@effected/github-actions 0.16.1 → 0.17.0-next-20260927071821

package/PackageManagerInstaller.js

@@ -7,7 +7,7 @@ import { PNPM_EXE_PREFIX, detectMusl, isNodeScript, pnpmExeTarget, strongestSri
 import { ToolInstaller } from "./ToolInstaller.js";
 import { Context, Effect, FileSystem, Layer, Option, Path, Schema } from "effect";
 import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process";
-import { DEFAULT_REGISTRY, PackageManagerPinName } from "@effected/npm";
+import { CorepackIntegrityHash, DEFAULT_REGISTRY, PackageManagerPin, PackageManagerPinName } from "@effected/npm";
 
 //#region src/PackageManagerInstaller.ts
 /**
@@ -21,8 +21,16 @@ var PackageManagerInstallerError = class extends Schema.TaggedError()("PackageMa
 	* {@link ToolInstallerError} that caused them, preserved on `cause`
 	* (`cacheFailed` also covers a shim that could not be written into the
 	* entry). `integrityMismatch` — the downloaded artifact does not hash to
-	* what the pin declares; nothing was cached. `integrityMissing` — the pin
-	* carries no integrity and the caller asked for `requireIntegrity`.
+	* what the pin or the `integrity` option (or, for pnpm 12's native
+	* binary, the registry or the caller's `nativeIntegrity`) declares;
+	* nothing was cached. Also raised before anything runs when the
+	* `integrity` option is malformed or disagrees with the pin (see
+	* {@link PackageManagerInstallOptions.integrity}).
+	* `integrityMissing` — neither the pin nor the `integrity` option
+	* carries integrity and the caller asked for `requireIntegrity`, or —
+	* with `subject` naming the package — the
+	* caller supplied `nativeIntegrity` without an entry for the host's
+	* `@pnpm/exe.*` package.
 	* `unsupportedPlatform` — no build exists for this runner's
 	* OS/architecture pair: bun publishes none, or pnpm 12 ships no
 	* `@pnpm/exe.*` native binary for it. `layoutUnexpected` — the artifact
@@ -57,7 +65,7 @@ var PackageManagerInstallerError = class extends Schema.TaggedError()("PackageMa
 			case "downloadFailed": return `Could not download ${pin}${this.subject === void 0 ? "" : ` from ${this.subject}`}`;
 			case "extractFailed": return `Could not extract ${pin}${this.subject === void 0 ? "" : ` (${this.subject})`}`;
 			case "integrityMismatch": return this.expected === void 0 || this.actual === void 0 ? `Could not verify the integrity of ${pin}${this.subject === void 0 ? "" : ` (${this.subject})`}` : `Integrity mismatch for ${pin}: expected ${this.expected}, got ${this.actual}`;
-			case "integrityMissing": return `The pin for ${pin} carries no integrity hash and requireIntegrity is set`;
+			case "integrityMissing": return this.subject === void 0 ? `Neither the pin for ${pin} nor the integrity option carries an integrity hash, and requireIntegrity is set` : `No integrity was supplied for ${this.subject}, which ${pin} needs on this runner`;
 			case "unsupportedPlatform": return `No ${pin} build is published for ${this.subject}`;
 			case "layoutUnexpected": return `The ${pin} artifact does not have the expected layout${this.subject === void 0 ? "" : `: ${this.subject}`}`;
 			default: return `Could not cache ${pin} into the tool cache${this.subject === void 0 ? "" : `: ${this.subject}`}`;
@@ -241,25 +249,27 @@ const make = Effect.gen(function* () {
 		cause
 	})));
 	/**
-	* Verify a downloaded artifact against the pin's integrity, fail-closed.
+	* Verify a downloaded artifact against the settled pin's integrity,
+	* fail-closed.
 	*
-	* A pin with no integrity proceeds with a logged warning — in-the-wild
+	* An integrity-less pin proceeds with a logged warning — in-the-wild
 	* `devEngines` pins routinely carry none, and the opt-in strictness lives in
 	* `requireIntegrity`, checked before anything is downloaded.
 	*/
 	const verifyIntegrity = (pin, file) => Effect.gen(function* () {
-		if (pin.integrity === void 0) {
-			yield* Effect.logWarning(`The pin ${pin.toString()} carries no integrity hash; the downloaded artifact was not verified.`);
+		const integrity = pin.integrity;
+		if (integrity === void 0) {
+			yield* Effect.logWarning(`The pin ${pin.toString()} carries no integrity hash and none was supplied; the downloaded artifact was not verified.`);
 			return;
 		}
-		const dot = pin.integrity.indexOf(".");
-		const algorithm = pin.integrity.slice(0, dot);
-		const expectedHex = pin.integrity.slice(dot + 1);
+		const dot = integrity.indexOf(".");
+		const algorithm = integrity.slice(0, dot);
+		const expectedHex = integrity.slice(dot + 1);
 		const actualHex = yield* hashFile(pin, file, algorithm);
 		if (actualHex !== expectedHex) return yield* Effect.fail(errorFor(pin)({
 			reason: "integrityMismatch",
 			subject: file,
-			expected: pin.integrity,
+			expected: integrity,
 			actual: `${algorithm}.${actualHex}`
 		}));
 	});
@@ -422,17 +432,64 @@ const make = Effect.gen(function* () {
 		}));
 	});
 	/**
+	* The strongest digest an SRI value lists — or, when it is not a string or
+	* lists no usable algorithm, the could-not-verify arm of
+	* `integrityMismatch` naming `subject`.
+	*/
+	const expectedFromSri = (pin, sri, subject) => Option.match(typeof sri === "string" ? strongestSri(sri) : Option.none(), {
+		onNone: () => Effect.fail(errorFor(pin)({
+			reason: "integrityMismatch",
+			subject
+		})),
+		onSome: Effect.succeed
+	});
+	/**
+	* The expected integrity of a native package as its registry packument
+	* declares it for the exact version — fail-closed: a packument that cannot
+	* be read, parsed, or that lists no usable SRI is the could-not-verify arm
+	* of `integrityMismatch`, naming the packument url.
+	*/
+	const registryIntegrity = (pin, packageName, version, registry) => Effect.gen(function* () {
+		const packumentUrl = `${registry}/${packageName}/${version}`;
+		const packumentFile = yield* installer.download(packumentUrl).pipe(Effect.mapError(fromInstaller(pin)));
+		const unverifiable = (cause) => errorFor(pin)({
+			reason: "integrityMismatch",
+			subject: packumentUrl,
+			cause
+		});
+		const packument = yield* fs.readFileString(packumentFile).pipe(Effect.mapError(unverifiable), Effect.flatMap((raw) => Effect.try({
+			try: () => JSON.parse(raw),
+			catch: unverifiable
+		})));
+		return yield* expectedFromSri(pin, packument.dist?.integrity, packumentUrl);
+	});
+	/**
+	* The expected integrity of a native package as the caller's
+	* `nativeIntegrity` map records it — fail-closed: no entry for the host's
+	* package is `integrityMissing` (a lockfile records every platform, so a
+	* gap means the map is inconsistent), and an entry with no usable SRI is
+	* the could-not-verify arm of `integrityMismatch`, both naming the package.
+	*/
+	const suppliedIntegrity = (pin, packageName, nativeIntegrity) => {
+		const supplied = Object.hasOwn(nativeIntegrity, packageName) ? nativeIntegrity[packageName] : void 0;
+		return typeof supplied === "string" ? expectedFromSri(pin, supplied, packageName) : Effect.fail(errorFor(pin)({
+			reason: "integrityMissing",
+			subject: packageName
+		}));
+	};
+	/**
 	* pnpm 12's native overlay, done here because the installer never runs the
 	* lifecycle script that does it upstream: pick the host's `@pnpm/exe.*`
 	* package from the wrapper's optional dependencies, fetch its tarball from
-	* the SAME registry the wrapper came from, verify it against the registry's
-	* own `dist.integrity` (fail-closed — this is a second artifact the pin
-	* never named, so there is no integrity-less posture to honor), and copy
+	* the SAME registry the wrapper came from, verify it against the caller's
+	* `nativeIntegrity` entry when one was supplied or else the registry's own
+	* `dist.integrity` (fail-closed either way — this is a second artifact the
+	* pin never named, so there is no integrity-less posture to honor), and copy
 	* the executable over the placeholder in the STAGED wrapper, where `dist/`
 	* sits beside it as the binary expects. Answers the bins as they should be
 	* shimmed and recorded — retargeted to `.exe` on Windows, as upstream does.
 	*/
-	const overlayNativeBinary = (pin, packageDir, bins, nativePackages, registry) => Effect.gen(function* () {
+	const overlayNativeBinary = (pin, packageDir, { bins, nativePackages }, { registry, nativeIntegrity }) => Effect.gen(function* () {
 		const target = Option.getOrUndefined(pnpmExeTarget(runnerOs, arch, musl));
 		const packageName = target === void 0 ? void 0 : `${PNPM_EXE_PREFIX}${target}`;
 		const nativeVersion = packageName === void 0 ? void 0 : nativePackages[packageName];
@@ -449,19 +506,7 @@ const make = Effect.gen(function* () {
 			reason: "layoutUnexpected",
 			subject: `package.json names no ${pin.name} bin to overlay`
 		}));
-		const packumentUrl = `${registry}/${packageName}/${nativeVersion}`;
-		const packumentFile = yield* installer.download(packumentUrl).pipe(Effect.mapError(fromInstaller(pin)));
-		const unverifiable = (cause) => errorFor(pin)({
-			reason: "integrityMismatch",
-			subject: packumentUrl,
-			...cause === void 0 ? {} : { cause }
-		});
-		const declared = (yield* fs.readFileString(packumentFile).pipe(Effect.mapError((cause) => unverifiable(cause)), Effect.flatMap((raw) => Effect.try({
-			try: () => JSON.parse(raw),
-			catch: (cause) => unverifiable(cause)
-		})))).dist?.integrity;
-		const expected = typeof declared === "string" ? Option.getOrUndefined(strongestSri(declared)) : void 0;
-		if (expected === void 0) return yield* Effect.fail(unverifiable());
+		const expected = nativeIntegrity === void 0 ? yield* registryIntegrity(pin, packageName, nativeVersion, registry) : yield* suppliedIntegrity(pin, packageName, nativeIntegrity);
 		const tarballUrl = `${registry}/${packageName}/-/exe.${target}-${nativeVersion}.tgz`;
 		const archive = yield* installer.download(tarballUrl).pipe(Effect.mapError(fromInstaller(pin)));
 		const actualHex = yield* hashFile(pin, archive, expected.algorithm);
@@ -525,9 +570,10 @@ const make = Effect.gen(function* () {
 		});
 	});
 	/** Download a registry tarball, verify, extract, shim, and cache the package dir. */
-	const installFromRegistry = (pin, name, registry) => Effect.gen(function* () {
+	const installFromRegistry = (pin, source) => Effect.gen(function* () {
+		const { name } = pin;
 		const version = pin.version.toString();
-		const url = registryTarballUrl(name, version, pin.version.major, registry);
+		const url = registryTarballUrl(name, version, pin.version.major, source.registry);
 		const archive = yield* installer.download(url).pipe(Effect.mapError(fromInstaller(pin)));
 		const berry = name === "yarn" && pin.version.major >= 2;
 		if (!berry) yield* verifyIntegrity(pin, archive);
@@ -538,7 +584,7 @@ const make = Effect.gen(function* () {
 			subject: "tarball has no package/ root"
 		}));
 		const manifest = yield* readPackageManifest(pin, packageDir);
-		const bins = Object.keys(manifest.nativePackages).length > 0 ? yield* overlayNativeBinary(pin, packageDir, manifest.bins, manifest.nativePackages, registry) : manifest.bins;
+		const bins = Object.keys(manifest.nativePackages).length > 0 ? yield* overlayNativeBinary(pin, packageDir, manifest, source) : manifest.bins;
 		if (berry) {
 			const cli = path.join(packageDir, "bin/yarn.js");
 			yield* assertFile(pin, cli, "bin/yarn.js is missing from the cli-dist tarball");
@@ -555,22 +601,54 @@ const make = Effect.gen(function* () {
 			bins: rootBins(bins, directory)
 		});
 	});
+	/**
+	* Fold the `integrity` option into the pin, answering the one pin every
+	* later step reads. The option's FORM is checked here, once — the type
+	* admits every `IntegrityHash` form, but only a corepack `<algo>.<hex>` can
+	* be compared with a pin's tail or split into an algorithm and a digest —
+	* and a pin integrity that disagrees with the option is refused rather than
+	* resolved by preferring either.
+	*
+	* A malformed option is `integrityMismatch` on its could-not-verify arm (no
+	* `expected`, no `actual`): the caller DID supply an integrity, so
+	* `integrityMissing` would misreport it, and a value that cannot be
+	* compared is exactly what that arm means.
+	*/
+	const settlePin = (pin, integrity) => Effect.gen(function* () {
+		if (integrity === void 0) return pin;
+		const option = yield* Schema.decodeUnknownEffect(CorepackIntegrityHash)(integrity).pipe(Effect.mapError((cause) => errorFor(pin)({
+			reason: "integrityMismatch",
+			subject: `the integrity option ${integrity} is not a corepack <algo>.<hex> hash`,
+			cause
+		})));
+		if (pin.integrity !== void 0 && pin.integrity !== option) return yield* Effect.fail(errorFor(pin)({
+			reason: "integrityMismatch",
+			subject: `the pin declares ${pin.integrity}, which disagrees with the integrity option`,
+			expected: option
+		}));
+		return PackageManagerPin.make({
+			name: pin.name,
+			version: pin.version,
+			integrity: option
+		});
+	});
 	return { install: Effect.fn("PackageManagerInstaller.install")(function* (pin, options) {
 		const version = pin.version.toString();
 		yield* Effect.annotateCurrentSpan({
 			name: pin.name,
 			version
 		});
-		if (options?.requireIntegrity === true && pin.integrity === void 0) return yield* Effect.fail(errorFor(pin)({ reason: "integrityMissing" }));
-		const cached = yield* installer.find(pin.name, version);
+		const effective = yield* settlePin(pin, options?.integrity);
+		if (options?.requireIntegrity === true && effective.integrity === void 0) return yield* Effect.fail(errorFor(pin)({ reason: "integrityMissing" }));
+		const cached = yield* installer.find(effective.name, version);
 		if (Option.isSome(cached)) {
-			const record = yield* cachedRecord(pin, cached.value);
+			const record = yield* cachedRecord(effective, cached.value);
 			if (Option.isSome(record)) return record.value;
 		}
-		if (pin.name === "npm" && options?.allowAmbient !== false) {
+		if (effective.name === "npm" && options?.allowAmbient !== false) {
 			const probed = yield* ambientNpmVersion;
 			if (Option.isSome(probed) && probed.value === version) return AmbientPackageManager.make({
-				name: pin.name,
+				name: effective.name,
 				version,
 				bins: {
 					npm: "npm",
@@ -578,9 +656,11 @@ const make = Effect.gen(function* () {
 				}
 			});
 		}
-		if (pin.name === "bun") return yield* installBun(pin);
-		const registry = (options?.registry ?? DEFAULT_REGISTRY).replace(/\/+$/, "");
-		return yield* installFromRegistry(pin, pin.name, registry);
+		if (effective.name === "bun") return yield* installBun(effective);
+		return yield* installFromRegistry(effective, {
+			registry: (options?.registry ?? DEFAULT_REGISTRY).replace(/\/+$/, ""),
+			nativeIntegrity: options?.nativeIntegrity
+		});
 	}) };
 });
 const dies = unstubbed("PackageManagerInstaller.makeTest");
@@ -593,9 +673,10 @@ const dies = unstubbed("PackageManagerInstaller.makeTest");
 * ambient `npm --version` probe (every Node toolchain ships npm), and only
 * then the manager's own dist: npm, pnpm and yarn 1.x from their registry
 * tarballs, yarn 2+ (Berry) from `@yarnpkg/cli-dist`, bun from its
-* per-platform GitHub-release zip. A pin that carries integrity is verified
-* fail-closed against what corepack itself hashes; one that does not proceeds
-* with a logged warning unless `requireIntegrity` says otherwise.
+* per-platform GitHub-release zip. An install with an expected integrity —
+* the pin's `+<integrity>` tail or the `integrity` option — is verified
+* fail-closed against what corepack itself hashes; one without proceeds with
+* a logged warning unless `requireIntegrity` says otherwise.
 *
 * Every tool-cache answer carries a `binDir` a consumer can hand straight to
 * `ActionOutputs.addPath`: the npm-registry managers get a `.bin` directory

package/index.d.ts

@@ -4,7 +4,7 @@ import { HttpClient } from "effect/unstable/http";
 import { ChildProcessSpawner } from "effect/unstable/process";
 import { IdentityToken, SlsaProvenance } from "@effected/sbom";
 import { BotIdentity, GitHubApp, GitHubClient, InstallationToken, PermissionLevel, RetryPolicy } from "@effected/github";
-import { PackageManagerPin } from "@effected/npm";
+import { IntegrityHashBrand, PackageManagerPin } from "@effected/npm";
 //#region src/ActionEnvironment.d.ts
 declare const ActionEnvironmentError_base: Schema.Class<ActionEnvironmentError, Schema.TaggedStruct<"ActionEnvironmentError", {
   readonly reason: Schema.Literals<readonly ["missing", "malformed"]>;
@@ -4597,8 +4597,16 @@ declare const PackageManagerInstallerError_base: Schema.Class<PackageManagerInst
    * {@link ToolInstallerError} that caused them, preserved on `cause`
    * (`cacheFailed` also covers a shim that could not be written into the
    * entry). `integrityMismatch` — the downloaded artifact does not hash to
-   * what the pin declares; nothing was cached. `integrityMissing` — the pin
-   * carries no integrity and the caller asked for `requireIntegrity`.
+   * what the pin or the `integrity` option (or, for pnpm 12's native
+   * binary, the registry or the caller's `nativeIntegrity`) declares;
+   * nothing was cached. Also raised before anything runs when the
+   * `integrity` option is malformed or disagrees with the pin (see
+   * {@link PackageManagerInstallOptions.integrity}).
+   * `integrityMissing` — neither the pin nor the `integrity` option
+   * carries integrity and the caller asked for `requireIntegrity`, or —
+   * with `subject` naming the package — the
+   * caller supplied `nativeIntegrity` without an entry for the host's
+   * `@pnpm/exe.*` package.
    * `unsupportedPlatform` — no build exists for this runner's
    * OS/architecture pair: bun publishes none, or pnpm 12 ships no
    * `@pnpm/exe.*` native binary for it. `layoutUnexpected` — the artifact
@@ -4634,11 +4642,40 @@ export declare class PackageManagerInstallerError extends PackageManagerInstalle
  */
 interface PackageManagerInstallOptions {
   /**
-   * Fail with `integrityMissing` when the pin carries no integrity hash,
-   * instead of proceeding with a logged warning. Off by default, because
-   * in-the-wild `devEngines` pins routinely carry no integrity.
+   * Fail with `integrityMissing` when neither the pin nor the `integrity`
+   * option carries an integrity hash, instead of proceeding with a logged
+   * warning. Off by default, because in-the-wild `devEngines` pins routinely
+   * carry no integrity.
    */
   readonly requireIntegrity?: boolean | undefined;
+  /**
+   * The expected integrity of the manager's own artifact, supplied beside
+   * the pin rather than through its `+<integrity>` tail — for a caller whose
+   * digest comes from somewhere other than the pin (a lockfile, or the
+   * registry's `dist.integrity`) and that should not have to rewrite the pin
+   * to carry it.
+   *
+   * @remarks
+   * Corepack form only (`<algo>.<hex>`), the same brand the pin's own
+   * `integrity` carries; convert a registry or lockfile SRI string with
+   * `CorepackIntegrityHash.fromSri` from `@effected/npm`. It verifies
+   * exactly what a pin integrity verifies — the registry tarball for npm,
+   * pnpm and yarn 1.x, the standalone `yarn.js` for yarn 2+, the platform zip
+   * for bun — and stands in for the pin's in every rule: it silences the
+   * "carries no integrity hash" warning, satisfies `requireIntegrity`, and a
+   * tool-cache hit is answered without re-verifying, exactly as it is for an
+   * integrity-carrying pin.
+   *
+   * Fail-closed, before any cache lookup or download: a value not in corepack
+   * form (an SRI or yarn hash) fails with `integrityMismatch` on its
+   * could-not-verify arm (no `expected`, no `actual`, `subject` naming the
+   * option); and when the pin also carries an integrity and the two differ,
+   * the install fails with `integrityMismatch` (`expected` is this option,
+   * `subject` names the pin's value) — neither is chosen silently. Equal
+   * values verify once. It governs the wrapper only; pnpm 12's native
+   * binary is `nativeIntegrity`'s business.
+   */
+  readonly integrity?: IntegrityHashBrand | undefined;
   /**
    * The npm registry host the npm, pnpm and yarn tarballs download from.
    * Defaults to `https://registry.npmjs.org`. A corporate mirror qualifies
@@ -4647,10 +4684,32 @@ interface PackageManagerInstallOptions {
    * artifact verified against the registry's own integrity — the
    * `/<name>/<version>` packument route as JSON carrying `dist.integrity`.
    * A tarball-only proxy fails a pnpm 12 pin with `downloadFailed` naming
-   * that packument url. bun does not ship through a registry — its
-   * per-platform zip always comes from GitHub releases.
+   * that packument url — unless `nativeIntegrity` vouches for the host's
+   * native package, which skips the packument. bun does not ship through a
+   * registry — its per-platform zip always comes from GitHub releases.
    */
   readonly registry?: string | undefined;
+  /**
+   * The expected Subresource Integrity of each pnpm native-binary package,
+   * keyed by bare package name with no version (`"@pnpm/exe.linux-x64"`) —
+   * usually read straight from the lockfile, which records every platform's
+   * entry.
+   *
+   * @remarks
+   * Consulted only for a pin whose wrapper overlays a native binary (pnpm 12
+   * and later); every other pin ignores it. When supplied, the installer
+   * verifies the host's `@pnpm/exe.<target>` tarball against this map's entry
+   * (its strongest listed algorithm) INSTEAD of the registry's packument, so
+   * the packument route is never requested and a tarball-only mirror
+   * suffices. Fail-closed throughout: a map with no entry for the host's
+   * package fails with `integrityMissing` naming that package, an entry
+   * carrying no parseable SRI fails with `integrityMismatch` (the
+   * could-not-verify arm), and a tarball that hashes to anything else fails
+   * with `integrityMismatch` naming the tarball url. Absent, the registry's
+   * own `dist.integrity` is the authority, as before. A tool-cache hit is
+   * answered without re-verifying, exactly as the pin's own integrity is.
+   */
+  readonly nativeIntegrity?: Readonly<Record<string, string>> | undefined;
   /**
    * Whether an npm pin may be answered by the runner's own ambient npm.
    * Defaults to `true`.
@@ -4775,9 +4834,10 @@ declare const PackageManagerInstaller_base: Context.ServiceClass<PackageManagerI
  * ambient `npm --version` probe (every Node toolchain ships npm), and only
  * then the manager's own dist: npm, pnpm and yarn 1.x from their registry
  * tarballs, yarn 2+ (Berry) from `@yarnpkg/cli-dist`, bun from its
- * per-platform GitHub-release zip. A pin that carries integrity is verified
- * fail-closed against what corepack itself hashes; one that does not proceeds
- * with a logged warning unless `requireIntegrity` says otherwise.
+ * per-platform GitHub-release zip. An install with an expected integrity —
+ * the pin's `+<integrity>` tail or the `integrity` option — is verified
+ * fail-closed against what corepack itself hashes; one without proceeds with
+ * a logged warning unless `requireIntegrity` says otherwise.
  *
  * Every tool-cache answer carries a `binDir` a consumer can hand straight to
  * `ActionOutputs.addPath`: the npm-registry managers get a `.bin` directory

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@effected/github-actions",
-	"version": "0.16.1",
+	"version": "0.17.0-next-20260927071821",
 	"private": false,
 	"description": "The GitHub Actions runtime: env, inputs, outputs, state, logging, cache, artifacts, blob storage, OIDC and the token bridge.",
 	"keywords": [
@@ -42,8 +42,8 @@
 		"@effected/github": "^0.13.0",
 		"@effected/glob": "^0.8.0",
 		"@effected/markdown": "^0.12.1",
-		"@effected/npm": "^0.16.0",
-		"@effected/sbom": "^0.8.0",
+		"@effected/npm": "^0.17.0-next-20260927071821",
+		"@effected/sbom": "^0.8.1-next-20260927071821",
 		"@effected/semver": "^0.9.0",
 		"@effected/templates": "^0.8.0",
 		"@effected/walker": "^0.12.0"