@effected/github-actions 0.3.0 → 0.4.1

package/ActionEnvironment.js

@@ -37,6 +37,22 @@ var GitHubContext = class extends Schema.Class("GitHubContext")({
 	ref: Schema.String,
 	/** The short ref, e.g. `main`. */
 	refName: Schema.String,
+	/**
+	* The source branch of the pull request, when the event has one.
+	*
+	* @remarks
+	* `GITHUB_HEAD_REF` is only set for `pull_request` events — and on every
+	* other event the runner does not merely omit it, it may write the **empty
+	* string**, which a raw `process.env` read happily reports as present. That
+	* trap is encoded in the type: absent and `""` both decode to
+	* `Option.none()`, so a consumer cannot build a cache key segment out of an
+	* empty branch name by accident. For "the branch a human means", use
+	* {@link GitHubContext.branch}, which owns the fallback to `refName`.
+	*
+	* The encoded form is `string | null` rather than a serialized `Option`, so
+	* an encoded context stays plain JSON.
+	*/
+	headRef: Schema.OptionFromNullOr(Schema.String),
 	sha: Schema.String,
 	workflow: Schema.String,
 	job: Schema.String,
@@ -48,7 +64,22 @@ var GitHubContext = class extends Schema.Class("GitHubContext")({
 	apiUrl: Schema.String,
 	graphqlUrl: Schema.String,
 	workspace: Schema.String
-}) {};
+}) {
+	/**
+	* The branch a human means: `headRef` when present (a pull request, where
+	* `refName` is the useless `123/merge`), otherwise `refName`.
+	*
+	* @remarks
+	* This is the universal branch-scoped-cache-key fallback chain, written
+	* once. On a `push` or any other non-PR event `headRef` is `Option.none()`
+	* — including when the runner wrote it as the empty string — so the answer
+	* is the short ref. Note that on a tag push `refName` names the tag, not a
+	* branch; a consumer that must distinguish still has the full `ref`.
+	*/
+	get branch() {
+		return Option.getOrElse(this.headRef, () => this.refName);
+	}
+};
 /**
 * The runner's own context, projected from the `RUNNER_*` variables.
 *
@@ -110,6 +141,7 @@ const make = (base) => Effect.gen(function* () {
 			]);
 			const runId = yield* Effect.flatMap(get("GITHUB_RUN_ID"), (raw) => numeric("GITHUB_RUN_ID", raw));
 			const runAttempt = yield* Effect.flatMap(get("GITHUB_RUN_ATTEMPT"), (raw) => numeric("GITHUB_RUN_ATTEMPT", raw));
+			const headRef = yield* lookup("GITHUB_HEAD_REF");
 			const [eventName, actor, serverUrl, apiUrl, graphqlUrl, workspace] = yield* Effect.all([
 				get("GITHUB_EVENT_NAME"),
 				get("GITHUB_ACTOR"),
@@ -123,6 +155,7 @@ const make = (base) => Effect.gen(function* () {
 				repositoryOwner,
 				ref,
 				refName,
+				headRef,
 				sha,
 				workflow,
 				job,

package/CacheKey.js

@@ -215,6 +215,47 @@ var CacheKey = class CacheKey extends Schema.Class("CacheKey")(Schema.Struct({
 		return CacheKey.make({ segments });
 	}
 	/**
+	* A segment-safe short digest of a string.
+	*
+	* @remarks
+	* {@link CacheKey.hashFiles} covers file *content*; this covers the key
+	* segments built from **non-file** inputs — a sorted version list, a branch
+	* name — that every compound key hashes and truncates by hand, each caller
+	* re-deciding the length and the placement. One home for the derivation:
+	* SHA-256, lowercase hex, the first `length` characters.
+	*
+	* The answer is **guaranteed to satisfy the segment grammar**: lowercase hex
+	* is nonempty (for any permitted `length`) and can never contain the comma
+	* or newline the restore-key protocol reserves, so the result drops straight
+	* into {@link CacheKey.of} with nothing to check at the call site.
+	*
+	* Deterministic and pure — the same input always answers the same digest,
+	* which is the entire point of putting one in a cache key. Distinct inputs
+	* are only *probably* distinct, as with any truncated hash; eight hex
+	* characters (32 bits) is the conventional balance between key legibility
+	* and collision risk for cache segments.
+	*
+	* A `length` outside `1..64` (or a fractional one) is a wiring mistake, not
+	* data, and **throws a `RangeError`** rather than failing typed: 64 is all
+	* SHA-256 has, and asking for more would silently answer fewer characters
+	* than the caller believes it got.
+	*
+	* @example
+	* ```ts
+	* import { CacheKey } from "@effected/github-actions";
+	*
+	* const key = CacheKey.of(
+	*   "Linux",
+	*   CacheKey.digest("node:24.4.0,pnpm:10.13.1"),
+	*   CacheKey.digest("feat/my-branch"),
+	* );
+	* ```
+	*/
+	static digest(input, length = 8) {
+		if (!Number.isInteger(length) || length < 1 || length > 64) throw new RangeError(`A digest length must be an integer between 1 and 64, got ${length}`);
+		return createHash("sha256").update(input).digest("hex").slice(0, length);
+	}
+	/**
 	* Hash a set of files into a single digest.
 	*
 	* @remarks

package/ChildEnv.js

@@ -0,0 +1,124 @@
+//#region src/ChildEnv.ts
+/**
+* Child-process environment construction: prepending directories to `PATH`
+* without falling into the three traps that each cost a real consumer a
+* cross-OS matrix round.
+*
+* @remarks
+* Spawning a child with directories prepended to `PATH` is one tiny concern
+* with three sharp edges, and every one of them fails silently or only on
+* Windows:
+*
+* 1. **`env` without `extendEnv: true` strips the child's environment.**
+*    Core's `ChildProcess.CommandOptions.env` *replaces* the block unless
+*    `extendEnv` says to merge, so a bare `{ env }` costs the child everything
+*    — including the very `PATH` being extended.
+* 2. **Windows spells it `Path`, and casing decides who wins.** The
+*    environment block is case-insensitive on win32, and Node de-duplicates a
+*    merged block by keeping the **lexicographically first** spelling — an
+*    undocumented internal that happens to favour `PATH` over an inherited
+*    `Path`, and that nothing obliges Node to keep. Writing through the
+*    inherited key's own casing means never depending on it.
+* 3. **`.cmd` shims need a shell since CVE-2024-27980.** See
+*    {@link ChildEnv.needsShell}.
+*
+* The first two live in {@link ChildEnv.prependPath}; the third is a separate
+* predicate because it belongs on the spawn call, not in the environment.
+*
+* This class is total and pure — no service, no `R`, nothing read from the
+* ambient process — the same species as `Secret`'s statics, one concern per
+* member.
+*
+* @public
+*/
+var ChildEnv = class ChildEnv {
+	constructor() {}
+	/**
+	* The key `base` spells `PATH` with — `Path` on a typical Windows block,
+	* `PATH` elsewhere, and `PATH` when the base has no entry at all.
+	*
+	* @remarks
+	* The lookup is case-insensitive because the Windows environment block is;
+	* the answer preserves the base's own casing because that is the spelling a
+	* merged block must write through (trap 2 above).
+	*/
+	static pathKeyOf(base) {
+		return Object.keys(base).find((key) => key.toUpperCase() === "PATH") ?? "PATH";
+	}
+	/**
+	* The environment additions that prepend `dirs` to the child's `PATH`,
+	* paired with the `extendEnv: true` that keeps them a *prepend*.
+	*
+	* @remarks
+	* `dirs` are joined ahead of the inherited value **in the order given** —
+	* order is the caller's policy, because the first directory wins any name
+	* collision (a package manager's shim directory leads so it beats a runtime
+	* of the same name). The entry is written under the base's own `PATH`
+	* spelling ({@link ChildEnv.pathKeyOf}), so a Windows child never receives
+	* `PATH` beside its inherited `Path`. An absent or empty inherited value
+	* appends nothing — deliberately not an empty trailing entry, which both
+	* platforms historically read as "the current directory".
+	*
+	* Two consumers, two compositions, and the difference is exactly trap 1:
+	*
+	* - A spawner call takes the **whole pair** — spread it into the command
+	*   options, as in the example below, so the `extendEnv: true` that makes
+	*   `env` a merge rather than a replacement cannot be forgotten.
+	* - An API that already merges additions over the parent itself —
+	*   `DetachedProcess.spawn`, whose `env` is documented as merged — takes
+	*   `.env` alone; `extendEnv` would be meaningless there.
+	*
+	* On a runner, pass `{ base: process.env, platform: process.platform }`.
+	*
+	* @example
+	* ```ts
+	* import { ChildEnv } from "@effected/github-actions";
+	* import { ChildProcess } from "effect/unstable/process";
+	*
+	* const command = ChildProcess.make("pnpm", ["install"], {
+	*   ...ChildEnv.prependPath(["/opt/hostedtoolcache/pnpm/10.13.1/x64/bin"], {
+	*     base: process.env,
+	*     platform: process.platform,
+	*   }),
+	*   ...(ChildEnv.needsShell(process.platform) ? { shell: true } : {}),
+	* });
+	* ```
+	*/
+	static prependPath(dirs, options) {
+		const delimiter = options.platform === "win32" ? ";" : ":";
+		const key = ChildEnv.pathKeyOf(options.base);
+		const inherited = options.base[key];
+		const entries = inherited === void 0 || inherited === "" ? dirs : [...dirs, inherited];
+		return {
+			env: { [key]: entries.join(delimiter) },
+			extendEnv: true
+		};
+	}
+	/**
+	* Whether a bare-name command must be launched through a shell on this
+	* platform.
+	*
+	* @remarks
+	* On Windows every npm-installed tool on `PATH` is a `.cmd` batch shim, not
+	* an executable: `CreateProcess` cannot run one, and since CVE-2024-27980
+	* Node refuses to hand `.cmd`/`.bat` files to it at all unless a shell is
+	* asked for — so the spawn fails at launch, before the tool ever runs.
+	* Under `shell: true`, `cmd.exe` resolves the bare name off the **child's**
+	* `PATH` — the one {@link ChildEnv.prependPath} builds — through `PATHEXT`,
+	* where `.EXE` precedes `.CMD`, so a real binary of the same name is still
+	* found first and the prepends keep working exactly as they do without a
+	* shell.
+	*
+	* POSIX answers `false`: the direct spawn already works, and a shell would
+	* only add a quoting hazard between the caller and the exit code. Note the
+	* hazard `true` carries: under a shell Node concatenates the command line
+	* rather than passing an argv, so arguments must be static literals, never
+	* derived from input.
+	*/
+	static needsShell(platform) {
+		return platform === "win32";
+	}
+};
+
+//#endregion
+export { ChildEnv };

package/index.d.ts

@@ -36,6 +36,22 @@ declare const GitHubContext_base: Schema.Class<GitHubContext, Schema.Struct<{
   readonly ref: Schema.String;
   /** The short ref, e.g. `main`. */
   readonly refName: Schema.String;
+  /**
+   * The source branch of the pull request, when the event has one.
+   *
+   * @remarks
+   * `GITHUB_HEAD_REF` is only set for `pull_request` events — and on every
+   * other event the runner does not merely omit it, it may write the **empty
+   * string**, which a raw `process.env` read happily reports as present. That
+   * trap is encoded in the type: absent and `""` both decode to
+   * `Option.none()`, so a consumer cannot build a cache key segment out of an
+   * empty branch name by accident. For "the branch a human means", use
+   * {@link GitHubContext.branch}, which owns the fallback to `refName`.
+   *
+   * The encoded form is `string | null` rather than a serialized `Option`, so
+   * an encoded context stays plain JSON.
+   */
+  readonly headRef: Schema.OptionFromNullOr<Schema.String>;
   readonly sha: Schema.String;
   readonly workflow: Schema.String;
   readonly job: Schema.String;
@@ -53,7 +69,20 @@ declare const GitHubContext_base: Schema.Class<GitHubContext, Schema.Struct<{
  *
  * @public
  */
-declare class GitHubContext extends GitHubContext_base {}
+declare class GitHubContext extends GitHubContext_base {
+  /**
+   * The branch a human means: `headRef` when present (a pull request, where
+   * `refName` is the useless `123/merge`), otherwise `refName`.
+   *
+   * @remarks
+   * This is the universal branch-scoped-cache-key fallback chain, written
+   * once. On a `push` or any other non-PR event `headRef` is `Option.none()`
+   * — including when the runner wrote it as the empty string — so the answer
+   * is the short ref. Note that on a tag push `refName` names the tag, not a
+   * branch; a consumer that must distinguish still has the full `ref`.
+   */
+  get branch(): string;
+}
 declare const RunnerContext_base: Schema.Class<RunnerContext, Schema.Struct<{
   readonly os: Schema.String;
   readonly arch: Schema.String;
@@ -915,6 +944,44 @@ declare class CacheKey extends CacheKey_base {
     /** The content hash, e.g. from {@link CacheKey.hashFiles}. Included last when given. */
     readonly hash?: string;
   }): CacheKey;
+  /**
+   * A segment-safe short digest of a string.
+   *
+   * @remarks
+   * {@link CacheKey.hashFiles} covers file *content*; this covers the key
+   * segments built from **non-file** inputs — a sorted version list, a branch
+   * name — that every compound key hashes and truncates by hand, each caller
+   * re-deciding the length and the placement. One home for the derivation:
+   * SHA-256, lowercase hex, the first `length` characters.
+   *
+   * The answer is **guaranteed to satisfy the segment grammar**: lowercase hex
+   * is nonempty (for any permitted `length`) and can never contain the comma
+   * or newline the restore-key protocol reserves, so the result drops straight
+   * into {@link CacheKey.of} with nothing to check at the call site.
+   *
+   * Deterministic and pure — the same input always answers the same digest,
+   * which is the entire point of putting one in a cache key. Distinct inputs
+   * are only *probably* distinct, as with any truncated hash; eight hex
+   * characters (32 bits) is the conventional balance between key legibility
+   * and collision risk for cache segments.
+   *
+   * A `length` outside `1..64` (or a fractional one) is a wiring mistake, not
+   * data, and **throws a `RangeError`** rather than failing typed: 64 is all
+   * SHA-256 has, and asking for more would silently answer fewer characters
+   * than the caller believes it got.
+   *
+   * @example
+   * ```ts
+   * import { CacheKey } from "@effected/github-actions";
+   *
+   * const key = CacheKey.of(
+   *   "Linux",
+   *   CacheKey.digest("node:24.4.0,pnpm:10.13.1"),
+   *   CacheKey.digest("feat/my-branch"),
+   * );
+   * ```
+   */
+  static digest(input: string, length?: number): string;
   /**
    * Hash a set of files into a single digest.
    *
@@ -2422,6 +2489,152 @@ type CheckRunProjection = {
  */
 declare const projectCheckState: (state: CheckState) => CheckRunProjection;
 //#endregion
+//#region src/ChildEnv.d.ts
+/**
+ * The environment additions {@link ChildEnv.prependPath} builds: exactly one
+ * entry, keyed by the spelling of `PATH` the base environment already uses.
+ *
+ * @public
+ */
+interface PathPrependEnv {
+  /** The additions to hand a child, ready to merge over the parent's block. */
+  readonly env: Readonly<Record<string, string>>;
+  /**
+   * Always `true`, and part of the answer on purpose: `env` **without**
+   * `extendEnv: true` silently replaces the child's entire environment with
+   * this one entry. See {@link ChildEnv.prependPath}.
+   */
+  readonly extendEnv: true;
+}
+/**
+ * What {@link ChildEnv.prependPath} derives the additions from.
+ *
+ * @public
+ */
+interface PathPrependOptions {
+  /**
+   * The environment the child will inherit — on a runner, `process.env`.
+   *
+   * @remarks
+   * Explicit rather than defaulted, matching this package's rule that ambient
+   * process state is never read behind a caller's back — which is also what
+   * makes the Windows casing branch exercisable from a test on any host.
+   */
+  readonly base: Readonly<Record<string, string | undefined>>;
+  /**
+   * The platform the child runs on, `process.platform`-shaped. Decides the
+   * `PATH` entry delimiter: `;` on `win32`, `:` everywhere else.
+   */
+  readonly platform: string;
+}
+/**
+ * Child-process environment construction: prepending directories to `PATH`
+ * without falling into the three traps that each cost a real consumer a
+ * cross-OS matrix round.
+ *
+ * @remarks
+ * Spawning a child with directories prepended to `PATH` is one tiny concern
+ * with three sharp edges, and every one of them fails silently or only on
+ * Windows:
+ *
+ * 1. **`env` without `extendEnv: true` strips the child's environment.**
+ *    Core's `ChildProcess.CommandOptions.env` *replaces* the block unless
+ *    `extendEnv` says to merge, so a bare `{ env }` costs the child everything
+ *    — including the very `PATH` being extended.
+ * 2. **Windows spells it `Path`, and casing decides who wins.** The
+ *    environment block is case-insensitive on win32, and Node de-duplicates a
+ *    merged block by keeping the **lexicographically first** spelling — an
+ *    undocumented internal that happens to favour `PATH` over an inherited
+ *    `Path`, and that nothing obliges Node to keep. Writing through the
+ *    inherited key's own casing means never depending on it.
+ * 3. **`.cmd` shims need a shell since CVE-2024-27980.** See
+ *    {@link ChildEnv.needsShell}.
+ *
+ * The first two live in {@link ChildEnv.prependPath}; the third is a separate
+ * predicate because it belongs on the spawn call, not in the environment.
+ *
+ * This class is total and pure — no service, no `R`, nothing read from the
+ * ambient process — the same species as `Secret`'s statics, one concern per
+ * member.
+ *
+ * @public
+ */
+declare class ChildEnv {
+  private constructor();
+  /**
+   * The key `base` spells `PATH` with — `Path` on a typical Windows block,
+   * `PATH` elsewhere, and `PATH` when the base has no entry at all.
+   *
+   * @remarks
+   * The lookup is case-insensitive because the Windows environment block is;
+   * the answer preserves the base's own casing because that is the spelling a
+   * merged block must write through (trap 2 above).
+   */
+  static pathKeyOf(base: Readonly<Record<string, string | undefined>>): string;
+  /**
+   * The environment additions that prepend `dirs` to the child's `PATH`,
+   * paired with the `extendEnv: true` that keeps them a *prepend*.
+   *
+   * @remarks
+   * `dirs` are joined ahead of the inherited value **in the order given** —
+   * order is the caller's policy, because the first directory wins any name
+   * collision (a package manager's shim directory leads so it beats a runtime
+   * of the same name). The entry is written under the base's own `PATH`
+   * spelling ({@link ChildEnv.pathKeyOf}), so a Windows child never receives
+   * `PATH` beside its inherited `Path`. An absent or empty inherited value
+   * appends nothing — deliberately not an empty trailing entry, which both
+   * platforms historically read as "the current directory".
+   *
+   * Two consumers, two compositions, and the difference is exactly trap 1:
+   *
+   * - A spawner call takes the **whole pair** — spread it into the command
+   *   options, as in the example below, so the `extendEnv: true` that makes
+   *   `env` a merge rather than a replacement cannot be forgotten.
+   * - An API that already merges additions over the parent itself —
+   *   `DetachedProcess.spawn`, whose `env` is documented as merged — takes
+   *   `.env` alone; `extendEnv` would be meaningless there.
+   *
+   * On a runner, pass `{ base: process.env, platform: process.platform }`.
+   *
+   * @example
+   * ```ts
+   * import { ChildEnv } from "@effected/github-actions";
+   * import { ChildProcess } from "effect/unstable/process";
+   *
+   * const command = ChildProcess.make("pnpm", ["install"], {
+   *   ...ChildEnv.prependPath(["/opt/hostedtoolcache/pnpm/10.13.1/x64/bin"], {
+   *     base: process.env,
+   *     platform: process.platform,
+   *   }),
+   *   ...(ChildEnv.needsShell(process.platform) ? { shell: true } : {}),
+   * });
+   * ```
+   */
+  static prependPath(dirs: readonly [string, ...ReadonlyArray<string>], options: PathPrependOptions): PathPrependEnv;
+  /**
+   * Whether a bare-name command must be launched through a shell on this
+   * platform.
+   *
+   * @remarks
+   * On Windows every npm-installed tool on `PATH` is a `.cmd` batch shim, not
+   * an executable: `CreateProcess` cannot run one, and since CVE-2024-27980
+   * Node refuses to hand `.cmd`/`.bat` files to it at all unless a shell is
+   * asked for — so the spawn fails at launch, before the tool ever runs.
+   * Under `shell: true`, `cmd.exe` resolves the bare name off the **child's**
+   * `PATH` — the one {@link ChildEnv.prependPath} builds — through `PATHEXT`,
+   * where `.EXE` precedes `.CMD`, so a real binary of the same name is still
+   * found first and the prepends keep working exactly as they do without a
+   * shell.
+   *
+   * POSIX answers `false`: the direct spawn already works, and a shell would
+   * only add a quoting hazard between the caller and the exit code. Note the
+   * hazard `true` carries: under a shell Node concatenates the command line
+   * rather than passing an argv, so arguments must be static literals, never
+   * derived from input.
+   */
+  static needsShell(platform: string): boolean;
+}
+//#endregion
 //#region src/DetachedProcess.d.ts
 declare const DetachedProcessError_base: Schema.Class<DetachedProcessError, Schema.TaggedStruct<"DetachedProcessError", {
   /**
@@ -3845,5 +4058,5 @@ declare class Secret {
   static readonly adopt: (name: string) => Config.Config<Redacted.Redacted<string>>;
 }
 //#endregion
-export { Action, ActionCache, ActionCacheError, type ActionCacheShape, ActionEnvironment, ActionEnvironmentError, type ActionEnvironmentShape, ActionInput, ActionLogger, type ActionLoggerShape, ActionOutputError, ActionOutputs, type ActionOutputsShape, type ActionRunOptions, ActionRuntime, type ActionServices, ActionState, ActionStateError, type ActionStateShape, ActionsIdentityToken, ActionsProvenance, AmbientPackageManager, type AnnotationProperties, Artifact, ArtifactError, type ArtifactItem, type ArtifactRef, type ArtifactShape, type Blob, BlobEnvelope, BlobEnvelopeError, BlobStore, BlobStoreError, type BlobStoreShape, BlobTransferError, CacheKey, CacheKeyError, CachedPackageManager, CheckDocument, CheckDocumentError, type CheckDocumentOptions, type CheckDocumentShape, type CheckDocumentSink, CheckReport, type CheckRunConclusion, type CheckRunProjection, CheckState, type ClientLayerOptions, type DataBlobTransfer, DetachedProcess, DetachedProcessError, type DetachedSpawnOptions, type DownloadOptions, type DownloadResult, DryRun, type DryRunShape, type ExtractOptions, type FileBlobTransfer, GitHubCacheBlobStore, GitHubContext, type GitHubHeadingDepth, type GitHubListOptions, GitHubMarkdown, type GitHubRowSchema, type GitHubSchemaTable, type GitHubSchemaTableColumn, type GitHubSchemaTableColumns, type GitHubSchemaTableFormatRequiredKeys, type GitHubSchemaTableFormattedColumn, type GitHubSchemaTableOptions, GitHubToken, GitHubTokenError, InstalledPackageManager, ManagedDocument, ManagedDocumentError, type ManagedDocumentSource, OidcClaims, OidcTokenError, OidcTokenIssuer, type OidcTokenIssuerShape, type PackageManagerInstallOptions, PackageManagerInstaller, PackageManagerInstallerError, type PackageManagerInstallerShape, ProcessId, type ProvisionFileOptions, type ProvisionOptions, type ProvisionedFile, type ReadOptions, type ReadinessOptions, RunnerContext, type S3Config, Secret, type ToolDownloadOptions, ToolInstaller, ToolInstallerError, type ToolInstallerShape, type UploadOptions, type UploadResult, type WithBufferOptions, WorkflowCommand, describeCause, projectCheckState };
+export { Action, ActionCache, ActionCacheError, type ActionCacheShape, ActionEnvironment, ActionEnvironmentError, type ActionEnvironmentShape, ActionInput, ActionLogger, type ActionLoggerShape, ActionOutputError, ActionOutputs, type ActionOutputsShape, type ActionRunOptions, ActionRuntime, type ActionServices, ActionState, ActionStateError, type ActionStateShape, ActionsIdentityToken, ActionsProvenance, AmbientPackageManager, type AnnotationProperties, Artifact, ArtifactError, type ArtifactItem, type ArtifactRef, type ArtifactShape, type Blob, BlobEnvelope, BlobEnvelopeError, BlobStore, BlobStoreError, type BlobStoreShape, BlobTransferError, CacheKey, CacheKeyError, CachedPackageManager, CheckDocument, CheckDocumentError, type CheckDocumentOptions, type CheckDocumentShape, type CheckDocumentSink, CheckReport, type CheckRunConclusion, type CheckRunProjection, CheckState, ChildEnv, type ClientLayerOptions, type DataBlobTransfer, DetachedProcess, DetachedProcessError, type DetachedSpawnOptions, type DownloadOptions, type DownloadResult, DryRun, type DryRunShape, type ExtractOptions, type FileBlobTransfer, GitHubCacheBlobStore, GitHubContext, type GitHubHeadingDepth, type GitHubListOptions, GitHubMarkdown, type GitHubRowSchema, type GitHubSchemaTable, type GitHubSchemaTableColumn, type GitHubSchemaTableColumns, type GitHubSchemaTableFormatRequiredKeys, type GitHubSchemaTableFormattedColumn, type GitHubSchemaTableOptions, GitHubToken, GitHubTokenError, InstalledPackageManager, ManagedDocument, ManagedDocumentError, type ManagedDocumentSource, OidcClaims, OidcTokenError, OidcTokenIssuer, type OidcTokenIssuerShape, type PackageManagerInstallOptions, PackageManagerInstaller, PackageManagerInstallerError, type PackageManagerInstallerShape, type PathPrependEnv, type PathPrependOptions, ProcessId, type ProvisionFileOptions, type ProvisionOptions, type ProvisionedFile, type ReadOptions, type ReadinessOptions, RunnerContext, type S3Config, Secret, type ToolDownloadOptions, ToolInstaller, ToolInstallerError, type ToolInstallerShape, type UploadOptions, type UploadResult, type WithBufferOptions, WorkflowCommand, describeCause, projectCheckState };
 //# sourceMappingURL=index.d.ts.map

package/index.js

@@ -19,6 +19,7 @@ import { CacheKey, CacheKeyError } from "./CacheKey.js";
 import { CheckState, projectCheckState } from "./CheckState.js";
 import { ManagedDocument, ManagedDocumentError } from "./ManagedDocument.js";
 import { CheckDocument, CheckDocumentError, CheckReport } from "./CheckDocument.js";
+import { ChildEnv } from "./ChildEnv.js";
 import { DetachedProcess, DetachedProcessError, ProcessId } from "./DetachedProcess.js";
 import { DryRun } from "./DryRun.js";
 import { GitHubMarkdown } from "./GitHubMarkdown.js";
@@ -26,4 +27,4 @@ import { GitHubToken, GitHubTokenError } from "./GitHubToken.js";
 import { ToolInstaller, ToolInstallerError } from "./ToolInstaller.js";
 import { AmbientPackageManager, CachedPackageManager, InstalledPackageManager, PackageManagerInstaller, PackageManagerInstallerError } from "./PackageManagerInstaller.js";
 
-export { Action, ActionCache, ActionCacheError, ActionEnvironment, ActionEnvironmentError, ActionInput, ActionLogger, ActionOutputError, ActionOutputs, ActionRuntime, ActionState, ActionStateError, ActionsIdentityToken, ActionsProvenance, AmbientPackageManager, Artifact, ArtifactError, BlobEnvelope, BlobEnvelopeError, BlobStore, BlobStoreError, BlobTransferError, CacheKey, CacheKeyError, CachedPackageManager, CheckDocument, CheckDocumentError, CheckReport, CheckState, DetachedProcess, DetachedProcessError, DryRun, GitHubCacheBlobStore, GitHubContext, GitHubMarkdown, GitHubToken, GitHubTokenError, InstalledPackageManager, ManagedDocument, ManagedDocumentError, OidcClaims, OidcTokenError, OidcTokenIssuer, PackageManagerInstaller, PackageManagerInstallerError, ProcessId, RunnerContext, Secret, ToolInstaller, ToolInstallerError, WorkflowCommand, describeCause, projectCheckState };
+export { Action, ActionCache, ActionCacheError, ActionEnvironment, ActionEnvironmentError, ActionInput, ActionLogger, ActionOutputError, ActionOutputs, ActionRuntime, ActionState, ActionStateError, ActionsIdentityToken, ActionsProvenance, AmbientPackageManager, Artifact, ArtifactError, BlobEnvelope, BlobEnvelopeError, BlobStore, BlobStoreError, BlobTransferError, CacheKey, CacheKeyError, CachedPackageManager, CheckDocument, CheckDocumentError, CheckReport, CheckState, ChildEnv, DetachedProcess, DetachedProcessError, DryRun, GitHubCacheBlobStore, GitHubContext, GitHubMarkdown, GitHubToken, GitHubTokenError, InstalledPackageManager, ManagedDocument, ManagedDocumentError, OidcClaims, OidcTokenError, OidcTokenIssuer, PackageManagerInstaller, PackageManagerInstallerError, ProcessId, RunnerContext, Secret, ToolInstaller, ToolInstallerError, WorkflowCommand, describeCause, projectCheckState };

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@effected/github-actions",
-	"version": "0.3.0",
+	"version": "0.4.1",
 	"private": false,
 	"description": "The GitHub Actions runtime: env, inputs, outputs, state, logging, cache, artifacts, blob storage, OIDC and the token bridge.",
 	"keywords": [
@@ -39,12 +39,12 @@
 	},
 	"dependencies": {
 		"@azure/storage-blob": "^12.33.0",
-		"@effected/github": "~0.2.1",
-		"@effected/glob": "~0.2.1",
-		"@effected/markdown": "~0.4.1",
-		"@effected/npm": "~0.7.0",
-		"@effected/sbom": "~0.2.1",
-		"@effected/templates": "~0.1.0"
+		"@effected/github": "^0.2.2",
+		"@effected/glob": "^0.2.2",
+		"@effected/markdown": "^0.4.2",
+		"@effected/npm": "^0.8.1",
+		"@effected/sbom": "^0.2.2",
+		"@effected/templates": "^0.1.1"
 	},
 	"peerDependencies": {
 		"@effect/platform-node": "4.0.0-beta.101",