@pnpm/deps.github-actions 1100.0.1 → 1100.1.1

package/CHANGELOG.md

@@ -1,5 +1,34 @@
 # @pnpm/deps.github-actions
 
+## 1100.1.1
+
+### Patch Changes
+
+- Checking GitHub Actions dependencies for updates is now opt-in for every command. Neither `pnpm outdated` nor `pnpm update` reads the workflow files unless `--include-github-actions` is passed or `update.githubActions` is set to `true` in `pnpm-workspace.yaml`. Reading them runs `git ls-remote` against every referenced repository, which fails in environments where GitHub is not reachable the way pnpm assumes (a GitHub Enterprise Server, a custom certificate authority, or an offline network) [#13254](https://github.com/pnpm/pnpm/issues/13254).
+
+  `pnpm outdated` accepts the `--include-github-actions` option too.
+
+- Updated dependencies:
+  - @pnpm/resolving.git-resolver@1100.1.13
+
+## 1100.1.0
+
+### Minor Changes
+
+- Added a new setting, `update.githubActionsServer`, for specifying the base URL of the GitHub server that hosts the repositories of the GitHub Actions referenced by the workflow files (for example, a GitHub Enterprise Server). When the setting is not defined, the URL is read from the `GITHUB_SERVER_URL` environment variable, falling back to `https://github.com`. The URL must use the `https://` or `http://` protocol [#13220](https://github.com/pnpm/pnpm/issues/13220).
+
+  `pnpm outdated` and `pnpm update` no longer fail when the refs of a GitHub Action's repository cannot be read (for example, when the action's repository is private or hosted on a different GitHub server). Such actions are now skipped with a warning.
+
+  Setting `update.githubActions` to `false` now makes `pnpm outdated` and the interactive `pnpm update` skip GitHub Actions dependencies.
+
+### Patch Changes
+
+- Republished every package: the tarballs published by the v11.13.1 through v11.16.0 releases were missing most of their compiled files due to a packing bug [#13164](https://github.com/pnpm/pnpm/issues/13164).
+
+- Updated dependencies:
+  - @pnpm/error@1100.1.0
+  - @pnpm/resolving.git-resolver@1100.1.12
+
 ## 1100.0.1
 
 ### Patch Changes

package/lib/index.d.ts

@@ -0,0 +1,41 @@
+export interface OutdatedGitHubAction {
+    current: string;
+    latest: string;
+    name: string;
+    wanted: string;
+    homepage: string;
+}
+export interface GitHubActionsOptions {
+    dir: string;
+    match?: (name: string) => boolean;
+    readRepoRefs?: (repo: string) => Promise<Record<string, string>>;
+    /**
+     * The base URL of the GitHub server hosting the action repositories.
+     * Defaults to the `GITHUB_SERVER_URL` environment variable, or
+     * https://github.com.
+     */
+    serverUrl?: string;
+}
+export interface FindOutdatedGitHubActionsOptions extends GitHubActionsOptions {
+    compatible?: boolean;
+}
+export interface UpdateGitHubActionsOptions extends GitHubActionsOptions {
+    latest?: boolean;
+}
+export interface GitHubActionsOptInOptions {
+    includeGithubActions?: boolean;
+    updateConfig?: {
+        githubActions?: boolean;
+    };
+}
+/**
+ * GitHub Actions dependencies are opt-in. Reading them means running
+ * `git ls-remote` against every referenced repository, so `pnpm outdated` and
+ * `pnpm update` only look at workflow files when asked to, either with
+ * `--include-github-actions` or with `update.githubActions: true`.
+ */
+export declare function shouldCheckGitHubActions(opts: GitHubActionsOptInOptions): boolean;
+export declare function isGitHubActionSelector(selector: string): boolean;
+export declare function normalizeGitHubActionSelector(selector: string): string;
+export declare function findOutdatedGitHubActions(opts: FindOutdatedGitHubActionsOptions): Promise<OutdatedGitHubAction[]>;
+export declare function updateGitHubActions(opts: UpdateGitHubActionsOptions): Promise<OutdatedGitHubAction[]>;

package/lib/index.js

@@ -1,7 +1,8 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import util from 'node:util';
-import { PnpmError } from '@pnpm/error';
+import { PnpmError, redactAndSanitize } from '@pnpm/error';
+import { globalWarn } from '@pnpm/logger';
 import { getRepoRefs } from '@pnpm/resolving.git-resolver';
 import { isSubdir } from 'is-subdir';
 import pLimit from 'p-limit';
@@ -10,6 +11,15 @@ import writeFileAtomic from 'write-file-atomic';
 import YAML, { isMap, isNode, isScalar, isSeq } from 'yaml';
 const SHA_PATTERN = /^[0-9a-f]{40}$/;
 const limitRepoReads = pLimit(8);
+/**
+ * GitHub Actions dependencies are opt-in. Reading them means running
+ * `git ls-remote` against every referenced repository, so `pnpm outdated` and
+ * `pnpm update` only look at workflow files when asked to, either with
+ * `--include-github-actions` or with `update.githubActions: true`.
+ */
+export function shouldCheckGitHubActions(opts) {
+    return opts.includeGithubActions === true || opts.updateConfig?.githubActions === true;
+}
 export function isGitHubActionSelector(selector) {
     const pattern = selector.startsWith('!') ? selector.slice(1) : selector;
     return !pattern.startsWith('@') && pattern.includes('/');
@@ -22,6 +32,7 @@ export function normalizeGitHubActionSelector(selector) {
 }
 export async function findOutdatedGitHubActions(opts) {
     const plans = await createUpdatePlan(opts);
+    const serverUrl = resolveServerUrl(opts.serverUrl);
     const target = (plan) => opts.compatible ? plan.wanted : plan.latest;
     return dedupeOutdated(plans
         .filter((plan) => semver.lt(plan.current.version, target(plan).version))
@@ -30,7 +41,7 @@ export async function findOutdatedGitHubActions(opts) {
         latest: target(plan).version.version,
         name: plan.action.name,
         wanted: plan.wanted.version.version,
-        homepage: `https://github.com/${plan.action.repo}`,
+        homepage: `${serverUrl}/${plan.action.repo}`,
     })));
 }
 export async function updateGitHubActions(opts) {
@@ -63,6 +74,7 @@ export async function updateGitHubActions(opts) {
             throw workflowError('WRITE', file.path, err);
         }
     }));
+    const serverUrl = resolveServerUrl(opts.serverUrl);
     return dedupeOutdated(updates.map((plan) => {
         const target = opts.latest ? plan.latest : plan.wanted;
         return {
@@ -70,19 +82,30 @@ export async function updateGitHubActions(opts) {
             latest: target.version.version,
             name: plan.action.name,
             wanted: plan.wanted.version.version,
-            homepage: `https://github.com/${plan.action.repo}`,
+            homepage: `${serverUrl}/${plan.action.repo}`,
         };
     }));
 }
 async function createUpdatePlan(opts) {
     const actions = await discoverActions(opts.dir);
     const selected = opts.match == null ? actions : actions.filter((action) => opts.match(action.name) || opts.match(action.repo));
-    const readRepoRefs = opts.readRepoRefs ?? readRefsWithGit;
+    const serverUrl = resolveServerUrl(opts.serverUrl);
+    const readRepoRefs = opts.readRepoRefs ?? (async (repo) => getRepoRefs(`${serverUrl}/${repo}.git`, null));
     const refsByRepo = new Map();
     return (await Promise.all(selected.map(async (action) => {
         let versionsPromise = refsByRepo.get(action.repo);
         if (versionsPromise == null) {
-            versionsPromise = limitRepoReads(() => readRepoRefs(action.repo).then(parseRepoVersions));
+            versionsPromise = limitRepoReads(async () => {
+                try {
+                    return parseRepoVersions(await readRepoRefs(action.repo));
+                }
+                catch (err) {
+                    // The git error may echo a credentialed URL or raw stderr back, so
+                    // it is redacted and stripped of control characters before logging.
+                    globalWarn(redactAndSanitize(`Skipping the GitHub Actions from "${action.repo}": ${util.types.isNativeError(err) ? err.message : String(err)}`));
+                    return [];
+                }
+            });
             refsByRepo.set(action.repo, versionsPromise);
         }
         const versions = await versionsPromise;
@@ -334,8 +357,16 @@ function dedupeOutdated(actions) {
     return [...new Map(actions.map((action) => [action.name, action])).values()]
         .sort((left, right) => left.name.localeCompare(right.name));
 }
-async function readRefsWithGit(repo) {
-    return getRepoRefs(`https://github.com/${repo}.git`, null);
+function resolveServerUrl(serverUrl) {
+    let url = serverUrl || process.env.GITHUB_SERVER_URL || 'https://github.com';
+    // Only allow http(s) so the value cannot select another git transport
+    // (e.g. `ext::`, which executes an arbitrary command).
+    if (!url.startsWith('https://') && !url.startsWith('http://')) {
+        throw new PnpmError('GITHUB_ACTIONS_SERVER_PROTOCOL', `The GitHub Actions server URL must use the "https://" or "http://" protocol, but got ${JSON.stringify(url)}`);
+    }
+    while (url.endsWith('/'))
+        url = url.slice(0, -1);
+    return url;
 }
 function workflowError(operation, filePath, cause) {
     const detail = util.types.isNativeError(cause) ? cause.message : String(cause);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/deps.github-actions",
-  "version": "1100.0.1",
+  "version": "1100.1.1",
   "description": "Discover and update GitHub Actions dependencies",
   "keywords": [
     "pnpm",
@@ -28,17 +28,20 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/error": "1100.0.1",
-    "@pnpm/resolving.git-resolver": "1100.1.11",
+    "@pnpm/error": "1100.1.0",
+    "@pnpm/resolving.git-resolver": "1100.1.13",
     "is-subdir": "^2.0.0",
-    "p-limit": "^7.3.0",
-    "semver": "^7.8.4",
+    "p-limit": "^7.3.1",
+    "semver": "^7.8.5",
     "write-file-atomic": "^7.0.1",
     "yaml": "^2.9.0"
   },
+  "peerDependencies": {
+    "@pnpm/logger": "^1100.0.0"
+  },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/deps.github-actions": "1100.0.1",
+    "@pnpm/deps.github-actions": "1100.1.1",
     "@types/semver": "7.7.1",
     "@types/write-file-atomic": "^4.0.3"
   },