits February 26, 2026 13:09
* Replace uuid with crypto.randomUUID()
* chore: license cache
* chore: update files in dist
* fix: edits during resolve
* fix security alerts
* fix security alerts
* address Copilot suggestions
---------
Co-authored-by: gowridurgad <gowridurgad@gmail.com>
* Bump minimatch from 3.1.2 to 3.1.3
Bumps [minimatch](https://github.com/isaacs/minimatch) from 3.1.2 to 3.1.3.
- [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md)
- [Commits](isaacs/minimatch@v3.1.2...v3.1.3)
---
updated-dependencies:
- dependency-name: minimatch
dependency-version: 3.1.3
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
* Check failure fix
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: gowridurgad <gowridurgad@gmail.com>
* chore: upgrade @actions dependencies and update licenses
- @actions/core: ^1.11.1 → ^2.0.3
- @actions/cache: ^5.0.1 → ^5.0.5
- @actions/glob: ^0.5.0 → ^0.5.1
- @actions/http-client: ^2.2.1 → ^3.0.2
- @actions/tool-cache: ^2.0.2 → ^3.0.1
- @actions/io: ^1.0.2 → ^2.0.0
- Run npm audit fix
- Update license files for new versions
- Rebuild dist files
Agent-Logs-Url: https://github.com/actions/setup-node/sessions/872a3dbf-9b85-446b-963b-9127718d9560
Co-authored-by: gowridurgad <159780674+gowridurgad@users.noreply.github.com>
* fix: update license files to fix Licensed CI failures
Update 5 license records that were out of date after the dependency
upgrade:
- brace-expansion: 1.1.12 → 1.1.13
- fast-xml-builder: 1.0.0 → 1.1.4
- fast-xml-parser: 5.4.1 → 5.5.11
- strnum: 2.1.2 → 2.2.3
- path-expression-matcher: add new record (version 1.4.0, new transitive dep)
Rebuild dist/ files to reflect updated lock file
Agent-Logs-Url: https://github.com/actions/setup-node/sessions/fb0e70ce-ad19-48df-88a4-97f3bdc896cb
Co-authored-by: gowridurgad <159780674+gowridurgad@users.noreply.github.com>
* feat: upgrade @actions/exec to ^2.0.0 and fix license records
- Upgrade @actions/exec from ^1.1.1 to ^2.0.0 in package.json
- Update package-lock.json via npm install
- Run `licensed cache` to regenerate license records:
- Remove exec-1.1.1.dep.yml and exec-2.0.0.dep.yml (replaced by exec.dep.yml)
- Remove io-1.1.3.dep.yml and io-2.0.0.dep.yml (replaced by io.dep.yml)
- Create exec.dep.yml (v2.0.0) - single version now in tree
- Create io.dep.yml (v2.0.0) - @actions/exec@1.1.1's nested io@1.1.3 removed
- Rebuild dist/ files
Agent-Logs-Url: https://github.com/actions/setup-node/sessions/24a1a530-6840-4445-8262-8342ec739e6d
Co-authored-by: gowridurgad <159780674+gowridurgad@users.noreply.github.com>
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: gowridurgad <159780674+gowridurgad@users.noreply.github.com>
…1533)
* setup node in local
* update workflows to remove EOL versions
* update node-dist versions in versions.yml
* update restore-only cache example in advanced-usage.md
* fix copilot suggestion
* update naming
Co-authored-by: gowridurgad <gowridurgad@gmail.com>
* Only use `mirrorToken` in `getManifest` if it's provided
Signed-off-by: Timo Sand <timo.sand@f-secure.com>
* `npm run build`
Signed-off-by: Timo Sand <timo.sand@f-secure.com>
---------
Signed-off-by: Timo Sand <timo.sand@f-secure.com>
Bump @actions/cache to 5.1.0, log cache write denied
#1567)
* docs: Update caching recommendations to mitigate cache poisoning risks
* docs: Disable automatic npm caching to mitigate cache poisoning risks
* Add cache-primary-key and cache-matched-key as outputs
* Refine cache output descriptions
---------
Co-authored-by: gowridurgad <gowridurgad@gmail.com>
* Migrate to ESM
* updated package.json version
* Update README for v6 and clean up dev dependencies
* Remove unused ts-node
* fix audit issue
---------
Co-authored-by: gowridurgad <gowridurgad@gmail.com>
* Add Node version validation and manifest fetch retry
* Add debug logs for expected and actual Node versions
* chore: rebuild dist
* refactor: enhance debug logging for Node installation failure
* update test cases
* Improve formatting of test cases
* revert package-lock.json
Bump @actions/cache from ^6.1.0 to ^6.2.0 and rebuild the vendored dist
bundles (dist/setup, dist/cache-save) via ncc. Update the licensed cache
record for @actions/cache to 6.2.0.
6.2.0 ships two transparent client behaviors: honor ACTIONS_CACHE_MODE to
skip restore/save when the effective cache-mode disallows it, and surface a
core.warning (not a run failure) when the cache service denies a read/write
due to token scopes.
Copilot-Session: 0acd1380-0102-4f9d-b613-192a6ddef737
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
)
* Update workflow action pins and move Node 20 to 26
* fix: correct node version in v8-canary and update setup for node 22 x86
* chore: update setup-node action version from v6 to v7 in documentation
* fix: update pnpm/action-setup version to v6 in advanced usage documentation
Co-authored-by: Haritha <73516759+HarithaVattikuti@users.noreply.github.com>
Co-authored-by: gowridurgad <gowridurgad@gmail.com>
…-time DoS) (#1599)
* Initial plan
* fix: update brace-expansion to address GHSA-3jxr-9vmj-r5cp and rebuild dist
- brace-expansion 1.1.13 → 1.1.16 (GHSA-3jxr-9vmj-r5cp patched floor: 1.1.16)
- brace-expansion 2.1.1 → 2.1.2 (GHSA-3jxr-9vmj-r5cp patched floor: 2.1.2)
- brace-expansion 5.0.6 → 5.0.8 (GHSA-3jxr-9vmj-r5cp patched floor: 5.0.7; also fixes GHSA-mh99-v99m-4gvg)
- Regenerated package-lock.json
- Rebuilt dist/setup/index.js and dist/cache-save/index.js with patched dependency
Closes#1596
* fix: eliminate remaining brace-expansion vulnerabilities and update license cache
## Basic validation CI fix
Add `overrides` in package.json to eliminate all brace-expansion 1.x and 2.x
from the dependency tree, resolving GHSA-mh99-v99m-4gvg for all packages:
- `"@actions/glob": "$@actions/glob"` - forces @actions/cache to use the
root @actions/glob@0.7.0 (minimatch@10.x → brace-expansion@5.0.8) instead
of its bundled @actions/glob@0.6.1 (minimatch@3.x → brace-expansion@1.x)
- `"glob": {"minimatch": "^10.2.5"}` - forces glob@10.x to use
minimatch@10.x → brace-expansion@5.0.8 instead of minimatch@9.x → brace-expansion@2.x
- `"test-exclude": "^7.0.2"` - upgrades test-exclude to a version that
natively uses minimatch@10.x (instead of @3.x), removing brace-expansion@1.x
from the jest coverage instrumentation path
`npm audit --audit-level=high` now reports 0 vulnerabilities.
## Licensed CI fix
Update .licenses/npm/ cache to match the new dependency tree:
- Add: brace-expansion-5.0.8.dep.yml
- Add: minimatch-10.2.6.dep.yml
- Remove stale: brace-expansion-1.1.13.dep.yml (already done in prev commit)
- Remove stale: brace-expansion-5.0.6.dep.yml (already done in prev commit)
- Remove stale: minimatch-3.1.5.dep.yml
- Remove stale: @actions/glob-0.6.1.dep.yml
- Remove stale: concat-map.dep.yml
- Remove stale: balanced-match-1.0.2.dep.yml
Rebuild dist artifacts to include updated brace-expansion.
* fix: replace brace-expansion workarounds with single override
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Bumps [actions/checkout](https://github.com/actions/checkout) from 7.0.0 to 7.0.1.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@9c091bb...3d3c42e)
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 7.0.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* feat: add support for mise.toml file
feat: add support for mise.toml file
feat: update licensed cache
feat: switch from js-toml to smol-toml to reduce deps and bundle size
* feat: added docs and improved tests
* feat: added docs and improved tests
* ci: fix ci
* ci: fix ci
Bumps [prettier](https://github.com/prettier/prettier) from 3.8.4 to 3.9.6.
- [Release notes](https://github.com/prettier/prettier/releases)
- [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md)
- [Commits](prettier/prettier@3.8.4...3.9.6)
---
updated-dependencies:
- dependency-name: prettier
dependency-version: 3.9.5
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
* Bump @vercel/ncc from 0.44.0 to 0.45.0
Bumps [@vercel/ncc](https://github.com/vercel/ncc) from 0.44.0 to 0.45.0.
- [Release notes](https://github.com/vercel/ncc/releases)
- [Commits](vercel/ncc@0.44.0...0.45.0)
---
updated-dependencies:
- dependency-name: "@vercel/ncc"
dependency-version: 0.45.0
dependency-type: direct:development
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
* rebuild bundle after ncc bump
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: gowridurgad <gowridurgad@gmail.com>
Bumps [pnpm/action-setup](https://github.com/pnpm/action-setup) from 6.0.9 to 6.0.10.
- [Release notes](https://github.com/pnpm/action-setup/releases)
- [Commits](pnpm/action-setup@0ebf471...0977fd9)
---
updated-dependencies:
- dependency-name: pnpm/action-setup
dependency-version: 6.0.10
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

⤵️ pullmerge-conflictResolve conflicts manually

Projects

None yet

Development

Successfully merging this pull request may close these issues.

16 participants

@ajuare8@migo557@WYAgroecology@kahbly7-star@bytalrbllqarat-maker@juniorrodriguezhernandz-star@xeshanahmed11-byte@netsoantonov-maker@v-HarithaVattikuti@suyashgaonkar@v-priyagupta108@Jcambass@fulldecent@aparnajyothi-y@jww3@pengx17