@effected/github-actions 0.23.1 → 0.25.0

package/internal/spawn.js

@@ -1,6 +1,6 @@
 import { Effect, Stream } from "effect";
 
-//#region src/internal/spawn.ts
+// src/internal/spawn.ts
 /**
 * Spawn `command` once, drain `stdout`+`stderr`, then read the exit code from
 * the same handle. Never fails on a non-zero exit — that is the caller's
@@ -14,5 +14,4 @@ const spawnOnce = (spawner, command) => Effect.scoped(Effect.gen(function* () {
 	};
 }));
 
-//#endregion
 export { spawnOnce };

package/internal/twirp.js

@@ -1,7 +1,7 @@
 import { Effect, Schedule } from "effect";
 import { HttpClientRequest } from "effect/http";
 
-//#region src/internal/twirp.ts
+// src/internal/twirp.ts
 /**
 * Returned instead of a failure when the backend answers HTTP 409.
 *
@@ -110,5 +110,4 @@ const stringField = (body, name) => {
 /** Whether a Twirp response carries `ok: true`. @internal */
 const isOk = (body) => field(body, "ok") === true;
 
-//#endregion
 export { CONFLICT, field, isOk, isRetryable, stringField, twirpCall, twirpFailureFields };

package/internal/unstubbed.js

@@ -1,6 +1,6 @@
 import { Effect } from "effect";
 
-//#region src/internal/unstubbed.ts
+// src/internal/unstubbed.ts
 /**
 * The die-on-call members of `<double>.makeTest`: `dies("save")` is an
 * `Effect` that defects naming `save` when run. Each package double binds its
@@ -12,5 +12,4 @@ const unstubbed = (double) => (member) => Effect.sync(() => {
 	throw new Error(`${double}: ${member}() was called but not stubbed — pass a \`${member}\` override.`);
 });
 
-//#endregion
 export { unstubbed };

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@effected/github-actions",
-	"version": "0.23.1",
+	"version": "0.25.0",
 	"private": false,
 	"description": "The GitHub Actions runtime: env, inputs, outputs, state, logging, cache, artifacts, blob storage, OIDC and the token bridge.",
 	"keywords": [
@@ -39,15 +39,18 @@
 	},
 	"dependencies": {
 		"@azure/storage-blob": "^12.33.0",
-		"@effected/github": "^0.21.0",
-		"@effected/github-commands": "^0.5.0",
-		"@effected/glob": "^0.13.0",
-		"@effected/markdown": "^0.19.0",
-		"@effected/npm": "^0.23.0",
-		"@effected/sbom": "^0.13.0",
-		"@effected/semver": "^0.14.0",
-		"@effected/templates": "^0.13.0",
-		"@effected/walker": "^0.18.0"
+		"@effected/crypto": "^0.1.0",
+		"@effected/github": "^0.23.0",
+		"@effected/github-commands": "^0.6.0",
+		"@effected/glob": "^0.14.0",
+		"@effected/jwt": "^0.5.0",
+		"@effected/markdown": "^0.20.0",
+		"@effected/npm": "^0.25.0",
+		"@effected/oidc": "^0.1.0",
+		"@effected/sbom": "^0.15.0",
+		"@effected/semver": "^0.15.0",
+		"@effected/templates": "^0.14.0",
+		"@effected/walker": "^0.19.0"
 	},
 	"peerDependencies": {
 		"@effect/platform-node": "^4.0.0",

package/internal/jwt.js

@@ -1,42 +0,0 @@
-import { Result } from "effect";
-import * as Base64Url from "effect/encoding/Base64Url";
-
-//#region src/internal/jwt.ts
-/**
-* The decoded payload of `token` — the middle segment, base64url JSON —
-* without any check on the signature.
-*
-* @internal
-*/
-const payloadOf = (token) => {
-	const segments = token.split(".");
-	const payload = segments[1];
-	if (segments.length !== 3 || payload === void 0 || payload === "") return Result.fail({ detail: `expected three segments, got ${segments.length}` });
-	const json = Base64Url.decodeString(payload);
-	if (Result.isFailure(json)) return Result.fail({
-		detail: "the payload is not base64url JSON",
-		cause: json.failure
-	});
-	try {
-		return Result.succeed(JSON.parse(json.success));
-	} catch (cause) {
-		return Result.fail({
-			detail: "the payload is not base64url JSON",
-			cause
-		});
-	}
-};
-/**
-* An **unsigned** JWT: `header.payload.unsigned`, each JSON segment
-* base64url-encoded. For building test doubles and nothing else — the
-* signature segment is a placeholder, so this token fails any verifier.
-*
-* @internal
-*/
-const unsignedJwt = (header, payload) => {
-	const segment = (value) => Base64Url.encode(JSON.stringify(value));
-	return `${segment(header)}.${segment(payload)}.unsigned`;
-};
-
-//#endregion
-export { payloadOf, unsignedJwt };

package/internal/sigv4.js

@@ -1,115 +0,0 @@
-import { sha256Hex } from "./digest.js";
-import { createHmac } from "node:crypto";
-
-//#region src/internal/sigv4.ts
-/**
-* AWS Signature Version 4, for S3-compatible object stores.
-*
-* @remarks
-* **Pure**, and about a hundred lines, which is the whole argument for not
-* taking an `@aws-sdk/*` dependency to obtain it. Signing is a specified
-* algorithm over strings and HMACs; the SDK around it exists to manage
-* credentials, retries and a service catalogue this package does not want.
-*
-* `node:crypto` rather than core `Crypto` because core's `Crypto` offers only
-* one-shot SHA digests over bytes already in memory — no HMAC, no incremental
-* hasher (see `internal/digest.ts`, this package's other `node:crypto`
-* licence). This package is the one place in the kit where a `node:` import
-* is sanctioned, and this is one of the four reasons.
-*
-* @internal
-*/
-const ALGORITHM = "AWS4-HMAC-SHA256";
-const hmac = (key, value) => new Uint8Array(createHmac("sha256", key).update(value).digest());
-/**
-* Percent-encode one path segment the way SigV4 requires.
-*
-* @remarks
-* `encodeURIComponent` leaves `!'()*` alone and AWS does not, so a key
-* containing any of them signs one string and requests another — which fails as
-* an opaque `SignatureDoesNotMatch` rather than as anything that names the
-* character. The unreserved set is exactly `A-Za-z0-9-_.~`.
-*/
-const uriEncode = (value) => encodeURIComponent(value).replace(/[!'()*]/g, (character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`);
-/** `20130524T000000Z` and `20130524`, the two forms the algorithm uses. */
-const timestamps = (now) => {
-	const amzDate = `${now.toISOString().replace(/[:-]|\.\d{3}/g, "").slice(0, 15)}Z`;
-	return {
-		amzDate,
-		dateStamp: amzDate.slice(0, 8)
-	};
-};
-/**
-* Assemble the headers that will be signed, and the canonical request over them.
-*
-* @remarks
-* Exported separately from {@link sign} so a test can pin it against AWS's
-* **own documented** canonical request rather than against this
-* implementation's output.
-*/
-const canonicalize = (request, credentials) => {
-	const { amzDate, dateStamp } = timestamps(request.now);
-	const payloadHash = sha256Hex(request.body);
-	const headers = {
-		...request.headers,
-		host: request.host,
-		"x-amz-date": amzDate,
-		"x-amz-content-sha256": payloadHash,
-		...credentials.sessionToken === void 0 ? {} : { "x-amz-security-token": credentials.sessionToken }
-	};
-	const lowered = new Map(Object.entries(headers).map(([name, value]) => [name.toLowerCase(), value]));
-	const canonicalNames = [...lowered.keys()].sort();
-	const canonicalHeaders = canonicalNames.map((name) => `${name}:${(lowered.get(name) ?? "").trim().replace(/\s+/g, " ")}\n`).join("");
-	const signedHeaders = canonicalNames.join(";");
-	const canonicalPath = `/${request.path.split("/").filter((segment) => segment !== "").map(uriEncode).join("/")}`;
-	return {
-		headers,
-		signedHeaders,
-		amzDate,
-		dateStamp,
-		canonicalRequest: [
-			request.method,
-			canonicalPath,
-			"",
-			canonicalHeaders,
-			signedHeaders,
-			payloadHash
-		].join("\n")
-	};
-};
-/**
-* Derive a signing key.
-*
-* @remarks
-* Four nested HMACs over date, region, service and the literal `aws4_request`.
-* Exported so a test can reproduce AWS's documented derivation example.
-*/
-const signingKey = (secretAccessKey, dateStamp, region, service) => hmac(hmac(hmac(hmac(`AWS4${secretAccessKey}`, dateStamp), region), service), "aws4_request");
-/**
-* Sign a request, returning the headers to send.
-*
-* @remarks
-* The returned record is the caller's headers **plus** everything signing added
-* — `host`, `x-amz-date`, `x-amz-content-sha256`, the optional
-* `x-amz-security-token` and `authorization` — so a caller sends exactly what
-* was signed rather than assembling a second, subtly different set.
-*/
-const sign = (request, credentials) => {
-	const { headers, canonicalRequest, signedHeaders, amzDate, dateStamp } = canonicalize(request, credentials);
-	const scope = `${dateStamp}/${credentials.region}/${credentials.service}/aws4_request`;
-	const stringToSign = [
-		ALGORITHM,
-		amzDate,
-		scope,
-		sha256Hex(canonicalRequest)
-	].join("\n");
-	const key = signingKey(credentials.secretAccessKey, dateStamp, credentials.region, credentials.service);
-	const signature = Buffer.from(hmac(key, stringToSign)).toString("hex");
-	return {
-		...headers,
-		authorization: `${ALGORITHM} Credential=${credentials.accessKeyId}/${scope}, SignedHeaders=${signedHeaders}, Signature=${signature}`
-	};
-};
-
-//#endregion
-export { canonicalize, sha256Hex as digestHex, sign, signingKey, uriEncode };