@effected/github-actions 0.13.2 → 0.13.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/internal/runnerFile.js +21 -2
- package/package.json +9 -8
package/internal/runnerFile.js
CHANGED
|
@@ -25,11 +25,30 @@ const delimiterFor = (value) => {
|
|
|
25
25
|
};
|
|
26
26
|
/**
|
|
27
27
|
* Whether `name` can head a block without breaking the structure it lives
|
|
28
|
-
* in: non-empty,
|
|
28
|
+
* in: non-empty, free of the line breaks that would end it early, and free
|
|
29
|
+
* of the separators the runner's file-command parser would re-split the
|
|
30
|
+
* line on.
|
|
31
|
+
*
|
|
32
|
+
* @remarks
|
|
33
|
+
* The runner (`FileCommandManager`) locates the first `=` and the first
|
|
34
|
+
* `<<` on each line and whichever comes first decides the shape: a
|
|
35
|
+
* `key=value` property assignment, or a `name<<delimiter` heredoc block.
|
|
36
|
+
* Because a block line is always `name<<DELIMITER`, an `=` anywhere in the
|
|
37
|
+
* name precedes the marker and the line parses as a property assignment cut
|
|
38
|
+
* at that `=`, leaving every line of the block to be read as stray entries;
|
|
39
|
+
* a `<<` inside the name splits there instead and yields a delimiter the
|
|
40
|
+
* terminating line can never match. Either way the entries after the
|
|
41
|
+
* malformed block are corrupted, so both separators are refused. A name
|
|
42
|
+
* ending in a single `<` corrupts the block the same way: the composed
|
|
43
|
+
* header `name<<<DELIMITER` matches the runner's first `<<` one character
|
|
44
|
+
* early, so the delimiter it waits for is `<DELIMITER` and the terminating
|
|
45
|
+
* line never matches — the whole file is lost. An interior `<` is safe
|
|
46
|
+
* (`a<b` still composes a header that splits exactly at the marker), so
|
|
47
|
+
* only the trailing position is refused.
|
|
29
48
|
*
|
|
30
49
|
* @internal
|
|
31
50
|
*/
|
|
32
|
-
const isUsableName = (name) => name !== "" && !/[\r\n]/.test(name);
|
|
51
|
+
const isUsableName = (name) => name !== "" && !/[\r\n]/.test(name) && !name.includes("=") && !name.includes("<<") && !name.endsWith("<");
|
|
33
52
|
/**
|
|
34
53
|
* One heredoc block, ready to append. The caller has checked the name with
|
|
35
54
|
* {@link isUsableName}.
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@effected/github-actions",
|
|
3
|
-
"version": "0.13.
|
|
3
|
+
"version": "0.13.3",
|
|
4
4
|
"private": false,
|
|
5
5
|
"description": "The GitHub Actions runtime: env, inputs, outputs, state, logging, cache, artifacts, blob storage, OIDC and the token bridge.",
|
|
6
6
|
"keywords": [
|
|
@@ -39,13 +39,14 @@
|
|
|
39
39
|
},
|
|
40
40
|
"dependencies": {
|
|
41
41
|
"@azure/storage-blob": "^12.33.0",
|
|
42
|
-
"@effected/github": "^0.10.
|
|
43
|
-
"@effected/glob": "^0.6.
|
|
44
|
-
"@effected/markdown": "^0.10.
|
|
45
|
-
"@effected/npm": "^0.14.
|
|
46
|
-
"@effected/sbom": "^0.6.
|
|
47
|
-
"@effected/
|
|
48
|
-
"@effected/
|
|
42
|
+
"@effected/github": "^0.10.2",
|
|
43
|
+
"@effected/glob": "^0.6.1",
|
|
44
|
+
"@effected/markdown": "^0.10.1",
|
|
45
|
+
"@effected/npm": "^0.14.1",
|
|
46
|
+
"@effected/sbom": "^0.6.2",
|
|
47
|
+
"@effected/semver": "^0.7.1",
|
|
48
|
+
"@effected/templates": "^0.6.1",
|
|
49
|
+
"@effected/walker": "^0.9.1"
|
|
49
50
|
},
|
|
50
51
|
"peerDependencies": {
|
|
51
52
|
"@effect/platform-node": "4.0.0-rc.115",
|