Skip to content

Commit a88e27c

Browse files
tensornulltensornull
committed
Merge branch 'main' into agent/update-pr4
2 parents fad128c + 61e97b2 commit a88e27c

8 files changed

Lines changed: 118 additions & 37 deletions

File tree

‎.github/workflows/ci.yml‎

Lines changed: 75 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -23,11 +23,11 @@ jobs:
2323
timeout-minutes: 5
2424
steps:
2525
- name: Check out the repository
26-
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
26+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
2727
with:
2828
persist-credentials: false
2929
- name: Set up Node.js 24
30-
uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
30+
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
3131
with:
3232
node-version: 24.x
3333
cache: npm
@@ -70,12 +70,12 @@ jobs:
7070
- 24.x
7171
steps:
7272
- name: Check out the repository
73-
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
73+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
7474
with:
7575
fetch-depth: 0
7676
persist-credentials: false
7777
- name: Set up Node.js ${{ matrix.node-version }}
78-
uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
78+
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
7979
with:
8080
node-version: ${{ matrix.node-version }}
8181
cache: npm
@@ -102,17 +102,80 @@ jobs:
102102
- name: Test packed-package fixtures
103103
run: npm run test:fixtures
104104

105+
artifact-pack:
106+
name: Pack the CI artifact
107+
runs-on: ubuntu-latest
108+
timeout-minutes: 15
109+
outputs:
110+
sha256: ${{ steps.pack.outputs.sha256 }}
111+
steps:
112+
- name: Check out the repository
113+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
114+
with:
115+
persist-credentials: false
116+
- name: Set up Node.js 24
117+
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
118+
with:
119+
node-version: 24.x
120+
cache: npm
121+
- name: Install locked dependencies
122+
run: npm ci
123+
- name: Pack exactly one artifact
124+
id: pack
125+
shell: bash
126+
run: |
127+
set -euo pipefail
128+
mkdir -p ci-artifacts
129+
npm pack --pack-destination ci-artifacts
130+
mapfile -t tarballs < <(find ci-artifacts -maxdepth 1 -type f -name '*.tgz' -print)
131+
if [[ "${#tarballs[@]}" -ne 1 ]]; then
132+
echo "Expected exactly one packed artifact, found ${#tarballs[@]}." >&2
133+
exit 1
134+
fi
135+
echo "sha256=$(sha256sum "${tarballs[0]}" | awk '{ print $1 }')" >> "$GITHUB_OUTPUT"
136+
- name: Upload the packed artifact
137+
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
138+
with:
139+
name: ci-npm-package
140+
path: ci-artifacts/*.tgz
141+
if-no-files-found: error
142+
143+
artifact-download:
144+
name: Verify the CI artifact round-trip
145+
needs:
146+
- artifact-pack
147+
runs-on: ubuntu-latest
148+
timeout-minutes: 10
149+
steps:
150+
- name: Download the packed artifact by name
151+
uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
152+
with:
153+
name: ci-npm-package
154+
path: ci-artifacts
155+
- name: Verify the unique artifact and its digest
156+
env:
157+
EXPECTED_SHA256: ${{ needs.artifact-pack.outputs.sha256 }}
158+
shell: bash
159+
run: |
160+
set -euo pipefail
161+
mapfile -t tarballs < <(find ci-artifacts -maxdepth 1 -type f -name '*.tgz' -print)
162+
if [[ "${#tarballs[@]}" -ne 1 ]]; then
163+
echo "Expected exactly one downloaded artifact, found ${#tarballs[@]}." >&2
164+
exit 1
165+
fi
166+
echo "$EXPECTED_SHA256 ${tarballs[0]}" | sha256sum --check --strict
167+
105168
minimum-openai:
106169
name: Minimum OpenAI / Node.js 22
107170
runs-on: ubuntu-latest
108171
timeout-minutes: 20
109172
steps:
110173
- name: Check out the repository
111-
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
174+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
112175
with:
113176
persist-credentials: false
114177
- name: Set up Node.js 22
115-
uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
178+
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
116179
with:
117180
node-version: 22.x
118181
cache: npm
@@ -130,11 +193,11 @@ jobs:
130193
timeout-minutes: 20
131194
steps:
132195
- name: Check out the repository
133-
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
196+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
134197
with:
135198
persist-credentials: false
136199
- name: Set up Node.js 24
137-
uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
200+
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
138201
with:
139202
node-version: 24.x
140203
cache: npm
@@ -150,11 +213,11 @@ jobs:
150213
timeout-minutes: 20
151214
steps:
152215
- name: Check out the repository
153-
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
216+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
154217
with:
155218
persist-credentials: false
156219
- name: Set up Node.js 26
157-
uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
220+
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
158221
with:
159222
node-version: 26.x
160223
cache: npm
@@ -177,11 +240,11 @@ jobs:
177240
timeout-minutes: 25
178241
steps:
179242
- name: Check out the repository
180-
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
243+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
181244
with:
182245
persist-credentials: false
183246
- name: Set up Node.js 24
184-
uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
247+
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
185248
with:
186249
node-version: 24.x
187250
cache: npm

‎.github/workflows/live-smoke.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,11 +25,11 @@ jobs:
2525
timeout-minutes: 5
2626
steps:
2727
- name: Check out the repository
28-
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
28+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
2929
with:
3030
persist-credentials: false
3131
- name: Set up Node.js 24
32-
uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
32+
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
3333
with:
3434
node-version: 24.x
3535
cache: npm

‎.github/workflows/publish.yml‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ jobs:
2424
version: ${{ steps.version.outputs.version }}
2525
steps:
2626
- name: Check out the published release tag
27-
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
27+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
2828
with:
2929
fetch-depth: 0
3030
persist-credentials: false
@@ -82,7 +82,7 @@ jobs:
8282
8383
echo "release-commit=${release_commit}" >> "$GITHUB_OUTPUT"
8484
- name: Set up Node.js 24
85-
uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
85+
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
8686
with:
8787
node-version: 24.x
8888
cache: npm
@@ -158,12 +158,12 @@ jobs:
158158
environment: live-smoke
159159
steps:
160160
- name: Check out the verified release tag
161-
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
161+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
162162
with:
163163
persist-credentials: false
164164
ref: ${{ needs.verify.outputs.release-commit }}
165165
- name: Set up Node.js 24
166-
uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
166+
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
167167
with:
168168
node-version: 24.x
169169
cache: npm
@@ -199,14 +199,15 @@ jobs:
199199
id-token: write
200200
steps:
201201
- name: Check out the verified release commit
202-
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
202+
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
203203
with:
204204
persist-credentials: false
205205
ref: ${{ needs.verify.outputs.release-commit }}
206206
- name: Set up Node.js 24
207-
uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
207+
uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
208208
with:
209209
node-version: 24.x
210+
package-manager-cache: false
210211
registry-url: https://registry.npmjs.org
211212
- name: Use a Trusted Publishing-capable npm CLI
212213
run: npm install --global npm@11.12.1

‎.github/workflows/release-please.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ jobs:
2323
pull-requests: write
2424
steps:
2525
- name: Run Release Please
26-
uses: googleapis/release-please-action@c2a5a2bd6a758a0937f1ddb1e8950609867ed15c # v4.3.0
26+
uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
2727
with:
2828
config-file: release-please-config.json
2929
manifest-file: .release-please-manifest.json

‎scripts/publish-artifact.sh‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -7,11 +7,7 @@ set -euo pipefail
77

88
artifact_directory="${ARTIFACT_DIRECTORY:-release-artifacts}"
99

10-
# actions/setup-node exports this fixed sentinel when registry-url is configured,
11-
# including the npm-documented Trusted Publishing workflow.
12-
setup_node_auth_placeholder="XXXXX-XXXXX-XXXXX-XXXXX"
13-
if [[ -n "${NPM_TOKEN:-}" ]] || \
14-
[[ -n "${NODE_AUTH_TOKEN:-}" && "${NODE_AUTH_TOKEN}" != "$setup_node_auth_placeholder" ]]; then
10+
if [[ -n "${NPM_TOKEN:-}" ]] || [[ -n "${NODE_AUTH_TOKEN:-}" ]]; then
1511
echo "Registry tokens are forbidden; publication must use npm Trusted Publishing." >&2
1612
exit 1
1713
fi

‎tests/ci-workflow.test.mjs‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -122,4 +122,29 @@ describe("blocking CI workflow", () => {
122122
run: "npm run test:live-contract",
123123
});
124124
});
125+
126+
it("round-trips one packed artifact across separate jobs", () => {
127+
const jobs = readWorkflow().jobs;
128+
const pack = jobs?.["artifact-pack"];
129+
const download = jobs?.["artifact-download"];
130+
131+
expect(pack?.outputs).toEqual({
132+
sha256: "${{ steps.pack.outputs.sha256 }}",
133+
});
134+
expect(download?.needs).toEqual(["artifact-pack"]);
135+
expect(pack.steps.some((step) => step.run?.includes("npm pack"))).toBe(
136+
true,
137+
);
138+
expect(
139+
pack.steps.some((step) =>
140+
step.uses?.startsWith("actions/upload-artifact@"),
141+
),
142+
).toBe(true);
143+
expect(
144+
download.steps.some((step) =>
145+
step.uses?.startsWith("actions/download-artifact@"),
146+
),
147+
).toBe(true);
148+
expect(download.steps.at(-1).run).toContain("sha256sum --check --strict");
149+
});
125150
});

‎tests/publish-artifact.test.mjs‎

Lines changed: 4 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,6 @@ import { afterEach, describe, expect, it } from "vitest";
1818
const script = fileURLToPath(
1919
new URL("../scripts/publish-artifact.sh", import.meta.url),
2020
);
21-
const setupNodeAuthPlaceholder = "XXXXX-XXXXX-XXXXX-XXXXX";
2221
const temporaryDirectories = [];
2322

2423
afterEach(() => {
@@ -97,17 +96,11 @@ describe("publish artifact authentication", () => {
9796
);
9897
});
9998

100-
it("allows the actions/setup-node authentication placeholder", () => {
101-
const { log, result } = runPublish({
102-
nodeAuthToken: setupNodeAuthPlaceholder,
103-
});
104-
expect(result.status, result.stderr).toBe(0);
105-
expect(log).toMatch(
106-
/^token-present\npublish .* --provenance --tag next\n$/,
107-
);
108-
});
109-
11099
it.each([
100+
[
101+
"NODE_AUTH_TOKEN setup-node sentinel",
102+
{ nodeAuthToken: "XXXXX-XXXXX-XXXXX-XXXXX" },
103+
],
111104
["NODE_AUTH_TOKEN", { nodeAuthToken: "opaque" }],
112105
["NPM_TOKEN", { npmToken: "opaque" }],
113106
])("rejects the %s registry credential", (_name, options) => {

‎tests/workflow-contract.test.mjs‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -116,6 +116,9 @@ describe("GitHub Actions workflow contract", () => {
116116
expect(publishWorkflow).not.toContain("NPM_ALPHA1_BOOTSTRAP");
117117
expect(publishWorkflow).not.toContain("recover-verify");
118118
expect(publishWorkflow).not.toContain("recover-publish");
119+
expect(publish).toMatch(
120+
/package-manager-cache: false\n {10}registry-url: https:\/\/registry\.npmjs\.org/,
121+
);
119122
});
120123

121124
it("pins third-party actions and disables checkout credential persistence", () => {

0 commit comments

Comments
 (0)