@effected/github-actions 0.13.2 → 0.13.4

package/PackageManagerInstaller.js

@@ -615,6 +615,16 @@ const dies = unstubbed("PackageManagerInstaller.makeTest");
 * stage-then-swap invariant holds here for free — shims included, the tool
 * cache only ever contains complete package managers.
 *
+* The pin is the whole contract: the installer provisions exactly the named
+* version and does not read the artifact's `engines.node` against the
+* runner's node. A pin whose engines the runner does not satisfy (npm 12 on
+* a node below `^22.22.2 || ^24.15.0 || >=26.0.0`) still installs and still
+* runs — npm itself warns (`npm warn cli npm v12.0.2 does not support ...`)
+* on every invocation and carries on (`lib/cli/entry.js`), so the
+* mismatch is visible in the job log but is not a typed failure here.
+* Keeping node and the manager pins coherent is the consumer's call, made
+* where it pins node.
+*
 * @example
 * ```ts
 * import { ActionOutputs, PackageManagerInstaller } from "@effected/github-actions";

package/index.d.ts

@@ -4677,6 +4677,16 @@ declare const PackageManagerInstaller_base: Context.ServiceClass<PackageManagerI
  * stage-then-swap invariant holds here for free — shims included, the tool
  * cache only ever contains complete package managers.
  *
+ * The pin is the whole contract: the installer provisions exactly the named
+ * version and does not read the artifact's `engines.node` against the
+ * runner's node. A pin whose engines the runner does not satisfy (npm 12 on
+ * a node below `^22.22.2 || ^24.15.0 || >=26.0.0`) still installs and still
+ * runs — npm itself warns (`npm warn cli npm v12.0.2 does not support ...`)
+ * on every invocation and carries on (`lib/cli/entry.js`), so the
+ * mismatch is visible in the job log but is not a typed failure here.
+ * Keeping node and the manager pins coherent is the consumer's call, made
+ * where it pins node.
+ *
  * @example
  * ```ts
  * import { ActionOutputs, PackageManagerInstaller } from "@effected/github-actions";

package/internal/runnerFile.js

@@ -25,11 +25,30 @@ const delimiterFor = (value) => {
 };
 /**
 * Whether `name` can head a block without breaking the structure it lives
-* in: non-empty, and free of the line breaks that would end it early.
+* in: non-empty, free of the line breaks that would end it early, and free
+* of the separators the runner's file-command parser would re-split the
+* line on.
+*
+* @remarks
+* The runner (`FileCommandManager`) locates the first `=` and the first
+* `<<` on each line and whichever comes first decides the shape: a
+* `key=value` property assignment, or a `name<<delimiter` heredoc block.
+* Because a block line is always `name<<DELIMITER`, an `=` anywhere in the
+* name precedes the marker and the line parses as a property assignment cut
+* at that `=`, leaving every line of the block to be read as stray entries;
+* a `<<` inside the name splits there instead and yields a delimiter the
+* terminating line can never match. Either way the entries after the
+* malformed block are corrupted, so both separators are refused. A name
+* ending in a single `<` corrupts the block the same way: the composed
+* header `name<<<DELIMITER` matches the runner's first `<<` one character
+* early, so the delimiter it waits for is `<DELIMITER` and the terminating
+* line never matches — the whole file is lost. An interior `<` is safe
+* (`a<b` still composes a header that splits exactly at the marker), so
+* only the trailing position is refused.
 *
 * @internal
 */
-const isUsableName = (name) => name !== "" && !/[\r\n]/.test(name);
+const isUsableName = (name) => name !== "" && !/[\r\n]/.test(name) && !name.includes("=") && !name.includes("<<") && !name.endsWith("<");
 /**
 * One heredoc block, ready to append. The caller has checked the name with
 * {@link isUsableName}.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@effected/github-actions",
-	"version": "0.13.2",
+	"version": "0.13.4",
 	"private": false,
 	"description": "The GitHub Actions runtime: env, inputs, outputs, state, logging, cache, artifacts, blob storage, OIDC and the token bridge.",
 	"keywords": [
@@ -39,13 +39,14 @@
 	},
 	"dependencies": {
 		"@azure/storage-blob": "^12.33.0",
-		"@effected/github": "^0.10.1",
-		"@effected/glob": "^0.6.0",
-		"@effected/markdown": "^0.10.0",
-		"@effected/npm": "^0.14.0",
-		"@effected/sbom": "^0.6.1",
-		"@effected/templates": "^0.6.0",
-		"@effected/walker": "^0.9.0"
+		"@effected/github": "^0.10.2",
+		"@effected/glob": "^0.6.1",
+		"@effected/markdown": "^0.10.1",
+		"@effected/npm": "^0.14.2",
+		"@effected/sbom": "^0.6.2",
+		"@effected/semver": "^0.7.1",
+		"@effected/templates": "^0.6.1",
+		"@effected/walker": "^0.9.1"
 	},
 	"peerDependencies": {
 		"@effect/platform-node": "4.0.0-rc.115",