@effected/github-actions 0.23.1 → 0.25.0

package/OidcTokenIssuer.js

@@ -1,11 +1,13 @@
 import { ActionEnvironment } from "./ActionEnvironment.js";
 import { unstubbed } from "./internal/unstubbed.js";
-import { payloadOf, unsignedJwt } from "./internal/jwt.js";
 import { Context, Effect, Layer, Redacted, Schema } from "effect";
 import { HttpClient, HttpClientRequest } from "effect/http";
+import { Oidc } from "@effected/oidc";
+import { ActionsOidcClaimsFromWire } from "@effected/github";
+import * as Base64Url from "effect/encoding/Base64Url";
 import * as HttpClientResponse from "effect/http/HttpClientResponse";
 
-//#region src/OidcTokenIssuer.ts
+// src/OidcTokenIssuer.ts
 /**
 * Raised when an OIDC token cannot be issued or read.
 *
@@ -45,44 +47,6 @@ var OidcTokenError = class extends Schema.TaggedError()("OidcTokenError", {
 		}
 	}
 };
-/**
-* The claims a GitHub Actions OIDC token carries about the workflow that ran.
-*
-* @remarks
-* The field names are GitHub's own JWT claim names, kept verbatim rather than
-* translated to the kit's casing. They are an **external vocabulary** — the
-* same strings that appear in a SLSA provenance predicate and in every
-* published example of an Actions OIDC policy — and renaming them would put a
-* translation layer between a consumer and the specification they are reading.
-*
-* @public
-*/
-var OidcClaims = class extends Schema.Class("OidcClaims")({
-	/** The issuer, e.g. `https://token.actions.githubusercontent.com`. */
-	iss: Schema.String,
-	/** The full ref the workflow ran on. */
-	ref: Schema.String,
-	/** The commit. */
-	sha: Schema.String,
-	/** `owner/repo`. */
-	repository: Schema.String,
-	/** The event that triggered the run. */
-	event_name: Schema.String,
-	/** The reusable-workflow ref, which is what a verifier pins against. */
-	job_workflow_ref: Schema.String,
-	/** The calling workflow's ref. */
-	workflow_ref: Schema.String,
-	/** The numeric repository id, as a string. */
-	repository_id: Schema.String,
-	/** The numeric owner id, as a string. */
-	repository_owner_id: Schema.String,
-	/** `github-hosted` or `self-hosted`. */
-	runner_environment: Schema.String,
-	/** The run id, as a string. */
-	run_id: Schema.String,
-	/** The run attempt, as a string. */
-	run_attempt: Schema.String
-}) {};
 /** The token envelope the runner's token service answers with. */
 const TokenEnvelope = Schema.Struct({
 	value: Schema.String,
@@ -97,16 +61,23 @@ const REQUEST_URL = "ACTIONS_ID_TOKEN_REQUEST_URL";
 * The absence of verification is deliberate and is documented on
 * {@link OidcTokenIssuerShape.claims}; do not "fix" it here.
 */
-const readClaims = (token) => Effect.gen(function* () {
-	const decoded = yield* Effect.fromResult(payloadOf(token)).pipe(Effect.mapError((failure) => new OidcTokenError({
-		reason: "malformedToken",
-		...failure
-	})));
-	return yield* Schema.decodeUnknownEffect(OidcClaims)(decoded).pipe(Effect.mapError((cause) => new OidcTokenError({
-		reason: "missingClaims",
-		cause
-	})));
-});
+const readClaims = (token) => Oidc.decodeUnverified(token, ActionsOidcClaimsFromWire).pipe(Effect.mapError((error) => error.reason === "claims" ? new OidcTokenError({
+	reason: "missingClaims",
+	cause: error.cause ?? error
+}) : new OidcTokenError({
+	reason: "malformedToken",
+	detail: error.detail,
+	cause: error
+})));
+/**
+* An **unsigned** JWT: `header.payload.unsigned`, each JSON segment
+* base64url-encoded. For test doubles only; the signature segment is a
+* placeholder, so the token fails any verifier.
+*/
+const unsignedJwt = (header, payload) => {
+	const segment = (value) => Base64Url.encode(JSON.stringify(value));
+	return `${segment(header)}.${segment(payload)}.unsigned`;
+};
 const make = Effect.gen(function* () {
 	const env = yield* ActionEnvironment;
 	const http = yield* HttpClient.HttpClient;
@@ -166,7 +137,7 @@ const dies = unstubbed("OidcTokenIssuer.makeTest");
 * const program = Effect.gen(function* () {
 *   const issuer = yield* OidcTokenIssuer;
 *   const claims = yield* issuer.claims("sigstore");
-*   return claims.job_workflow_ref;
+*   return claims.jobWorkflowRef;
 * });
 * ```
 *
@@ -193,7 +164,7 @@ var OidcTokenIssuer = class OidcTokenIssuer extends Context.Service()("@effected
 	static unsignedTokenFor = (claims) => Redacted.make(unsignedJwt({
 		alg: "RS256",
 		typ: "JWT"
-	}, Schema.encodeUnknownSync(OidcClaims)(claims)));
+	}, Schema.encodeSync(ActionsOidcClaimsFromWire)(claims)));
 	/** A test double. Unstubbed members die rather than answering with a non-token. */
 	static makeTest = (overrides = {}) => ({
 		token: () => dies("token"),
@@ -218,5 +189,4 @@ var OidcTokenIssuer = class OidcTokenIssuer extends Context.Service()("@effected
 	});
 };
 
-//#endregion
-export { OidcClaims, OidcTokenError, OidcTokenIssuer };
+export { OidcTokenError, OidcTokenIssuer };

package/PackageManagerInstaller.js

@@ -1,7 +1,7 @@
 import { ActionEnvironment } from "./ActionEnvironment.js";
 import { unstubbed } from "./internal/unstubbed.js";
 import { digestFileHex } from "./internal/digest.js";
-import { isWindowsRunner } from "./internal/runner.js";
+import { isWindowsRunner, runnerArch } from "./internal/runner.js";
 import { typeAt } from "./internal/fsProbe.js";
 import { PNPM_EXE_PREFIX, detectMusl, isNodeScript, pnpmExeTarget, strongestSri } from "./internal/pnpmExe.js";
 import { cmdShim, gitBashShim, posixShim } from "./internal/shim.js";
@@ -10,7 +10,18 @@ import { Context, Effect, FileSystem, Layer, Option, Path, Schema } from "effect
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
 import { CorepackIntegrityHash, DEFAULT_REGISTRY, PackageManagerPin, PackageManagerPinName } from "@effected/npm";
 
-//#region src/PackageManagerInstaller.ts
+// src/PackageManagerInstaller.ts
+/**
+* The two `package.json` members the installer reads, as JSON text decoded to
+* an object. Both stay `unknown`: they are attacker-supplied, and their own
+* normalizers decide what survives.
+*/
+const decodeManifest = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Struct({
+	bin: Schema.optionalKey(Schema.Unknown),
+	optionalDependencies: Schema.optionalKey(Schema.Unknown)
+})));
+/** A packument's `dist.integrity`, left `unknown` for `expectedFromSri` to judge. */
+const decodePackument = Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Struct({ dist: Schema.optionalKey(Schema.Struct({ integrity: Schema.optionalKey(Schema.Unknown) })) })));
 /**
 * Raised when a package manager cannot be provisioned on the runner.
 *
@@ -202,11 +213,6 @@ const normalizeBins = (bin, fallbackName) => {
 	}
 	return Object.keys(entries).length === 0 ? Option.none() : Option.some(entries);
 };
-/** Map a `RUNNER_ARCH` value (`X64`, `ARM64`) onto the Node arch spelling. */
-const archFromRunner = (runnerArch) => {
-	const lowered = runnerArch.toLowerCase();
-	return lowered === "x64" || lowered === "arm64" ? lowered : runnerArch;
-};
 const make = Effect.gen(function* () {
 	const env = yield* ActionEnvironment;
 	const fs = yield* FileSystem.FileSystem;
@@ -214,10 +220,7 @@ const make = Effect.gen(function* () {
 	const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
 	const installer = yield* ToolInstaller;
 	const runnerOs = yield* Effect.map(env.getOptional("RUNNER_OS"), (found) => Option.getOrElse(found, () => ""));
-	const arch = yield* Effect.map(env.getOptional("RUNNER_ARCH"), (found) => Option.match(found, {
-		onNone: () => process.arch,
-		onSome: archFromRunner
-	}));
+	const arch = yield* runnerArch(env);
 	const windows = yield* isWindowsRunner(env);
 	const musl = detectMusl();
 	const bunBinaryName = windows ? "bun.exe" : "bun";
@@ -305,14 +308,11 @@ const make = Effect.gen(function* () {
 			subject: "no package.json",
 			cause
 		})));
-		const manifest = yield* Effect.try({
-			try: () => JSON.parse(raw),
-			catch: (cause) => errorFor(pin)({
-				reason: "layoutUnexpected",
-				subject: "unparseable package.json",
-				cause
-			})
-		});
+		const manifest = yield* decodeManifest(raw).pipe(Effect.mapError((cause) => errorFor(pin)({
+			reason: "layoutUnexpected",
+			subject: "unparseable package.json",
+			cause
+		})));
 		const bins = Option.getOrUndefined(normalizeBins(manifest.bin, pin.name));
 		if (bins === void 0) return yield* Effect.fail(errorFor(pin)({
 			reason: "layoutUnexpected",
@@ -458,10 +458,7 @@ const make = Effect.gen(function* () {
 			subject: packumentUrl,
 			cause
 		});
-		const packument = yield* fs.readFileString(packumentFile).pipe(Effect.mapError(unverifiable), Effect.flatMap((raw) => Effect.try({
-			try: () => JSON.parse(raw),
-			catch: unverifiable
-		})));
+		const packument = yield* fs.readFileString(packumentFile).pipe(Effect.mapError(unverifiable), Effect.flatMap((raw) => decodePackument(raw).pipe(Effect.mapError(unverifiable))));
 		return yield* expectedFromSri(pin, packument.dist?.integrity, packumentUrl);
 	});
 	/**
@@ -734,5 +731,4 @@ var PackageManagerInstaller = class PackageManagerInstaller extends Context.Serv
 	static layerTest = (overrides = {}) => Layer.succeed(PackageManagerInstaller, PackageManagerInstaller.makeTest(overrides));
 };
 
-//#endregion
 export { AmbientPackageManager, CachedPackageManager, InstalledPackageManager, PackageManagerInstaller, PackageManagerInstallerError };

package/README.md

@@ -155,7 +155,7 @@ Two decisions make that safe for any segment value, with no prefix reasoning at
 
 `CacheKey.hashFiles` is byte-compatible with `@actions/glob`'s `hashFiles`, and `OidcTokenIssuer.claims` decodes the runner's OIDC token for a SLSA provenance predicate without verifying its signature — the token arrived over TLS from the runner's own token service, so the transport is the trust boundary and nothing here branches on the claims for authorization.
 
-`ActionsProvenance.capture` turns those claims into an `@effected/sbom` `SlsaProvenance` predicate, and `ActionsIdentityToken.layer` serves that package's narrow `IdentityToken` contract from the same issuer — the inversion that keeps the Actions runtime out of every consumer that only wants to emit an SBOM:
+`ActionsProvenance.capture` turns those claims into an `@effected/sbom` `SlsaProvenance` predicate, and `ActionsIdentityToken.layer` serves `@effected/oidc`'s narrow `IdentityToken` contract, which that package's signer consumes, from the same issuer — the inversion that keeps the Actions runtime out of every consumer that only wants to emit an SBOM:
 
 ```ts
 import { ActionsIdentityToken, ActionsProvenance, OidcTokenIssuer } from "@effected/github-actions";
@@ -303,13 +303,13 @@ const TestOutputs = ActionOutputs.layerTest({
 - `ActionCache` / `Artifact` — the runner's cache and artifact protocols over Twirp v2, excluded from the default runtime so a consumer that skips them never links Azure.
 - `CacheKey` — cache keys and their restore-key ladder, `withNamespace(segment)` for a bust token or a shared-runner prefix, plus `hashFiles`/`matchingFiles`/`hashMatching` byte-compatible with `@actions/glob`.
 - `OidcTokenIssuer` — the runner's OIDC token service, with unverified claim decoding for provenance predicates.
-- `ActionsIdentityToken` / `ActionsProvenance` — the `@effected/sbom` seam: `layer` serves that package's `IdentityToken` contract from the runner's issuer, and `capture` builds a `SlsaProvenance` predicate out of the runner's OIDC claims.
+- `ActionsIdentityToken` / `ActionsProvenance` — the `@effected/sbom` seam: `layer` serves `@effected/oidc`'s `IdentityToken` contract from the runner's issuer, and `capture` builds a `SlsaProvenance` predicate out of the runner's OIDC claims.
 - `GitHubMarkdown` — the escaping-safe writer for GitHub surfaces: `table`, `tableFor(schema)`, `heading`, `link`, `code`, `codeBlock`, `list`, `details` and `raw`, and the package's only importer of `@effected/markdown`.
 - `ManagedDocument` — marker-delimited named regions in text a human also edits, for a sticky comment or a managed pull request description; content outside the regions survives byte-for-byte, and each region can carry marker metadata that round-trips through `entry(key)` without ever addressing the region.
 - `CheckState` / `projectCheckState` — the kit's check vocabulary, wider than GitHub's conclusions, and its projection onto the check-run wire form.
 - `CheckDocument` — the debounced check-to-document reconciler: report states as they change, and one write lands carrying the final one. `stamp` plus a readable sink lets two runs share one document, dropping a strictly older run's pass instead of clobbering the newer one; `flush` reports `written`, `unchanged` or `stale`.
 - `ToolInstaller` — download, extract and cache a toolchain in the runner's tool cache, with no `@actions/tool-cache` dependency; `ToolInstallerError` always names its `subject`.
-- `BlobStore` — durable `get`/`put`/`has` over `StoredBlob<A>` values (bytes plus caller-schema metadata; the type was named `Blob<A>` before, which collided with the global), backed by `layerS3` (SigV4-signed, no `@aws-sdk/*` dependency) or `GitHubCacheBlobStore.layer` (the runner's own cache); `layerMemory` runs the real envelope framing for tests.
+- `BlobStore` — durable `get`/`put`/`has` over `StoredBlob<A>` values (bytes plus caller-schema metadata; the type was named `Blob<A>` before, which collided with the global), backed by `layerS3` (SigV4-signed through `@effected/crypto`, so it needs core `Crypto` in `R`; no `@aws-sdk/*` dependency) or `GitHubCacheBlobStore.layer` (the runner's own cache); `layerMemory` runs the real envelope framing for tests.
 
 ## License
 

package/Secret.js

@@ -1,7 +1,7 @@
 import { ActionOutputs } from "./ActionOutputs.js";
 import { Config, Effect, Redacted } from "effect";
 
-//#region src/Secret.ts
+// src/Secret.ts
 /**
 * The declassification seam: the **only** place in this package where a
 * `Redacted` value becomes a plain string.
@@ -94,9 +94,13 @@ var Secret = class Secret {
 	* Declassify one secret for an in-process use that needs the raw bytes.
 	*
 	* @remarks
-	* Request signing is the case this exists for: an HMAC cannot be computed
-	* over a `Redacted`, so a signing key has to become a string somewhere, and
-	* the point of this module is that "somewhere" is here and nowhere else.
+	* For a consumer that must hand the raw key to code taking a plain string,
+	* such as a third-party signing library. A signer that takes a `Redacted`
+	* needs no declassification at all: `@effected/crypto`'s `SigV4` and `Hmac`
+	* unwrap the key only where they compute, so a caller of those (this
+	* package's own S3 `BlobStore` is one) registers the value with
+	* {@link Secret.mask} and passes the `Redacted` on. No module in this
+	* package calls this member any more.
 	*
 	* Signing named the member; it does not gate it. **Any in-process use that
 	* needs the raw value without writing it to a runner file is this
@@ -121,9 +125,9 @@ var Secret = class Secret {
 	* `::add-mask::` command only masks when the runner parses this process's
 	* stdout; a detached worker's stdout is a log file no runner parses, so
 	* there the command masks nothing *and* spells the plaintext into the log.
-	* A worker that signs (an S3-style `BlobStore` is the canonical case) must compose
-	* `ActionOutputs.layerDetached`, under which this member still returns the
-	* raw key for the HMAC but the mask is a documented no-op; the masking
+	* A worker that signs must compose `ActionOutputs.layerDetached`, under
+	* which this member still returns the raw key but the mask is a
+	* documented no-op; the masking
 	* itself is the **parent's** job, done before the spawn via
 	* {@link Secret.forChildEnv} under the real layer.
 	*/
@@ -198,5 +202,4 @@ var Secret = class Secret {
 	static adopt = (name) => Config.Redacted(name);
 };
 
-//#endregion
 export { Secret };

package/ToolInstaller.js

@@ -1,6 +1,6 @@
 import { ActionEnvironment } from "./ActionEnvironment.js";
 import { unstubbed } from "./internal/unstubbed.js";
-import { isWindowsRunner, toolCacheRoot } from "./internal/runner.js";
+import { isWindowsRunner, runnerArch, toolCacheRoot } from "./internal/runner.js";
 import { spawnOnce } from "./internal/spawn.js";
 import { tarExtractCommand, unzipCommand } from "./internal/archiveCommands.js";
 import { isErrno, typeAt } from "./internal/fsProbe.js";
@@ -8,7 +8,7 @@ import { Context, Effect, FileSystem, Layer, Option, Path, Schedule, Schema, Str
 import { HttpClient } from "effect/http";
 import { ChildProcessSpawner } from "effect/process";
 
-//#region src/ToolInstaller.ts
+// src/ToolInstaller.ts
 /**
 * Raised when a tool cannot be downloaded, extracted or cached.
 *
@@ -68,11 +68,12 @@ const make = Effect.gen(function* () {
 	const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
 	const root = yield* toolCacheRoot(env, path);
 	const windows = yield* isWindowsRunner(env);
+	const arch = yield* runnerArch(env);
 	const cachePath = (tool, version) => ToolInstaller.cachePath({
 		root,
 		tool,
 		version,
-		arch: process.arch
+		arch
 	});
 	const destinationFor = (options) => {
 		const requested = options?.destination;
@@ -376,5 +377,4 @@ var ToolInstaller = class ToolInstaller extends Context.Service()("@effected/git
 	static layerTest = (overrides = {}) => Layer.succeed(ToolInstaller, ToolInstaller.makeTest(overrides));
 };
 
-//#endregion
 export { ToolInstaller, ToolInstallerError };