@effected/github-actions 0.12.0 → 0.13.1

package/internal/fsProbe.js

@@ -0,0 +1,14 @@
+import { Effect } from "effect";
+
+//#region src/internal/fsProbe.ts
+/**
+* The entry's type, or `undefined` when nothing readable is there. Absence
+* and unreadability collapse together on purpose: every caller's next move
+* (reinstall, write the shim, fail `layoutUnexpected`) is the same for both.
+*
+* @internal
+*/
+const typeAt = (fs, path) => Effect.map(Effect.option(fs.stat(path)), (info) => info._tag === "Some" ? info.value.type : void 0);
+
+//#endregion
+export { typeAt };

package/internal/jwt.js

@@ -0,0 +1,63 @@
+import { Encoding, Result } from "effect";
+
+//#region src/internal/jwt.ts
+/**
+* The JWT segment codec — read a payload, or frame an unsigned token — for the
+* two places this package reads a runner-issued token's claims.
+*
+* @remarks
+* **No signature verification, deliberately.** Every token read here was
+* handed to this process by the runner that started it, and the claim read
+* scopes a request (`actionsResults`) or is republished for a verifier
+* elsewhere (`OidcTokenIssuer`); neither authorizes anything on the strength
+* of the claim alone. Do not "fix" it here.
+*
+* Core `Encoding` does the base64url work, so no `Buffer` is involved: it is
+* strict about the alphabet where Node's decoder is forgiving, which is why
+* there is a test whose payload actually contains `-` and `_`.
+*
+* @internal
+*/
+/**
+* The decoded payload of `token` — the middle segment, base64url JSON —
+* without any check on the signature.
+*
+* @internal
+*/
+const payloadOf = (token) => {
+	const segments = token.split(".");
+	const payload = segments[1];
+	if (segments.length !== 3 || payload === void 0 || payload === "") return Result.fail({
+		kind: "segments",
+		detail: `expected three segments, got ${segments.length}`
+	});
+	const json = Encoding.decodeBase64UrlString(payload);
+	if (Result.isFailure(json)) return Result.fail({
+		kind: "payload",
+		detail: "the payload is not base64url JSON",
+		cause: json.failure
+	});
+	try {
+		return Result.succeed(JSON.parse(json.success));
+	} catch (cause) {
+		return Result.fail({
+			kind: "payload",
+			detail: "the payload is not base64url JSON",
+			cause
+		});
+	}
+};
+/**
+* An **unsigned** JWT: `header.payload.unsigned`, each JSON segment
+* base64url-encoded. For building test doubles and nothing else — the
+* signature segment is a placeholder, so this token fails any verifier.
+*
+* @internal
+*/
+const unsignedJwt = (header, payload) => {
+	const segment = (value) => Encoding.encodeBase64Url(JSON.stringify(value));
+	return `${segment(header)}.${segment(payload)}.unsigned`;
+};
+
+//#endregion
+export { payloadOf, unsignedJwt };

package/internal/runner.js

@@ -0,0 +1,31 @@
+import { Effect, Option } from "effect";
+
+//#region src/internal/runner.ts
+/**
+* Whether `RUNNER_OS` says Windows. `false` when unset — off a runner, the
+* POSIX shape is the honest default.
+*
+* @internal
+*/
+const isWindowsRunner = (env) => Effect.map(env.getOptional("RUNNER_OS"), (found) => Option.match(found, {
+	onNone: () => false,
+	onSome: (os) => os.toLowerCase() === "windows"
+}));
+/**
+* The tool-cache root: `RUNNER_TOOL_CACHE`, or `/tmp/runner-tool-cache` off a
+* runner.
+*
+* @remarks
+* Resolved at layer construction, never at import: the source package read
+* the variable into a module-level constant, which fixed the root before any
+* layer could say otherwise and made it impossible to point a test elsewhere.
+* `PackageManagerInstaller` resolves the same root because the shims it
+* writes into a staged entry must name the FINAL cache path; sharing the
+* resolution is what keeps its post-swap equality check a formality.
+*
+* @internal
+*/
+const toolCacheRoot = (env, path) => Effect.map(env.getOptional("RUNNER_TOOL_CACHE"), (found) => Option.getOrElse(found, () => path.join("/tmp", "runner-tool-cache")));
+
+//#endregion
+export { isWindowsRunner, toolCacheRoot };

package/internal/runnerFile.js

@@ -0,0 +1,45 @@
+//#region src/internal/runnerFile.ts
+/**
+* The runner-file heredoc protocol — `GITHUB_OUTPUT`, `GITHUB_ENV` and
+* `GITHUB_STATE` all take `name<<DELIM\nvalue\nDELIM\n` — spelled once for
+* `ActionOutputs` and `ActionState`.
+*
+* @remarks
+* **Delimiters are derived, never random.** GitHub's own toolkit uses a
+* random UUID here and accepts the (tiny) chance of collision. Deriving the
+* delimiter instead makes collision **impossible** rather than improbable,
+* needs no randomness — so no `Crypto` in `R` and no unreproducible output —
+* and is trivially testable. A value that contains a delimiter would
+* terminate its block early and corrupt every entry after it, which is a
+* value-controlled injection into the runner's own file.
+*
+* @internal
+*/
+/** The base delimiter for a heredoc block. */
+const BASE_DELIMITER = "EFFECTED_EOF";
+/** A delimiter guaranteed absent from `value`. @internal */
+const delimiterFor = (value) => {
+	let delimiter = BASE_DELIMITER;
+	while (value.includes(delimiter)) delimiter = `${delimiter}_`;
+	return delimiter;
+};
+/**
+* Whether `name` can head a block without breaking the structure it lives
+* in: non-empty, and free of the line breaks that would end it early.
+*
+* @internal
+*/
+const isUsableName = (name) => name !== "" && !/[\r\n]/.test(name);
+/**
+* One heredoc block, ready to append. The caller has checked the name with
+* {@link isUsableName}.
+*
+* @internal
+*/
+const heredocBlock = (name, value) => {
+	const delimiter = delimiterFor(value);
+	return `${name}<<${delimiter}\n${value}\n${delimiter}\n`;
+};
+
+//#endregion
+export { delimiterFor, heredocBlock, isUsableName };

package/internal/sigv4.js

@@ -1,4 +1,5 @@
-import { createHash, createHmac } from "node:crypto";
+import { sha256Hex } from "./digest.js";
+import { createHmac } from "node:crypto";
 
 //#region src/internal/sigv4.ts
 /**
@@ -18,7 +19,6 @@ import { createHash, createHmac } from "node:crypto";
 * @internal
 */
 const ALGORITHM = "AWS4-HMAC-SHA256";
-const sha256Hex = (value) => createHash("sha256").update(value).digest("hex");
 const hmac = (key, value) => new Uint8Array(createHmac("sha256", key).update(value).digest());
 /**
 * Percent-encode one path segment the way SigV4 requires.
@@ -114,4 +114,4 @@ const sign = (request, credentials) => {
 };
 
 //#endregion
-export { canonicalize, sign, signingKey, uriEncode };
+export { canonicalize, sha256Hex as digestHex, sign, signingKey, uriEncode };

package/internal/spawn.js

@@ -0,0 +1,18 @@
+import { Effect, Stream } from "effect";
+
+//#region src/internal/spawn.ts
+/**
+* Spawn `command` once, drain `stdout`+`stderr`, then read the exit code from
+* the same handle. Never fails on a non-zero exit — that is the caller's
+* policy.
+*/
+const spawnOnce = (spawner, command) => Effect.scoped(Effect.gen(function* () {
+	const handle = yield* spawner.spawn(command);
+	return {
+		output: yield* Stream.mkString(Stream.decodeText(handle.all)),
+		code: yield* handle.exitCode
+	};
+}));
+
+//#endregion
+export { spawnOnce };

package/internal/twirp.js

@@ -14,6 +14,23 @@ import { HttpClientRequest } from "effect/unstable/http";
 */
 const CONFLICT = Symbol.for("@effected/github-actions/twirp/conflict");
 /**
+* The error fields a {@link TwirpFailure} contributes to a caller's own error
+* class — the cache, artifact and blob-store errors all carry `reason`,
+* `status`, `detail` and `cause` under the same names, so each spreads this
+* and adds its own identifier.
+*
+* @internal
+*/
+const twirpFailureFields = (failure) => failure.kind === "status" ? {
+	reason: "refused",
+	detail: failure.method,
+	...failure.status === void 0 ? {} : { status: failure.status }
+} : {
+	reason: "unreachable",
+	detail: `${failure.method} did not answer with a Twirp body`,
+	...failure.cause === void 0 ? {} : { cause: failure.cause }
+};
+/**
 * Whether retrying could plausibly help.
 *
 * @remarks
@@ -94,4 +111,4 @@ const stringField = (body, name) => {
 const isOk = (body) => field(body, "ok") === true;
 
 //#endregion
-export { CONFLICT, field, isOk, isRetryable, stringField, twirpCall };
+export { CONFLICT, field, isOk, isRetryable, stringField, twirpCall, twirpFailureFields };

package/internal/unstubbed.js

@@ -0,0 +1,28 @@
+import { Effect } from "effect";
+
+//#region src/internal/unstubbed.ts
+/**
+* The one way an unstubbed test-double member dies, for every `makeTest` in
+* this package.
+*
+* @remarks
+* A double's unstubbed member must die rather than silently succeed — a stub
+* that returns nothing teaches a test that nothing happened. The message names
+* the double, the member and the override that fixes it, and it is spelled
+* here once so a wording change is one edit rather than ten.
+*
+* @internal
+*/
+/**
+* The die-on-call members of `<double>.makeTest`: `dies("save")` is an
+* `Effect` that defects naming `save` when run. Each package double binds its
+* own name once, then lists its members.
+*
+* @internal
+*/
+const unstubbed = (double) => (member) => Effect.sync(() => {
+	throw new Error(`${double}: ${member}() was called but not stubbed — pass a \`${member}\` override.`);
+});
+
+//#endregion
+export { unstubbed };

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@effected/github-actions",
-	"version": "0.12.0",
+	"version": "0.13.1",
 	"private": false,
 	"description": "The GitHub Actions runtime: env, inputs, outputs, state, logging, cache, artifacts, blob storage, OIDC and the token bridge.",
 	"keywords": [
@@ -39,12 +39,13 @@
 	},
 	"dependencies": {
 		"@azure/storage-blob": "^12.33.0",
-		"@effected/github": "^0.10.0",
+		"@effected/github": "^0.10.1",
 		"@effected/glob": "^0.6.0",
 		"@effected/markdown": "^0.10.0",
 		"@effected/npm": "^0.14.0",
-		"@effected/sbom": "^0.6.0",
-		"@effected/templates": "^0.6.0"
+		"@effected/sbom": "^0.6.1",
+		"@effected/templates": "^0.6.0",
+		"@effected/walker": "^0.9.0"
 	},
 	"peerDependencies": {
 		"@effect/platform-node": "4.0.0-rc.115",