@pnpm/deps.github-actions 1100.0.1

package/CHANGELOG.md

@@ -0,0 +1,8 @@
+# @pnpm/deps.github-actions
+
+## 1100.0.1
+
+### Patch Changes
+
+- Updated dependencies:
+  - @pnpm/resolving.git-resolver@1100.1.11

package/LICENSE

@@ -0,0 +1,22 @@
+The MIT License (MIT)
+
+Copyright (c) 2015-2016 Rico Sta. Cruz and other contributors
+Copyright (c) 2016-2026 Zoltan Kochan and other contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,42 @@
+# @pnpm/deps.github-actions
+
+> Discover and update GitHub Actions dependencies
+
+[![npm version](https://img.shields.io/npm/v/@pnpm/deps.github-actions.svg)](https://npmx.dev/package/@pnpm/deps.github-actions)
+
+## Installation
+
+```sh
+pnpm add @pnpm/deps.github-actions
+```
+
+## Usage
+
+```ts
+import {
+  findOutdatedGitHubActions,
+  updateGitHubActions,
+} from '@pnpm/deps.github-actions'
+
+const outdated = await findOutdatedGitHubActions({
+  dir: process.cwd(),
+})
+
+await updateGitHubActions({
+  dir: process.cwd(),
+})
+```
+
+The package scans workflow files in `.github/workflows` and follows referenced local reusable workflows and composite actions. Only `uses` fields in jobs and steps are treated as dependencies.
+
+Updates are always pinned to an exact commit SHA. The corresponding semantic version tag is written in a comment:
+
+```yaml
+- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+```
+
+By default, `updateGitHubActions` selects the newest caret-compatible release. This keeps `0.5.x` releases below `0.6.0`, since pre-1.0 minor releases may contain breaking changes. Set `latest: true` to allow incompatible updates. `findOutdatedGitHubActions` reports the newest release by default; set `compatible: true` to report only caret-compatible updates.
+
+## License
+
+MIT

package/lib/index.js

@@ -0,0 +1,347 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import util from 'node:util';
+import { PnpmError } from '@pnpm/error';
+import { getRepoRefs } from '@pnpm/resolving.git-resolver';
+import { isSubdir } from 'is-subdir';
+import pLimit from 'p-limit';
+import semver from 'semver';
+import writeFileAtomic from 'write-file-atomic';
+import YAML, { isMap, isNode, isScalar, isSeq } from 'yaml';
+const SHA_PATTERN = /^[0-9a-f]{40}$/;
+const limitRepoReads = pLimit(8);
+export function isGitHubActionSelector(selector) {
+    const pattern = selector.startsWith('!') ? selector.slice(1) : selector;
+    return !pattern.startsWith('@') && pattern.includes('/');
+}
+export function normalizeGitHubActionSelector(selector) {
+    if (!isGitHubActionSelector(selector))
+        return selector;
+    const refSeparator = selector.lastIndexOf('@');
+    return refSeparator === -1 ? selector : selector.slice(0, refSeparator);
+}
+export async function findOutdatedGitHubActions(opts) {
+    const plans = await createUpdatePlan(opts);
+    const target = (plan) => opts.compatible ? plan.wanted : plan.latest;
+    return dedupeOutdated(plans
+        .filter((plan) => semver.lt(plan.current.version, target(plan).version))
+        .map((plan) => ({
+        current: plan.current.version.version,
+        latest: target(plan).version.version,
+        name: plan.action.name,
+        wanted: plan.wanted.version.version,
+        homepage: `https://github.com/${plan.action.repo}`,
+    })));
+}
+export async function updateGitHubActions(opts) {
+    const plans = await createUpdatePlan(opts);
+    const updates = plans.filter((plan) => {
+        const target = opts.latest ? plan.latest : plan.wanted;
+        return semver.lte(plan.current.version, target.version) &&
+            (plan.action.ref !== target.commit || plan.action.commentVersion !== target.tag);
+    });
+    const edits = new Map();
+    for (const plan of updates) {
+        const target = opts.latest ? plan.latest : plan.wanted;
+        const replacements = edits.get(plan.action.file) ?? [];
+        replacements.push({
+            range: plan.action.range,
+            value: renderTargetValue(plan.action, target),
+        });
+        edits.set(plan.action.file, replacements);
+    }
+    await Promise.all([...edits].map(async ([file, replacements]) => {
+        let source = file.source;
+        replacements.sort((left, right) => right.range[0] - left.range[0]);
+        for (const replacement of replacements) {
+            source = source.slice(0, replacement.range[0]) + replacement.value + source.slice(replacement.range[1]);
+        }
+        try {
+            await writeFileAtomic(file.path, source);
+        }
+        catch (err) {
+            throw workflowError('WRITE', file.path, err);
+        }
+    }));
+    return dedupeOutdated(updates.map((plan) => {
+        const target = opts.latest ? plan.latest : plan.wanted;
+        return {
+            current: plan.current.version.version,
+            latest: target.version.version,
+            name: plan.action.name,
+            wanted: plan.wanted.version.version,
+            homepage: `https://github.com/${plan.action.repo}`,
+        };
+    }));
+}
+async function createUpdatePlan(opts) {
+    const actions = await discoverActions(opts.dir);
+    const selected = opts.match == null ? actions : actions.filter((action) => opts.match(action.name) || opts.match(action.repo));
+    const readRepoRefs = opts.readRepoRefs ?? readRefsWithGit;
+    const refsByRepo = new Map();
+    return (await Promise.all(selected.map(async (action) => {
+        let versionsPromise = refsByRepo.get(action.repo);
+        if (versionsPromise == null) {
+            versionsPromise = limitRepoReads(() => readRepoRefs(action.repo).then(parseRepoVersions));
+            refsByRepo.set(action.repo, versionsPromise);
+        }
+        const versions = await versionsPromise;
+        const current = findCurrentVersion(action, versions);
+        if (current == null)
+            return null;
+        const stable = versions.filter(({ version }) => version.prerelease.length === 0);
+        const candidates = current.version.prerelease.length === 0 ? stable : versions;
+        const latest = candidates.at(-1);
+        const wanted = candidates
+            .filter(({ version }) => semver.satisfies(version, `^${current.version.version}`))
+            .at(-1);
+        if (latest == null || wanted == null)
+            return null;
+        return { action, current, latest, wanted };
+    }))).filter((plan) => plan != null);
+}
+async function discoverActions(dir) {
+    let realRoot;
+    try {
+        realRoot = await fs.realpath(dir);
+    }
+    catch (err) {
+        throw workflowError('READ', dir, err);
+    }
+    const workflowDir = path.join(dir, '.github', 'workflows');
+    let entries;
+    try {
+        entries = await fs.readdir(workflowDir);
+    }
+    catch (err) {
+        if (isErrorCode(err, 'ENOENT'))
+            return [];
+        throw workflowError('READ', workflowDir, err);
+    }
+    const workflowFiles = entries
+        .filter((entry) => entry.endsWith('.yml') || entry.endsWith('.yaml'))
+        .map((entry) => path.join(workflowDir, entry));
+    const visited = new Set();
+    const actions = [];
+    await Promise.all(workflowFiles.map(scanFile));
+    return actions;
+    async function scanFile(filePath) {
+        let realFilePath;
+        try {
+            realFilePath = await fs.realpath(filePath);
+        }
+        catch (err) {
+            throw workflowError('READ', filePath, err);
+        }
+        if (!isSubdir(realRoot, realFilePath)) {
+            throw new PnpmError('GITHUB_ACTIONS_WORKFLOW_OUTSIDE_ROOT', `GitHub Actions workflow is outside the project root: ${filePath}`);
+        }
+        if (visited.has(realFilePath))
+            return;
+        visited.add(realFilePath);
+        let source;
+        try {
+            source = await fs.readFile(realFilePath, 'utf8');
+        }
+        catch (err) {
+            throw workflowError('READ', realFilePath, err);
+        }
+        const document = YAML.parseDocument(source);
+        if (document.errors.length > 0)
+            throw workflowError('PARSE', realFilePath, document.errors[0]);
+        const file = { path: realFilePath, source };
+        const localReferences = [];
+        for (const node of findUsesScalars(document.contents)) {
+            const value = node.value;
+            if (value.startsWith('./')) {
+                localReferences.push(value);
+                continue;
+            }
+            const parsed = parseActionReference(value);
+            if (parsed == null)
+                continue;
+            if (node.range == null)
+                throw new Error(`Missing source range for GitHub Action in ${realFilePath}`);
+            const end = trimLineBreak(source, node.range[2] ?? node.range[1]);
+            actions.push({
+                ...parsed,
+                commentVersion: getCommentVersion(node),
+                file,
+                flowStyle: isFlowStyle(source, node.range[1]),
+                indentation: getIndentation(source, node.range[0]),
+                originalValue: source.slice(node.range[0], end),
+                range: [node.range[0], end],
+            });
+        }
+        const localFiles = await Promise.all(localReferences.map(async (reference) => resolveLocalReference(dir, reference)));
+        await Promise.all(localFiles.filter((local) => local != null).map(scanFile));
+    }
+}
+function findUsesScalars(node) {
+    if (!isMap(node))
+        return [];
+    const found = [];
+    const jobs = findMapValue(node, 'jobs');
+    if (isMap(jobs)) {
+        for (const job of jobs.items) {
+            if (!isMap(job.value))
+                continue;
+            const jobUses = findStringScalar(job.value, 'uses');
+            if (jobUses != null)
+                found.push(jobUses);
+            found.push(...findStepUses(findMapValue(job.value, 'steps')));
+        }
+    }
+    const runs = findMapValue(node, 'runs');
+    if (isMap(runs)) {
+        found.push(...findStepUses(findMapValue(runs, 'steps')));
+    }
+    return found;
+}
+function findStepUses(node) {
+    if (!isSeq(node))
+        return [];
+    return node.items.flatMap((item) => {
+        if (!isMap(item))
+            return [];
+        const uses = findStringScalar(item, 'uses');
+        return uses == null ? [] : [uses];
+    });
+}
+function findMapValue(node, key) {
+    if (!isMap(node))
+        return null;
+    const value = node.items.find((pair) => isScalar(pair.key) && pair.key.value === key)?.value;
+    return isNode(value) ? value : null;
+}
+function findStringScalar(node, key) {
+    const value = findMapValue(node, key);
+    return isScalar(value) && typeof value.value === 'string' ? value : null;
+}
+async function resolveLocalReference(rootDir, reference) {
+    const target = path.resolve(rootDir, reference);
+    const candidate = target.endsWith('.yml') || target.endsWith('.yaml')
+        ? await existingPath(target)
+        : (await Promise.all(['action.yml', 'action.yaml'].map(async (filename) => existingPath(path.join(target, filename)))))
+            .find((candidate) => candidate != null) ?? null;
+    if (candidate == null)
+        return null;
+    let realRoot;
+    let realCandidate;
+    try {
+        [realRoot, realCandidate] = await Promise.all([fs.realpath(rootDir), fs.realpath(candidate)]);
+    }
+    catch (err) {
+        throw workflowError('READ', candidate, err);
+    }
+    return isSubdir(realRoot, realCandidate) ? realCandidate : null;
+}
+async function existingPath(candidate) {
+    try {
+        await fs.access(candidate);
+        return candidate;
+    }
+    catch (err) {
+        if (!isErrorCode(err, 'ENOENT'))
+            throw workflowError('READ', candidate, err);
+        return null;
+    }
+}
+function parseActionReference(value) {
+    if (value.startsWith('docker://'))
+        return null;
+    const at = value.lastIndexOf('@');
+    if (at <= 0 || at === value.length - 1)
+        return null;
+    const name = value.slice(0, at);
+    const parts = name.split('/');
+    if (parts.length < 2 || parts[0] === '' || parts[1] === '')
+        return null;
+    return { name, ref: value.slice(at + 1), repo: `${parts[0]}/${parts[1]}` };
+}
+function parseRepoVersions(refs) {
+    const versions = [];
+    for (const [ref, commit] of Object.entries(refs)) {
+        const match = /^refs\/tags\/(v?\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?)$/.exec(ref);
+        if (match == null)
+            continue;
+        const version = semver.parse(match[1], { loose: true });
+        if (version == null)
+            continue;
+        versions.push({
+            commit: refs[`${ref}^{}`] ?? commit,
+            tag: match[1],
+            version,
+        });
+    }
+    return versions.sort((left, right) => semver.compare(left.version, right.version));
+}
+function findCurrentVersion(action, versions) {
+    if (SHA_PATTERN.test(action.ref) && action.commentVersion != null) {
+        const parsed = semver.parse(action.commentVersion, { loose: true });
+        if (parsed != null) {
+            const annotated = versions.find(({ commit, version }) => commit === action.ref && semver.eq(version, parsed));
+            if (annotated != null)
+                return annotated;
+        }
+    }
+    const parsed = semver.parse(action.ref, { loose: true });
+    if (parsed != null) {
+        return versions.find(({ version }) => semver.eq(version, parsed)) ?? null;
+    }
+    if (/^v?\d+$/.test(action.ref)) {
+        const major = Number(action.ref.replace(/^v/, ''));
+        return versions.filter(({ version }) => version.major === major && version.prerelease.length === 0).at(-1) ?? null;
+    }
+    if (SHA_PATTERN.test(action.ref)) {
+        return versions.filter(({ commit }) => commit === action.ref).at(-1) ?? null;
+    }
+    return null;
+}
+function getCommentVersion(node) {
+    const candidate = node.comment?.trimStart().split(/\s/, 1)[0];
+    return candidate != null && semver.valid(candidate, { loose: true }) != null ? candidate : undefined;
+}
+function renderTargetValue(action, target) {
+    const oldReference = `${action.name}@${action.ref}`;
+    const newReference = `${action.name}@${target.commit}`;
+    let value = action.originalValue.replace(oldReference, newReference);
+    if (action.commentVersion != null)
+        return value.replace(action.commentVersion, target.tag);
+    const comment = value.indexOf(' #');
+    if (comment === -1) {
+        return action.flowStyle
+            ? `${value.trimEnd()} # ${target.tag}\n${action.indentation}`
+            : `${value} # ${target.tag}`;
+    }
+    return `${value.slice(0, comment + 2)}${target.tag} ${value.slice(comment + 2).trimStart()}`;
+}
+function isFlowStyle(source, end) {
+    const lineEnd = source.indexOf('\n', end);
+    const following = source.slice(end, lineEnd === -1 ? source.length : lineEnd).trimStart();
+    return following.startsWith('}') || following.startsWith(']') || following.startsWith(',');
+}
+function getIndentation(source, start) {
+    const lineStart = source.lastIndexOf('\n', start - 1) + 1;
+    return ' '.repeat(start - lineStart);
+}
+function trimLineBreak(source, end) {
+    while (end > 0 && (source[end - 1] === '\n' || source[end - 1] === '\r'))
+        end--;
+    return end;
+}
+function dedupeOutdated(actions) {
+    return [...new Map(actions.map((action) => [action.name, action])).values()]
+        .sort((left, right) => left.name.localeCompare(right.name));
+}
+async function readRefsWithGit(repo) {
+    return getRepoRefs(`https://github.com/${repo}.git`, null);
+}
+function workflowError(operation, filePath, cause) {
+    const detail = util.types.isNativeError(cause) ? cause.message : String(cause);
+    return new PnpmError(`GITHUB_ACTIONS_WORKFLOW_${operation}`, `Failed to ${operation.toLowerCase()} GitHub Actions workflow ${filePath}: ${detail}`, { cause });
+}
+function isErrorCode(err, code) {
+    return util.types.isNativeError(err) && 'code' in err && err.code === code;
+}
+//# sourceMappingURL=index.js.map

package/package.json

@@ -0,0 +1,57 @@
+{
+  "name": "@pnpm/deps.github-actions",
+  "version": "1100.0.1",
+  "description": "Discover and update GitHub Actions dependencies",
+  "keywords": [
+    "pnpm",
+    "pnpm11",
+    "github-actions"
+  ],
+  "license": "MIT",
+  "funding": "https://opencollective.com/pnpm",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/pnpm/pnpm/tree/main/pnpm11/deps/github-actions"
+  },
+  "homepage": "https://github.com/pnpm/pnpm/tree/main/pnpm11/deps/github-actions#readme",
+  "bugs": {
+    "url": "https://github.com/pnpm/pnpm/issues"
+  },
+  "type": "module",
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "exports": {
+    ".": "./lib/index.js"
+  },
+  "files": [
+    "lib",
+    "!*.map"
+  ],
+  "dependencies": {
+    "@pnpm/error": "1100.0.1",
+    "@pnpm/resolving.git-resolver": "1100.1.11",
+    "is-subdir": "^2.0.0",
+    "p-limit": "^7.3.0",
+    "semver": "^7.8.4",
+    "write-file-atomic": "^7.0.1",
+    "yaml": "^2.9.0"
+  },
+  "devDependencies": {
+    "@jest/globals": "30.4.1",
+    "@pnpm/deps.github-actions": "1100.0.1",
+    "@types/semver": "7.7.1",
+    "@types/write-file-atomic": "^4.0.3"
+  },
+  "engines": {
+    "node": ">=22.13"
+  },
+  "jest": {
+    "preset": "@pnpm/jest-config"
+  },
+  "scripts": {
+    "lint": "eslint \"src/**/*.ts\" \"test/**/*.ts\"",
+    "test": "pn compile && pn .test",
+    "compile": "tsgo --build && pn lint --fix",
+    ".test": "cross-env NODE_OPTIONS=\"$NODE_OPTIONS --experimental-vm-modules --disable-warning=ExperimentalWarning --disable-warning=DEP0169\" jest"
+  }
+}