@pnpm/resolving.git-resolver 1100.1.10 → 1100.1.12

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # @pnpm/git-resolver
 
+## 1100.1.12
+
+### Patch Changes
+
+- Added a new setting, `update.githubActionsServer`, for specifying the base URL of the GitHub server that hosts the repositories of the GitHub Actions referenced by the workflow files (for example, a GitHub Enterprise Server). When the setting is not defined, the URL is read from the `GITHUB_SERVER_URL` environment variable, falling back to `https://github.com`. The URL must use the `https://` or `http://` protocol [#13220](https://github.com/pnpm/pnpm/issues/13220).
+
+  `pnpm outdated` and `pnpm update` no longer fail when the refs of a GitHub Action's repository cannot be read (for example, when the action's repository is private or hosted on a different GitHub server). Such actions are now skipped with a warning.
+
+  Setting `update.githubActions` to `false` now makes `pnpm outdated` and the interactive `pnpm update` skip GitHub Actions dependencies.
+
+- Republished every package: the tarballs published by the v11.13.1 through v11.16.0 releases were missing most of their compiled files due to a packing bug [#13164](https://github.com/pnpm/pnpm/issues/13164).
+
+- Updated dependencies:
+  - @pnpm/error@1100.1.0
+  - @pnpm/network.fetch@1100.1.8
+  - @pnpm/resolving.resolver-base@1100.5.4
+
+## 1100.1.11
+
+### Patch Changes
+
+- Added GitHub Actions dependencies to `pnpm outdated` and interactive `pnpm update`. Non-interactive updates can include them with `--include-github-actions` or by setting `update.githubActions` to `true` in `pnpm-workspace.yaml`. Updated actions are pinned to exact commit hashes with their release tags preserved in comments.
+
+- Updated dependencies:
+  - @pnpm/network.fetch@1100.1.7
+  - @pnpm/resolving.resolver-base@1100.5.3
+
 ## 1100.1.10
 
 ### Patch Changes

package/lib/createGitHostedPkgId.d.ts

@@ -0,0 +1,6 @@
+import type { PkgResolutionId } from '@pnpm/resolving.resolver-base';
+export declare function createGitHostedPkgId({ repo, commit, path }: {
+    repo: string;
+    commit: string;
+    path?: string;
+}): PkgResolutionId;

package/lib/createGitHostedPkgId.js

@@ -0,0 +1,21 @@
+export function createGitHostedPkgId({ repo, commit, path }) {
+    const normalizedRepo = normalizeGitRepoForPkgResolutionId(repo);
+    let id = `${normalizedRepo.includes('://') ? '' : 'https://'}${normalizedRepo}#${commit}`;
+    if (!id.startsWith('git+'))
+        id = `git+${id}`;
+    if (path) {
+        id += `&path:${path}`;
+    }
+    return id;
+}
+function normalizeGitRepoForPkgResolutionId(repo) {
+    // Only scp-style shorthand (`user@host:path`) needs rewriting. A repo that
+    // already carries a URL scheme (e.g. `ssh://user@host:2222/path`) is left
+    // alone — its `@host:port` would otherwise match the scp pattern and get
+    // mangled into `ssh://ssh://…`.
+    if (repo.includes('://'))
+        return repo;
+    const scp = /^([^@\s]+@[^:\s]+):(.+)$/.exec(repo);
+    return scp == null ? repo : `ssh://${scp[1]}/${scp[2]}`;
+}
+//# sourceMappingURL=createGitHostedPkgId.js.map

package/lib/index.d.ts

@@ -0,0 +1,17 @@
+import type { DispatcherOptions } from '@pnpm/network.fetch';
+import type { GitResolution, LatestInfo, LatestQuery, ResolveOptions, ResolveResult, TarballResolution } from '@pnpm/resolving.resolver-base';
+import { createGitHostedPkgId } from './createGitHostedPkgId.js';
+import { type HostedPackageSpec } from './parseBareSpecifier.js';
+export { createGitHostedPkgId };
+export type { HostedPackageSpec };
+export interface GitResolveResult extends ResolveResult {
+    normalizedBareSpecifier?: string;
+    resolution: GitResolution | TarballResolution;
+    resolvedVia: 'git-repository';
+}
+export type GitResolver = (wantedDependency: {
+    bareSpecifier: string;
+}, opts?: Pick<ResolveOptions, 'currentPkg' | 'update'>) => Promise<GitResolveResult | null>;
+export declare function createGitResolver(opts: DispatcherOptions): GitResolver;
+export declare function resolveLatestFromGit(query: LatestQuery): Promise<LatestInfo | undefined>;
+export declare function getRepoRefs(repo: string, ref: string | null): Promise<Record<string, string>>;

package/lib/index.js

@@ -89,8 +89,10 @@ export async function resolveLatestFromGit(query) {
 function resolveVTags(vTags, range) {
     return semver.maxSatisfying(vTags, range, true);
 }
-async function getRepoRefs(repo, ref) {
-    const gitArgs = [repo];
+export async function getRepoRefs(repo, ref) {
+    // `--` keeps a repo URL that starts with a dash (e.g. from a malicious
+    // config value) from being parsed as a git flag, matching the Rust runner.
+    const gitArgs = ['--', repo];
     if (ref) {
         gitArgs.push(ref);
         // Also request the peeled ref for annotated tags (e.g., refs/tags/v1.0.0^{})
@@ -102,7 +104,8 @@ async function getRepoRefs(repo, ref) {
     const refs = {};
     for (const line of result.stdout.split('\n')) {
         const [commit, refName] = line.split('\t');
-        refs[refName] = commit;
+        if (commit && refName)
+            refs[refName] = commit;
     }
     return refs;
 }

package/lib/parseBareSpecifier.d.ts

@@ -0,0 +1,16 @@
+import { type DispatcherOptions } from '@pnpm/network.fetch';
+export interface HostedPackageSpec {
+    fetchSpec: string;
+    hosted?: {
+        type: string;
+        user: string;
+        project: string;
+        committish: string;
+        tarball: () => string | undefined;
+    };
+    normalizedBareSpecifier: string;
+    gitCommittish: string | null;
+    gitRange?: string;
+    path?: string;
+}
+export declare function parseBareSpecifier(bareSpecifier: string, opts: DispatcherOptions): null | (() => Promise<HostedPackageSpec>);

package/lib/parseBareSpecifier.js

@@ -0,0 +1,177 @@
+// cspell:ignore sshurl
+import urlLib, { URL } from 'node:url';
+import { fetchWithDispatcher } from '@pnpm/network.fetch';
+import { gracefulGit as git } from 'graceful-git';
+import HostedGit from 'hosted-git-info';
+const gitProtocols = new Set([
+    'git',
+    'git+http',
+    'git+https',
+    'git+rsync',
+    'git+ftp',
+    'git+file',
+    'git+ssh',
+    'ssh',
+]);
+export function parseBareSpecifier(bareSpecifier, opts) {
+    const hosted = HostedGit.fromUrl(bareSpecifier);
+    if (hosted != null) {
+        return () => fromHostedGit(hosted, opts);
+    }
+    const colonsPos = bareSpecifier.indexOf(':');
+    if (colonsPos === -1)
+        return null;
+    const protocol = bareSpecifier.slice(0, colonsPos);
+    // Also detect http/https URLs ending in .git as git repositories
+    const isGitUrl = gitProtocols.has(protocol.toLocaleLowerCase()) ||
+        ((protocol === 'http' || protocol === 'https') && /\.git(?:#|$)/.test(bareSpecifier));
+    if (protocol && isGitUrl) {
+        const correctBareSpecifier = correctUrl(bareSpecifier);
+        const url = new URL(correctBareSpecifier);
+        if (!url?.protocol)
+            return null;
+        const hash = (url.hash?.length > 1) ? decodeURIComponent(url.hash.slice(1)) : null;
+        return async () => ({
+            fetchSpec: urlToFetchSpec(url),
+            normalizedBareSpecifier: bareSpecifier,
+            ...parseGitParams(hash),
+        });
+    }
+    return null;
+}
+function urlToFetchSpec(url) {
+    url.hash = '';
+    const fetchSpec = urlLib.format(url);
+    if (fetchSpec.startsWith('git+')) {
+        return fetchSpec.slice(4);
+    }
+    return fetchSpec;
+}
+async function fromHostedGit(hosted, dispatcherOptions) {
+    let fetchSpec = null;
+    // try git/https url before fallback to ssh url
+    const gitHttpsUrl = hosted.https({ noCommittish: true, noGitPlus: true });
+    if (gitHttpsUrl && await isRepoPublic(gitHttpsUrl, dispatcherOptions) && await accessRepository(gitHttpsUrl)) {
+        fetchSpec = gitHttpsUrl;
+    }
+    else {
+        const gitSshUrl = hosted.ssh({ noCommittish: true });
+        if (gitSshUrl && await accessRepository(gitSshUrl)) {
+            fetchSpec = gitSshUrl;
+        }
+    }
+    if (!fetchSpec) {
+        const httpsUrl = hosted.https({ noGitPlus: true, noCommittish: true });
+        if (httpsUrl) {
+            if ((hosted.auth || !await isRepoPublic(httpsUrl, dispatcherOptions)) && await accessRepository(httpsUrl)) {
+                return {
+                    fetchSpec: httpsUrl,
+                    hosted: {
+                        ...hosted,
+                        _fill: hosted._fill,
+                        tarball: undefined,
+                    },
+                    normalizedBareSpecifier: `git+${httpsUrl}`,
+                    ...parseGitParams(hosted.committish),
+                };
+            }
+            else {
+                try {
+                    // when git ls-remote private repo, it asks for login credentials.
+                    // use HTTP HEAD request to test whether this is a private repo, to avoid login prompt.
+                    // this is very similar to yarn classic's behavior.
+                    // npm instead tries git ls-remote directly which prompts user for login credentials.
+                    // HTTP HEAD on https://domain/user/repo, strip out ".git"
+                    const response = await fetchWithDispatcher(httpsUrl.replace(/\.git$/, ''), { method: 'HEAD', redirect: 'manual', retry: { retries: 0 }, dispatcherOptions });
+                    if (response.ok) {
+                        fetchSpec = httpsUrl;
+                    }
+                }
+                catch {
+                    // ignore
+                }
+            }
+        }
+    }
+    if (!fetchSpec) {
+        // use ssh url for likely private repo
+        fetchSpec = hosted.sshurl({ noCommittish: true });
+    }
+    return {
+        fetchSpec: fetchSpec,
+        hosted: {
+            ...hosted,
+            tarballtemplate: hosted.type === 'gitlab' ? gitlabTarballTemplate : hosted.tarballtemplate,
+            _fill: hosted._fill,
+            tarball: hosted.tarball,
+        },
+        normalizedBareSpecifier: hosted.shortcut(),
+        ...parseGitParams(hosted.committish),
+    };
+}
+// hosted-git-info's default GitLab tarball URL contains an encoded slash
+// (`%2F`) which survives into the virtual store directory name and makes
+// Node refuse to import the package (ERR_INVALID_MODULE_SPECIFIER).
+function gitlabTarballTemplate({ domain, user, project, committish }) {
+    const ref = committish ? encodeURIComponent(committish) : 'HEAD';
+    return `https://${domain}/${user}/${project}/-/archive/${ref}/${project}-${ref}.tar.gz`;
+}
+async function isRepoPublic(httpsUrl, dispatcherOptions) {
+    try {
+        const response = await fetchWithDispatcher(httpsUrl.replace(/\.git$/, ''), { method: 'HEAD', redirect: 'manual', retry: { retries: 0 }, dispatcherOptions });
+        return response.ok;
+    }
+    catch {
+        return false;
+    }
+}
+async function accessRepository(repository) {
+    try {
+        await git(['ls-remote', '--exit-code', repository, 'HEAD'], { retries: 0 });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function parseGitParams(committish) {
+    const result = { gitCommittish: null };
+    if (!committish) {
+        return result;
+    }
+    const params = committish.split('&');
+    for (const param of params) {
+        if (param.length >= 7 && param.slice(0, 7) === 'semver:') {
+            result.gitRange = param.slice(7);
+        }
+        else if (param.slice(0, 5) === 'path:') {
+            result.path = param.slice(5);
+        }
+        else {
+            result.gitCommittish = param;
+        }
+    }
+    return result;
+}
+// handle SCP-like URLs
+// see https://github.com/yarnpkg/yarn/blob/5682d55/src/util/git.js#L103
+function correctUrl(gitUrl) {
+    let _gitUrl = gitUrl.replace(/^git\+/, '');
+    if (_gitUrl.startsWith('ssh://')) {
+        const hashIndex = _gitUrl.indexOf('#');
+        let hash = '';
+        if (hashIndex !== -1) {
+            hash = _gitUrl.slice(hashIndex);
+            _gitUrl = _gitUrl.slice(0, hashIndex);
+        }
+        const [auth, ...pathname] = _gitUrl.slice(6).split('/');
+        const [, host] = auth.split('@');
+        if (host.includes(':') && !/:\d+$/.test(host)) {
+            const authArr = auth.split(':');
+            const protocol = gitUrl.split('://')[0];
+            gitUrl = `${protocol}://${authArr.slice(0, -1).join(':') + '/' + authArr[authArr.length - 1]}${pathname.length ? '/' + pathname.join('/') : ''}${hash}`;
+        }
+    }
+    return gitUrl;
+}
+//# sourceMappingURL=parseBareSpecifier.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/resolving.git-resolver",
-  "version": "1100.1.10",
+  "version": "1100.1.12",
   "description": "Resolver for git-hosted packages",
   "keywords": [
     "pnpm",
@@ -29,16 +29,16 @@
     "!*.map"
   ],
   "dependencies": {
-    "@pnpm/error": "1100.0.1",
-    "@pnpm/network.fetch": "1100.1.6",
-    "@pnpm/resolving.resolver-base": "1100.5.2",
+    "@pnpm/error": "1100.1.0",
+    "@pnpm/network.fetch": "1100.1.8",
+    "@pnpm/resolving.resolver-base": "1100.5.4",
     "graceful-git": "^5.0.0",
     "hosted-git-info": "npm:@pnpm/hosted-git-info@1.0.0",
     "semver": "^7.8.4"
   },
   "devDependencies": {
     "@jest/globals": "30.4.1",
-    "@pnpm/resolving.git-resolver": "1100.1.10",
+    "@pnpm/resolving.git-resolver": "1100.1.12",
     "@types/hosted-git-info": "^3.0.5",
     "@types/is-windows": "^1.0.2",
     "@types/semver": "7.7.1",