@effected/github-actions 0.13.1 → 0.13.3

package/PackageManagerInstaller.js

@@ -3,6 +3,7 @@ import { unstubbed } from "./internal/unstubbed.js";
 import { digestFileHex } from "./internal/digest.js";
 import { isWindowsRunner, toolCacheRoot } from "./internal/runner.js";
 import { typeAt } from "./internal/fsProbe.js";
+import { PNPM_EXE_PREFIX, detectMusl, isNodeScript, pnpmExeTarget, strongestSri } from "./internal/pnpmExe.js";
 import { ToolInstaller } from "./ToolInstaller.js";
 import { Context, Effect, FileSystem, Layer, Option, Path, Schema } from "effect";
 import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process";
@@ -22,9 +23,11 @@ var PackageManagerInstallerError = class extends Schema.TaggedError()("PackageMa
 	* entry). `integrityMismatch` — the downloaded artifact does not hash to
 	* what the pin declares; nothing was cached. `integrityMissing` — the pin
 	* carries no integrity and the caller asked for `requireIntegrity`.
-	* `unsupportedPlatform` — bun publishes no build for this runner's
-	* OS/architecture pair. `layoutUnexpected` — the artifact extracted, but
-	* its contents are not shaped like the package manager it claims to be.
+	* `unsupportedPlatform` — no build exists for this runner's
+	* OS/architecture pair: bun publishes none, or pnpm 12 ships no
+	* `@pnpm/exe.*` native binary for it. `layoutUnexpected` — the artifact
+	* extracted, but its contents are not shaped like the package manager it
+	* claims to be.
 	*/
 	reason: Schema.Literals([
 		"downloadFailed",
@@ -93,10 +96,14 @@ var AmbientPackageManager = class extends Schema.Class("AmbientPackageManager")(
 * on Windows); for bun it is the entry directory itself, because the cached
 * `bun` binary is directly executable and a shim would add nothing but a
 * fork. `bins` still maps each published bin name to the underlying entry —
-* a Node script to run with `node` for npm/pnpm/yarn, the native binary for
-* bun. Calling `addPath` remains deliberately the consumer's move, and note
-* that `addPath` targets *subsequent* steps: a same-process probe must use
-* the absolute paths in `bins` or `binDir`.
+* a Node script to run with `node` for npm, yarn and pnpm 11 and earlier; an
+* executable to run directly for bun and for pnpm 12+, whose `pnpm` is the
+* host's native binary (overlaid onto the cached wrapper the way pnpm's own
+* install script does) and whose `pn`/`pnpx`/`pnx` are shell aliases of it.
+* Each shim already applies that distinction. Calling `addPath` remains
+* deliberately the consumer's move, and note that `addPath` targets
+* *subsequent* steps: a same-process probe must use the absolute paths in
+* `bins` or `binDir`.
 *
 * @public
 */
@@ -136,12 +143,23 @@ const InstalledPackageManager = Schema.Union([AmbientPackageManager, CachedPacka
 /** The shim directory name inside a cached npm-registry-manager entry. */
 const SHIM_DIR = ".bin";
 /**
-* The POSIX shim body: an `exec` wrapper so the shim's process *becomes*
-* node, and `"$@"` so arguments survive quoting intact.
+* The POSIX shim body: an `exec` wrapper so the shim's process *becomes* the
+* target, and `"$@"` so arguments survive quoting intact. A Node script
+* (`.js`/`.mjs`/`.cjs`) runs under `node`; anything else — pnpm 12's native
+* binary, its `#!/bin/sh` alias scripts — is exec'd directly, because handing
+* a shell script or a Mach-O to node is exactly the "Invalid or unexpected
+* token" failure this rule exists to prevent.
 */
-const posixShim = (target) => `#!/bin/sh\nexec node "${target}" "$@"\n`;
-/** The Windows shim body, CRLF-terminated as cmd expects. */
-const cmdShim = (target) => `@echo off\r\nnode "${target}" %*\r\n`;
+const posixShim = (target) => isNodeScript(target) ? `#!/bin/sh\nexec node "${target}" "$@"\n` : `#!/bin/sh\nexec "${target}" "$@"\n`;
+/** The Windows shim body, CRLF-terminated as cmd expects; same node-vs-direct rule. */
+const cmdShim = (target) => isNodeScript(target) ? `@echo off\r\nnode "${target}" %*\r\n` : `@echo off\r\n"${target}" %*\r\n`;
+/** The bin names pnpm's wrapper publishes, every one of which becomes the native binary on Windows. */
+const PNPM_NATIVE_BIN_NAMES = [
+	"pnpm",
+	"pn",
+	"pnpx",
+	"pnx"
+];
 /**
 * The bun release asset name for a runner platform, or `None` when bun
 * publishes no build for it.
@@ -201,6 +219,7 @@ const make = Effect.gen(function* () {
 		onSome: archFromRunner
 	}));
 	const windows = yield* isWindowsRunner(env);
+	const musl = detectMusl();
 	const bunBinaryName = windows ? "bun.exe" : "bun";
 	const shimFileName = (name) => windows ? `${name}.cmd` : name;
 	const shimBody = windows ? cmdShim : posixShim;
@@ -265,13 +284,18 @@ const make = Effect.gen(function* () {
 		}));
 	});
 	/**
-	* The bin entries a package directory publishes, from its own manifest.
+	* What a package directory's own manifest says about its entry points: the
+	* `bin` map, plus the `@pnpm/exe.*` optional dependencies that mark the
+	* pnpm 12 native-binary layout (empty for every other manager and version).
 	*
 	* Read from the artifact rather than hardcoded per manager, because the
 	* layouts genuinely move — corepack's own table has pnpm's entry at
-	* `bin/pnpm.cjs` through v10 and `bin/pnpm.mjs` from v11.
+	* `bin/pnpm.cjs` through v10 and `bin/pnpm.mjs` from v11, and from v12 the
+	* `pnpm` bin is a placeholder for a native binary shipped as a separate
+	* package. Both maps are attacker-supplied bytes and are normalized to
+	* string → string before anything downstream reads them.
 	*/
-	const readPackageBins = (pin, packageDir) => Effect.gen(function* () {
+	const readPackageManifest = (pin, packageDir) => Effect.gen(function* () {
 		const manifestPath = path.join(packageDir, "package.json");
 		const raw = yield* fs.readFileString(manifestPath).pipe(Effect.mapError((cause) => errorFor(pin)({
 			reason: "layoutUnexpected",
@@ -300,8 +324,41 @@ const make = Effect.gen(function* () {
 			}));
 			yield* assertFile(pin, target, `bin ${name} (${relative}) is missing`);
 		}
-		return bins;
+		return {
+			bins,
+			nativePackages: nativePackagesOf(manifest.optionalDependencies)
+		};
 	});
+	/**
+	* The `@pnpm/exe.<target>` → version entries of an `optionalDependencies`
+	* value, and nothing else: only well-formed string pairs under that prefix
+	* survive, so a hostile or malformed map cannot smuggle a package name
+	* into a registry url.
+	*/
+	const nativePackagesOf = (optionalDependencies) => {
+		if (typeof optionalDependencies !== "object" || optionalDependencies === null) return {};
+		const entries = {};
+		for (const [name, version] of Object.entries(optionalDependencies)) if (name.startsWith("@pnpm/exe.") && typeof version === "string") entries[name] = version;
+		return entries;
+	};
+	/**
+	* pnpm's Windows overlay places the native binary as `<name>.exe` for every
+	* wrapper bin and repoints `bin` at those; this is that repoint, applied to
+	* the in-memory map (the shims and the record) rather than the manifest.
+	*/
+	const nativeWindowsBins = (bins) => Object.fromEntries(Object.entries(bins).map(([name, relative]) => PNPM_NATIVE_BIN_NAMES.includes(name) ? [name, `${relative}.exe`] : [name, relative]));
+	/**
+	* Whether a file is still pnpm's shebang-less placeholder (a `#`-led text
+	* file that is not a `#!` script) rather than the native binary meant to
+	* overlay it — the mark of an entry written by a version of this module
+	* that predates the overlay, or by a foreign writer that ran no lifecycle
+	* scripts. Anything else (a shebang, an executable's magic, an unreadable
+	* or empty file) is left to the ordinary layout checks.
+	*/
+	const isPlaceholder = (file) => Effect.scoped(Effect.flatMap(fs.open(file), (handle) => handle.readAlloc(2))).pipe(Effect.map((head) => Option.match(head, {
+		onNone: () => false,
+		onSome: (bytes) => bytes.length >= 1 && bytes[0] === 35 && bytes[1] !== 33
+	})), Effect.orElseSucceed(() => false));
 	const rootBins = (bins, directory) => Object.fromEntries(Object.entries(bins).map(([name, relative]) => [name, path.join(directory, relative)]));
 	/**
 	* Write one executable shim per bin into `<into>/.bin`, each invoking
@@ -333,28 +390,118 @@ const make = Effect.gen(function* () {
 			if (!windows) yield* fs.chmod(shim, 493).pipe(Effect.mapError(cacheError(shim)));
 		}
 	});
-	/** The record for a directory already in the cache, regenerating absent shims. */
+	/**
+	* The record for a directory already in the cache, regenerating absent
+	* shims — or `None` when the entry is a pnpm 12 wrapper whose `pnpm` bin is
+	* still the placeholder, which no shim can make runnable: the caller then
+	* reinstalls over it through the ordinary install path (ToolInstaller's
+	* swap removes the old entry and renames the complete new one into place).
+	*/
 	const cachedRecord = (pin, directory) => Effect.gen(function* () {
 		if (pin.name === "bun") {
 			const binary = path.join(directory, bunBinaryName);
 			yield* assertFile(pin, binary, `cached bun binary (${bunBinaryName}) is missing`);
-			return CachedPackageManager.make({
+			return Option.some(CachedPackageManager.make({
 				name: pin.name,
 				version: pin.version.toString(),
 				directory,
 				binDir: directory,
 				bins: { bun: binary }
-			});
+			}));
+		}
+		const manifest = yield* readPackageManifest(pin, directory);
+		let bins = manifest.bins;
+		if (Object.keys(manifest.nativePackages).length > 0) {
+			const entry = bins[pin.name];
+			if (entry !== void 0 && (yield* isPlaceholder(path.join(directory, entry)))) {
+				yield* Effect.logInfo(`The cached ${pin.name}@${pin.version.toString()} still holds pnpm's placeholder bin; reinstalling it over.`);
+				return Option.none();
+			}
+			if (windows) bins = nativeWindowsBins(bins);
 		}
-		const bins = yield* readPackageBins(pin, directory);
 		yield* writeShims(pin, directory, directory, bins, { skipExisting: true });
-		return CachedPackageManager.make({
+		return Option.some(CachedPackageManager.make({
 			name: pin.name,
 			version: pin.version.toString(),
 			directory,
 			binDir: path.join(directory, SHIM_DIR),
 			bins: rootBins(bins, directory)
+		}));
+	});
+	/**
+	* pnpm 12's native overlay, done here because the installer never runs the
+	* lifecycle script that does it upstream: pick the host's `@pnpm/exe.*`
+	* package from the wrapper's optional dependencies, fetch its tarball from
+	* the SAME registry the wrapper came from, verify it against the registry's
+	* own `dist.integrity` (fail-closed — this is a second artifact the pin
+	* never named, so there is no integrity-less posture to honor), and copy
+	* the executable over the placeholder in the STAGED wrapper, where `dist/`
+	* sits beside it as the binary expects. Answers the bins as they should be
+	* shimmed and recorded — retargeted to `.exe` on Windows, as upstream does.
+	*/
+	const overlayNativeBinary = (pin, packageDir, bins, nativePackages, registry) => Effect.gen(function* () {
+		const target = Option.getOrUndefined(pnpmExeTarget(runnerOs, arch, musl));
+		const packageName = target === void 0 ? void 0 : `${PNPM_EXE_PREFIX}${target}`;
+		const nativeVersion = packageName === void 0 ? void 0 : nativePackages[packageName];
+		if (target === void 0 || packageName === void 0 || nativeVersion === void 0) return yield* Effect.fail(errorFor(pin)({
+			reason: "unsupportedPlatform",
+			subject: `${runnerOs || "unknown"}/${arch}`
+		}));
+		if (nativeVersion !== pin.version.toString()) return yield* Effect.fail(errorFor(pin)({
+			reason: "layoutUnexpected",
+			subject: `${packageName} is pinned at ${nativeVersion}, not the wrapper's ${pin.version.toString()}`
+		}));
+		const placeholder = bins[pin.name];
+		if (placeholder === void 0) return yield* Effect.fail(errorFor(pin)({
+			reason: "layoutUnexpected",
+			subject: `package.json names no ${pin.name} bin to overlay`
+		}));
+		const packumentUrl = `${registry}/${packageName}/${nativeVersion}`;
+		const packumentFile = yield* installer.download(packumentUrl).pipe(Effect.mapError(fromInstaller(pin)));
+		const unverifiable = (cause) => errorFor(pin)({
+			reason: "integrityMismatch",
+			subject: packumentUrl,
+			...cause === void 0 ? {} : { cause }
+		});
+		const declared = (yield* fs.readFileString(packumentFile).pipe(Effect.mapError((cause) => unverifiable(cause)), Effect.flatMap((raw) => Effect.try({
+			try: () => JSON.parse(raw),
+			catch: (cause) => unverifiable(cause)
+		})))).dist?.integrity;
+		const expected = typeof declared === "string" ? Option.getOrUndefined(strongestSri(declared)) : void 0;
+		if (expected === void 0) return yield* Effect.fail(unverifiable());
+		const tarballUrl = `${registry}/${packageName}/-/exe.${target}-${nativeVersion}.tgz`;
+		const archive = yield* installer.download(tarballUrl).pipe(Effect.mapError(fromInstaller(pin)));
+		const actualHex = yield* hashFile(pin, archive, expected.algorithm);
+		if (actualHex !== expected.hex) return yield* Effect.fail(errorFor(pin)({
+			reason: "integrityMismatch",
+			subject: tarballUrl,
+			expected: `${expected.algorithm}.${expected.hex}`,
+			actual: `${expected.algorithm}.${actualHex}`
+		}));
+		const extracted = yield* installer.extractTar(archive).pipe(Effect.mapError(fromInstaller(pin)));
+		const nativeName = windows ? "pnpm.exe" : "pnpm";
+		const native = path.join(extracted, "package", nativeName);
+		yield* assertFile(pin, native, `package/${nativeName} is missing from the ${packageName} tarball`);
+		const cacheError = (subject) => (cause) => errorFor(pin)({
+			reason: "cacheFailed",
+			subject,
+			cause
 		});
+		if (windows) {
+			for (const name of PNPM_NATIVE_BIN_NAMES) {
+				const relative = bins[name];
+				if (relative === void 0) continue;
+				for (const destination of [path.join(packageDir, relative), path.join(packageDir, `${relative}.exe`)]) yield* fs.copyFile(native, destination).pipe(Effect.mapError(cacheError(destination)));
+			}
+			return nativeWindowsBins(bins);
+		}
+		const destination = path.join(packageDir, placeholder);
+		yield* fs.copyFile(native, destination).pipe(Effect.mapError(cacheError(destination)));
+		for (const relative of Object.values(bins)) if (!isNodeScript(relative)) {
+			const file = path.join(packageDir, relative);
+			yield* fs.chmod(file, 493).pipe(Effect.mapError(cacheError(file)));
+		}
+		return bins;
 	});
 	/** Download bun's per-platform zip from GitHub releases and cache the binary. */
 	const installBun = (pin) => Effect.gen(function* () {
@@ -397,7 +544,8 @@ const make = Effect.gen(function* () {
 			reason: "layoutUnexpected",
 			subject: "tarball has no package/ root"
 		}));
-		const bins = yield* readPackageBins(pin, packageDir);
+		const manifest = yield* readPackageManifest(pin, packageDir);
+		const bins = Object.keys(manifest.nativePackages).length > 0 ? yield* overlayNativeBinary(pin, packageDir, manifest.bins, manifest.nativePackages, registry) : manifest.bins;
 		if (berry) {
 			const cli = path.join(packageDir, "bin/yarn.js");
 			yield* assertFile(pin, cli, "bin/yarn.js is missing from the cli-dist tarball");
@@ -426,7 +574,10 @@ const make = Effect.gen(function* () {
 		});
 		if (options?.requireIntegrity === true && pin.integrity === void 0) return yield* Effect.fail(errorFor(pin)({ reason: "integrityMissing" }));
 		const cached = yield* installer.find(pin.name, version);
-		if (Option.isSome(cached)) return yield* cachedRecord(pin, cached.value);
+		if (Option.isSome(cached)) {
+			const record = yield* cachedRecord(pin, cached.value);
+			if (Option.isSome(record)) return record.value;
+		}
 		if (pin.name === "npm" && options?.allowAmbient !== false) {
 			const probed = yield* ambientNpmVersion;
 			if (Option.isSome(probed) && probed.value === version) return AmbientPackageManager.make({

package/index.d.ts

@@ -4490,9 +4490,11 @@ declare const PackageManagerInstallerError_base: Schema.Class<PackageManagerInst
    * entry). `integrityMismatch` — the downloaded artifact does not hash to
    * what the pin declares; nothing was cached. `integrityMissing` — the pin
    * carries no integrity and the caller asked for `requireIntegrity`.
-   * `unsupportedPlatform` — bun publishes no build for this runner's
-   * OS/architecture pair. `layoutUnexpected` — the artifact extracted, but
-   * its contents are not shaped like the package manager it claims to be.
+   * `unsupportedPlatform` — no build exists for this runner's
+   * OS/architecture pair: bun publishes none, or pnpm 12 ships no
+   * `@pnpm/exe.*` native binary for it. `layoutUnexpected` — the artifact
+   * extracted, but its contents are not shaped like the package manager it
+   * claims to be.
    */
   readonly reason: Schema.Literals<readonly ["downloadFailed", "extractFailed", "integrityMismatch", "integrityMissing", "unsupportedPlatform", "layoutUnexpected", "cacheFailed"]>;
   /** The package manager being installed. */
@@ -4530,10 +4532,14 @@ interface PackageManagerInstallOptions {
   readonly requireIntegrity?: boolean | undefined;
   /**
    * The npm registry host the npm, pnpm and yarn tarballs download from.
-   * Defaults to `https://registry.npmjs.org`; a corporate mirror that serves
-   * the standard `/<name>/-/<basename>-<version>.tgz` tarball routes works
-   * unchanged. bun does not ship through a registry — its per-platform zip
-   * always comes from GitHub releases.
+   * Defaults to `https://registry.npmjs.org`. A corporate mirror qualifies
+   * when it serves the standard `/<name>/-/<basename>-<version>.tgz` tarball
+   * route and — for pnpm 12 and later, whose native binary is a second
+   * artifact verified against the registry's own integrity — the
+   * `/<name>/<version>` packument route as JSON carrying `dist.integrity`.
+   * A tarball-only proxy fails a pnpm 12 pin with `downloadFailed` naming
+   * that packument url. bun does not ship through a registry — its
+   * per-platform zip always comes from GitHub releases.
    */
   readonly registry?: string | undefined;
   /**
@@ -4600,10 +4606,14 @@ declare const CachedPackageManager_base: Schema.Class<CachedPackageManager, Sche
  * on Windows); for bun it is the entry directory itself, because the cached
  * `bun` binary is directly executable and a shim would add nothing but a
  * fork. `bins` still maps each published bin name to the underlying entry —
- * a Node script to run with `node` for npm/pnpm/yarn, the native binary for
- * bun. Calling `addPath` remains deliberately the consumer's move, and note
- * that `addPath` targets *subsequent* steps: a same-process probe must use
- * the absolute paths in `bins` or `binDir`.
+ * a Node script to run with `node` for npm, yarn and pnpm 11 and earlier; an
+ * executable to run directly for bun and for pnpm 12+, whose `pnpm` is the
+ * host's native binary (overlaid onto the cached wrapper the way pnpm's own
+ * install script does) and whose `pn`/`pnpx`/`pnx` are shell aliases of it.
+ * Each shim already applies that distinction. Calling `addPath` remains
+ * deliberately the consumer's move, and note that `addPath` targets
+ * *subsequent* steps: a same-process probe must use the absolute paths in
+ * `bins` or `binDir`.
  *
  * @public
  */

package/internal/pnpmExe.js

@@ -0,0 +1,124 @@
+import { Encoding, Option, Result } from "effect";
+
+//#region src/internal/pnpmExe.ts
+/**
+* The pnpm native-binary layout: from pnpm 12 the `pnpm` registry package is a
+* thin wrapper whose `pnpm` bin is a shebang-less placeholder that the
+* package's own install script overwrites with the host's native executable,
+* fetched as an optional dependency named `@pnpm/exe.<os>-<arch>[-musl]`.
+* The installer never runs lifecycle scripts, so it performs that overlay
+* itself; the pure pieces of that live here, where they are testable without
+* a tarball.
+*
+* Detection is by LAYOUT (the manifest's `optionalDependencies` naming an
+* `@pnpm/exe.*` package), never by major version — pnpm 11 and earlier ship
+* no such dependency and keep their Node entry points.
+*
+* @internal
+*/
+/** The prefix every native-binary package name carries. @internal */
+const PNPM_EXE_PREFIX = "@pnpm/exe.";
+/**
+* The targets pnpm publishes a native binary for — the `PLATFORMS` table of
+* the wrapper's own `native-binary.mjs`, flattened to the spellings that
+* follow the prefix. Only linux x64/arm64 have a musl twin.
+*/
+const PNPM_EXE_TARGETS = /* @__PURE__ */ new Set([
+	"linux-x64",
+	"linux-arm64",
+	"linux-x64-musl",
+	"linux-arm64-musl",
+	"linux-riscv64",
+	"linux-ppc64",
+	"linux-s390x",
+	"darwin-x64",
+	"darwin-arm64",
+	"win32-x64",
+	"win32-arm64",
+	"freebsd-x64",
+	"android-x64",
+	"android-arm64"
+]);
+/** `RUNNER_OS` spellings (lower-cased) onto Node's `process.platform` spellings, which the targets use. */
+const RUNNER_OS_TO_PLATFORM = {
+	linux: "linux",
+	macos: "darwin",
+	windows: "win32"
+};
+/**
+* The `@pnpm/exe.*` target for a runner platform, or `None` when pnpm
+* publishes no native binary for it.
+*
+* `musl` only distinguishes on linux; an arch released for glibc alone
+* (riscv64, ppc64, s390x) answers `None` on a musl host, as upstream does —
+* the glibc binary cannot run there.
+*
+* @internal
+*/
+const pnpmExeTarget = (runnerOs, arch, musl) => {
+	const platform = RUNNER_OS_TO_PLATFORM[runnerOs.toLowerCase()];
+	if (platform === void 0) return Option.none();
+	const target = `${platform}-${arch}${platform === "linux" && musl ? "-musl" : ""}`;
+	return PNPM_EXE_TARGETS.has(target) ? Option.some(target) : Option.none();
+};
+/**
+* Whether the HOST libc is musl, the way the wrapper's `native-binary.mjs`
+* decides it: a glibc build of node reports `glibcVersionRuntime` in its
+* diagnostic report header, a musl build does not. Only meaningful on a
+* linux host; anything unprobeable counts as glibc, which is what every
+* hosted runner is.
+*
+* `process.report` is a global, not a `node:` import, so this stays inside
+* the package's closed `node:` list.
+*
+* @internal
+*/
+const detectMusl = () => {
+	if (process.platform !== "linux") return false;
+	try {
+		const report = process.report?.getReport();
+		if (report === void 0 || report.header === void 0) return false;
+		return report.header.glibcVersionRuntime === void 0 || report.header.glibcVersionRuntime === "";
+	} catch {
+		return false;
+	}
+};
+/** The SRI algorithms a registry may list, strongest first. */
+const SRI_ALGORITHMS = [
+	"sha512",
+	"sha384",
+	"sha256",
+	"sha1"
+];
+/**
+* The strongest entry of a Subresource Integrity string (`<algo>-<base64>`,
+* several separated by whitespace), as `{ algorithm, hex }` — the spelling a
+* corepack pin uses, so a mismatch reports both sides the same way. `None`
+* when nothing parseable is there.
+*
+* @internal
+*/
+const strongestSri = (integrity) => {
+	const entries = integrity.split(/\s+/).filter((entry) => entry.length > 0).flatMap((entry) => {
+		const dash = entry.indexOf("-");
+		if (dash <= 0) return [];
+		const algorithm = entry.slice(0, dash).toLowerCase();
+		if (!SRI_ALGORITHMS.includes(algorithm)) return [];
+		const digest = entry.slice(dash + 1).split("?")[0] ?? "";
+		const decoded = Encoding.decodeBase64(digest);
+		return Result.isSuccess(decoded) ? [{
+			algorithm,
+			hex: Encoding.encodeHex(decoded.success)
+		}] : [];
+	});
+	for (const algorithm of SRI_ALGORITHMS) {
+		const found = entries.find((entry) => entry.algorithm === algorithm);
+		if (found !== void 0) return Option.some(found);
+	}
+	return Option.none();
+};
+/** Whether a bin target is a Node script (run with `node`) rather than an executable run directly. @internal */
+const isNodeScript = (target) => /\.[cm]?js$/i.test(target);
+
+//#endregion
+export { PNPM_EXE_PREFIX, detectMusl, isNodeScript, pnpmExeTarget, strongestSri };

package/internal/runnerFile.js

@@ -25,11 +25,30 @@ const delimiterFor = (value) => {
 };
 /**
 * Whether `name` can head a block without breaking the structure it lives
-* in: non-empty, and free of the line breaks that would end it early.
+* in: non-empty, free of the line breaks that would end it early, and free
+* of the separators the runner's file-command parser would re-split the
+* line on.
+*
+* @remarks
+* The runner (`FileCommandManager`) locates the first `=` and the first
+* `<<` on each line and whichever comes first decides the shape: a
+* `key=value` property assignment, or a `name<<delimiter` heredoc block.
+* Because a block line is always `name<<DELIMITER`, an `=` anywhere in the
+* name precedes the marker and the line parses as a property assignment cut
+* at that `=`, leaving every line of the block to be read as stray entries;
+* a `<<` inside the name splits there instead and yields a delimiter the
+* terminating line can never match. Either way the entries after the
+* malformed block are corrupted, so both separators are refused. A name
+* ending in a single `<` corrupts the block the same way: the composed
+* header `name<<<DELIMITER` matches the runner's first `<<` one character
+* early, so the delimiter it waits for is `<DELIMITER` and the terminating
+* line never matches — the whole file is lost. An interior `<` is safe
+* (`a<b` still composes a header that splits exactly at the marker), so
+* only the trailing position is refused.
 *
 * @internal
 */
-const isUsableName = (name) => name !== "" && !/[\r\n]/.test(name);
+const isUsableName = (name) => name !== "" && !/[\r\n]/.test(name) && !name.includes("=") && !name.includes("<<") && !name.endsWith("<");
 /**
 * One heredoc block, ready to append. The caller has checked the name with
 * {@link isUsableName}.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@effected/github-actions",
-	"version": "0.13.1",
+	"version": "0.13.3",
 	"private": false,
 	"description": "The GitHub Actions runtime: env, inputs, outputs, state, logging, cache, artifacts, blob storage, OIDC and the token bridge.",
 	"keywords": [
@@ -39,13 +39,14 @@
 	},
 	"dependencies": {
 		"@azure/storage-blob": "^12.33.0",
-		"@effected/github": "^0.10.1",
-		"@effected/glob": "^0.6.0",
-		"@effected/markdown": "^0.10.0",
-		"@effected/npm": "^0.14.0",
-		"@effected/sbom": "^0.6.1",
-		"@effected/templates": "^0.6.0",
-		"@effected/walker": "^0.9.0"
+		"@effected/github": "^0.10.2",
+		"@effected/glob": "^0.6.1",
+		"@effected/markdown": "^0.10.1",
+		"@effected/npm": "^0.14.1",
+		"@effected/sbom": "^0.6.2",
+		"@effected/semver": "^0.7.1",
+		"@effected/templates": "^0.6.1",
+		"@effected/walker": "^0.9.1"
 	},
 	"peerDependencies": {
 		"@effect/platform-node": "4.0.0-rc.115",