@ronaldphilipsen/local-action 0.0.0-stage → 7.0.1

package/.grype.yml

@@ -0,0 +1,151 @@
+# enable/disable checking for application updates on startup
+# same as GRYPE_CHECK_FOR_APP_UPDATE env var
+# check-for-app-update: true
+
+# allows users to specify which image source should be used to generate the sbom
+# valid values are: registry, docker, podman
+# same as GRYPE_DEFAULT_IMAGE_PULL_SOURCE env var
+# default-image-pull-source: ""
+
+# same as --name; set the name of the target being analyzed
+# name: ""
+
+# upon scanning, if a severity is found at or above the given severity then the return code will be 1
+# default is unset which will skip this validation (options: negligible, low, medium, high, critical)
+# same as --fail-on ; GRYPE_FAIL_ON_SEVERITY env var
+fail-on-severity: high
+
+# the output format of the vulnerability report (options: table, json, cyclonedx)
+# same as -o ; GRYPE_OUTPUT env var
+# output: "table"
+
+# suppress all output (except for the vulnerability list)
+# same as -q ; GRYPE_QUIET env var
+quiet: true
+
+# write output report to a file (default is to write to stdout)
+# same as --file; GRYPE_FILE env var
+# file: ""
+
+# a list of globs to exclude from scanning, for example:
+exclude:
+  - '**/__fixtures__'
+  - '**/.git'
+  - '**/megalinter-reports'
+# same as --exclude ; GRYPE_EXCLUDE env var
+# exclude: []
+
+# os and/or architecture to use when referencing container images (e.g. "windows/armv6" or "arm64")
+# same as --platform; GRYPE_PLATFORM env var
+# platform: ""
+
+# If using SBOM input, automatically generate CPEs when packages have none
+# add-cpes-if-none: false
+
+# Explicitly specify a linux distribution to use as <distro>:<version> like alpine:3.10
+# distro:
+
+# external-sources:
+#   enable: false
+#   maven:
+#     search-upstream-by-sha1: true
+#     base-url: https://search.maven.org/solrsearch/select
+
+# db:
+# check for database updates on execution
+# same as GRYPE_DB_AUTO_UPDATE env var
+# auto-update: true
+
+# location to write the vulnerability database cache
+# same as GRYPE_DB_CACHE_DIR env var
+# cache-dir: "$XDG_CACHE_HOME/grype/db"
+
+# URL of the vulnerability database
+# same as GRYPE_DB_UPDATE_URL env var
+# update-url: "https://toolbox-data.anchore.io/grype/databases/listing.json"
+
+# it ensures db build is no older than the max-allowed-built-age
+# set to false to disable check
+# validate-age: true
+
+# Max allowed age for vulnerability database,
+# age being the time since it was built
+# Default max age is 120h (or five days)
+# max-allowed-built-age: "120h"
+
+# search:
+# the search space to look for packages (options: all-layers, squashed)
+# same as -s ; GRYPE_SEARCH_SCOPE env var
+# scope: "squashed"
+
+# search within archives that do contain a file index to search against (zip)
+# note: for now this only applies to the java package cataloger
+# same as GRYPE_PACKAGE_SEARCH_INDEXED_ARCHIVES env var
+# indexed-archives: true
+
+# search within archives that do not contain a file index to search against (tar, tar.gz, tar.bz2, etc)
+# note: enabling this may result in a performance impact since all discovered compressed tars will be decompressed
+# note: for now this only applies to the java package cataloger
+# same as GRYPE_PACKAGE_SEARCH_UNINDEXED_ARCHIVES env var
+# unindexed-archives: false
+
+# options when pulling directly from a registry via the "registry:" scheme
+# registry:
+# skip TLS verification when communicating with the registry
+# same as GRYPE_REGISTRY_INSECURE_SKIP_TLS_VERIFY env var
+# insecure-skip-tls-verify: false
+# use http instead of https when connecting to the registry
+# same as GRYPE_REGISTRY_INSECURE_USE_HTTP env var
+# insecure-use-http: false
+
+# credentials for specific registries
+# auth:
+# - # the URL to the registry (e.g. "docker.io", "localhost:5000", etc.)
+# same as GRYPE_REGISTRY_AUTH_AUTHORITY env var
+# authority: ""
+# same as GRYPE_REGISTRY_AUTH_USERNAME env var
+# username: ""
+# same as GRYPE_REGISTRY_AUTH_PASSWORD env var
+# password: ""
+# note: token and username/password are mutually exclusive
+# same as GRYPE_REGISTRY_AUTH_TOKEN env var
+# token: ""
+# - ... # note, more credentials can be provided via config file only
+
+# log:
+# use structured logging
+# same as GRYPE_LOG_STRUCTURED env var
+# structured: false
+
+# the log level; note: detailed logging suppress the ETUI
+# same as GRYPE_LOG_LEVEL env var
+# Uses logrus logging levels: https://github.com/sirupsen/logrus#level-logging
+# level: "error"
+
+# location to write the log file (default is not to have a log file)
+# same as GRYPE_LOG_FILE env var
+# file: ""
+
+# match:
+# sets the matchers below to use cpes when trying to find
+# vulnerability matches. The stock matcher is the default
+# when no primary matcher can be identified
+# java:
+#   using-cpes: true
+# python:
+#   using-cpes: true
+# javascript:
+#   using-cpes: true
+# ruby:
+#   using-cpes: true
+# dotnet:
+#   using-cpes: true
+# golang:
+#   using-cpes: true
+# stock:
+#   using-cpes: true
+
+ignore:
+  - package:
+      name: stdlib
+      type: go-module

package/.markdown-lint.yml

@@ -0,0 +1,7 @@
+# Unordered list style
+MD004:
+  style: dash
+
+# Ordered list item prefix
+MD029:
+  style: one

package/.mega-linter.yml

@@ -0,0 +1,188 @@
+# Mega-Linter Configuration File
+# https://megalinter.io/latest/config-file/
+
+# Activates formatting and autofix
+APPLY_FIXES: none
+
+# Flag to clear files from report folder before starting the linting process
+CLEAR_REPORT_FOLDER: true
+
+# List of disabled descriptors keys
+# https://megalinter.io/latest/config-activation/
+DISABLE:
+  - COPYPASTE
+  - SPELL
+  - SNAKEMAKE
+
+# Flag to have the linter complete with exit code 0 even if errors were detected
+DISABLE_ERRORS: false
+
+# List of disabled linters keys
+# https://megalinter.io/latest/config-activation/
+DISABLE_LINTERS:
+  - JAVASCRIPT_STANDARD
+  - JSON_JSONLINT
+  - JSON_V8R
+  - MARKDOWN_MARKDOWN_LINK_CHECK
+  - MARKDOWN_MARKDOWN_TABLE_FORMATTER
+  - REPOSITORY_KICS
+  - REPOSITORY_SEMGREP
+  - TYPESCRIPT_STANDARD
+  - YAML_V8R
+
+# List of enabled but not blocking linters keys
+# https://megalinter.io/latest/config-activation/
+# DISABLE_ERRORS_LINTERS: []
+
+# List of enabled descriptors keys
+# https://megalinter.io/latest/config-activation/
+# If you use ENABLE variable, all other linters will be disabled by default
+# ENABLE: []
+
+# List of enabled linters keys
+# If you use ENABLE_LINTERS variable, all other linters will be disabled
+# ENABLE_LINTERS: []
+
+# List of excluded directory basenames.
+EXCLUDED_DIRECTORIES:
+  - .git
+  - coverage
+  - dist
+  - megalinter-reports
+  - node_modules
+  - reports
+
+# If set to true, MegaLinter fails if a linter is missing in the selected flavor
+FAIL_IF_MISSING_LINTER_IN_FLAVOR: false
+
+# If set to true, MegaLinter fails if a linter or formatter has autofixed
+# sources, even if there are no errors
+FAIL_IF_UPDATED_SOURCES: false
+
+# Upload reports to file.io
+FILEIO_REPORTER: false
+
+# Regular expression defining which files will be excluded from linting
+# E.g.: `.*src/test.*`
+# FILTER_REGEX_EXCLUDE: .*src/test.*
+
+# Regular expression defining which files will be processed by linters
+# E.g.: `.*src/.*`
+# FILTER_REGEX_INCLUDE: .*src/.*
+
+# Provides suggestions about different MegaLinter flavors to use to improve
+# runtime performance
+FLAVOR_SUGGESTIONS: false
+
+# Formatter errors will be reported as errors (and not warnings) if this
+# variable is set to false
+FORMATTERS_DISABLE_ERRORS: false
+
+# If set, calls git with Authorization: Bearer+value
+# GIT_AUTHORIZATION_BEARER:
+
+# URL where the github API can be reached
+# Must be overridden if using GitHub Enterprise
+# GITHUB_API_URL: https://api.github.com
+
+# Posts a comment on the pull request with linting results
+GITHUB_COMMENT_REPORTER: true
+
+# URL of the GitHub instance
+# Must be overridden if using GitHub Enterprise Server
+# GITHUB_SERVER_URL: https://github.com
+
+# Sets pull request status checks on GitHub
+GITHUB_STATUS_REPORTER: true
+
+# Base directory for REPORT_OUTPUT_FOLDER, for user-defined linter rules
+# location, for location of linted files if DEFAULT_WORKSPACE isn't set
+# GITHUB_WORKSPACE:
+
+# If set to true, MegaLinter will skip files containing @generated marker but
+# without @not-generated marker (more info at https://generated.at)
+IGNORE_GENERATED_FILES: true
+
+# If set to true, MegaLinter will skip files ignored by git using .gitignore
+IGNORE_GITIGNORED_FILES: true
+
+# JavaScript default style to check/apply
+JAVASCRIPT_DEFAULT_STYLE: prettier
+
+# Directory for all linter configuration rules
+# Can be a local folder or a remote URL
+# (ex: https://raw.githubusercontent.com/some_org/some_repo/mega-linter-rules)
+# LINTER_RULES_PATH:
+
+# How much output the script will generate to the console. One of INFO, DEBUG,
+# WARNING or ERROR.
+LOG_LEVEL: INFO
+
+# Markdown default style to check/apply
+MARKDOWN_DEFAULT_STYLE: markdownlint
+
+# Generate Markdown summary report
+MARKDOWN_SUMMARY_REPORTER: true
+
+# Name of the Markdown summary report file
+MARKDOWN_SUMMARY_REPORTER_FILE_NAME: summary.md
+
+# Comma-separated list of files to analyze. Using this variable will bypass
+# other file listing methods
+# MEGALINTER_FILES_TO_LINT: []
+
+# Process linters in parallel to improve overall MegaLinter performance. If
+# true, linters of same language or formats are grouped in the same parallel
+# process to avoid lock issues if fixing the same files
+PARALLEL: true
+
+# All available cores are used by default. If there are too many, you need to
+# decrease the number of used cores in order to enhance performance
+# PARALLEL_PROCESS_NUMBER: 4
+
+# List of plugin urls to install and run during MegaLinter run
+# PLUGINS: []
+
+# Custom bash commands to run after linters
+# POST_COMMANDS:
+#   - command: echo "This is MegaLinter POST_COMMAND on own MegaLinter ! :)"
+#     cwd: "workspace"
+
+# Custom bash commands to run before linters
+PRE_COMMANDS:
+  - command: |
+      npm -g install \
+        prettier
+    cwd: workspace
+
+# Enable printing alpaca image to console
+PRINT_ALPACA: true
+
+# Display all files analyzed by the linter instead of only the number
+PRINT_ALL_FILES: false
+
+# Set to simple to avoid external images in generated markdown
+REPORTERS_MARKDOWN_TYPE: advanced
+
+REPOSITORY_GRYPE_CONFIG_FILE: .grype.yml
+
+# Additional list of secured environment variables to hide when calling linters.
+# SECURED_ENV_VARIABLES: []
+
+# Displays elapsed time in reports
+SHOW_ELAPSED_TIME: true
+
+# Displays all disabled linters mega-linter could have run
+SHOW_SKIPPED_LINTERS: false
+
+# Comma-separated list of cli_lint_modes
+# Use if you want to skip linters with some CLI lint modes (ex: file,project)
+# Available values: file, cli_lint_mode, project
+# SKIP_CLI_LINT_MODES: []
+
+# Typescript default style to check/apply
+TYPESCRIPT_DEFAULT_STYLE: prettier
+
+# Will parse the entire repository and find all files to validate
+# When set to false, only new or edited files will be parsed for validation
+VALIDATE_ALL_CODEBASE: true

package/.node-version

@@ -0,0 +1 @@
+26.12.1

package/.prettierignore

@@ -0,0 +1,4 @@
+coverage/
+dist/
+node_modules/
+reports/

package/.prettierrc.yml

@@ -0,0 +1,14 @@
+arrowParens: avoid
+bracketSameLine: true
+bracketSpacing: true
+endOfLine: lf
+htmlWhitespaceSensitivity: css
+jsxSingleQuote: false
+printWidth: 80
+proseWrap: always
+quoteProps: as-needed
+semi: false
+singleQuote: true
+tabWidth: 2
+trailingComma: none
+useTabs: false

package/.vscode/launch.json

@@ -0,0 +1,15 @@
+{
+  "version": "0.2.0",
+  "configurations": [
+    {
+      "name": "Debug Local Action",
+      "type": "node",
+      "request": "launch",
+      "runtimeExecutable": "local-action",
+      "cwd": "${workspaceRoot}",
+      "args": [".", "src/main.ts", ".env"],
+      "console": "integratedTerminal",
+      "skipFiles": ["<node_internals>/**", "node_modules/**"]
+    }
+  ]
+}

package/.vscode/mcp.json

@@ -0,0 +1,9 @@
+{
+  "servers": {
+    "github": {
+      "url": "https://api.githubcopilot.com/mcp/",
+      "type": "http"
+    }
+  },
+  "inputs": []
+}

package/.vscode/settings.json

@@ -0,0 +1,15 @@
+{
+  "github.copilot.chat.reviewSelection.instructions": [
+    {
+      "text": "Review the code changes carefully before accepting them."
+    }
+  ],
+  "github.copilot.chat.commitMessageGeneration.instructions": [
+    {
+      "text": "Use conventional commit message format."
+    }
+  ],
+  "github.copilot.chat.pullRequestDescriptionGeneration.instructions": [
+    { "text": "Always include a list of key changes." }
+  ]
+}

package/.vscode/tasks.json

@@ -0,0 +1,51 @@
+{
+  "version": "2.0.0",
+  "tasks": [
+    {
+      "label": "Workspace: Lint",
+      "type": "shell",
+      "group": "test",
+      "command": "npx mega-linter-runner --flavor cupcake",
+      "options": {
+        "cwd": "${workspaceFolder}"
+      },
+      "problemMatcher": []
+    },
+    {
+      "label": "npm: Test",
+      "type": "shell",
+      "group": "test",
+      "command": "npm test",
+      "options": {
+        "cwd": "${workspaceFolder}"
+      }
+    },
+    {
+      "label": "npm: Lint",
+      "type": "shell",
+      "group": "test",
+      "command": "npm run lint",
+      "options": {
+        "cwd": "${workspaceFolder}"
+      }
+    },
+    {
+      "label": "npm: Format (Check)",
+      "group": "test",
+      "type": "shell",
+      "command": "npm run format:check",
+      "options": {
+        "cwd": "${workspaceFolder}"
+      }
+    },
+    {
+      "label": "npm: Format (Write)",
+      "group": "test",
+      "type": "shell",
+      "command": "npm run format:write",
+      "options": {
+        "cwd": "${workspaceFolder}"
+      }
+    }
+  ]
+}

package/.yaml-lint.yml

@@ -0,0 +1,10 @@
+rules:
+  document-end: disable
+  document-start:
+    level: warning
+    present: false
+  line-length:
+    level: warning
+    max: 80
+    allow-non-breakable-words: true
+    allow-non-breakable-inline-mappings: true

package/CHANGELOG.md

@@ -0,0 +1,75 @@
+# Changelog
+
+## v7
+
+Update support for each of the following packages to the latest versions:
+
+- [`@actions/artifact`](https://www.npmjs.com/package/@actions/artifact):
+  `5.0.2`
+- [`@actions/cache`](https://www.npmjs.com/package/@actions/cache): `5.0.3`
+- [`@actions/core`](https://www.npmjs.com/package/@actions/core): `2.0.2`
+- [`@actions/github`](https://www.npmjs.com/package/@actions/github): `7.0.0`
+
+## v6
+
+Adds support for the `@actions/cache` package, allowing for local caching of
+dependencies and other files between runs of a GitHub Action. This is achieved
+by setting the `LOCAL_ACTION_CACHE_PATH` environment variable to a directory
+where cache files will be stored.
+
+For both `@actions/artifact` and `@actions/cache`, the `LOCAL_ACTION_WORKSPACE`
+environment variable must be set. Otherwise, calling functions will throw an
+error. Similarly, `@actions/artifact` requires the `LOCAL_ACTION_ARTIFACT_PATH`
+environment variable to be set, and `@actions/cache` requires the
+`LOCAL_ACTION_CACHE_PATH` environment variable to be set.
+
+## v5
+
+Removes support for custom `paths` in the target action's `tsconfig.json`. This
+appears to have been causing issues with type-stripping and later versions of
+Node.js.
+
+## v4
+
+This version adds support for
+[`pre`](https://docs.github.com/en/actions/reference/metadata-syntax-for-github-actions#runspre)
+and
+[`post`](https://docs.github.com/en/actions/reference/metadata-syntax-for-github-actions#runspost)
+scripts for actions. These should follow the same structure as the `run` action
+code (see the
+[`README.md`](https://github.com/github/local-action#action-structure) for more
+details).
+
+## v3
+
+This version adds **experimental** support for [pnpm](https://pnpm.io/) and
+[yarn](https://yarnpkg.com/).
+
+Depending on the package manager and version, the invocation of the `tsx`
+command that drives `@github/local-action` is invoked differently.
+
+| Package Manager | Version | Command     |
+| --------------- | ------- | ----------- |
+| `npm`           | Any     | `npm exec`  |
+| `pnpm`          | Any     | `pnpm dlx`  |
+| `yarn`          | `<= 3`  | `yarn exec` |
+| `yarn`          | `>= 4`  | `yarn dlx`  |
+
+Alongside this, yarn PnP support is implemented via
+[unplugging](https://yarnpkg.com/cli/unplug) any modules stubbed by
+`@github/local-action` and "re-plugging" after completion of the action run.
+
+This support is still a work in progress. Any feedback or issues are welcome!
+
+## v2
+
+As of version `2.0.0`, the `local-action` tool has been updated to require
+**Node.js v20.6.0** or higher. This is necessary to support ESM loaders to
+override dependencies in the GitHub Actions Toolkit.
+
+## v1
+
+With the release of `v1.0.0`, there was a need to switch from
+[`ts-node`](https://www.npmjs.com/package/ts-node) to
+[`tsx`](https://www.npmjs.com/package/tsx). However, the bundled version of
+`tsx` is being used, so you should no longer need to install either :grinning:

package/CODEOWNERS

@@ -0,0 +1,3 @@
+# Repository CODEOWNERS
+
+* @ncalteen

package/CODE_OF_CONDUCT.md

@@ -0,0 +1,74 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+In the interest of fostering an open and welcoming environment, we as
+contributors and maintainers pledge to making participation in our project and
+our community a harassment-free experience for everyone, regardless of age, body
+size, disability, ethnicity, gender identity and expression, level of
+experience, nationality, personal appearance, race, religion, or sexual identity
+and orientation.
+
+## Our Standards
+
+Examples of behavior that contributes to creating a positive environment
+include:
+
+- Using welcoming and inclusive language
+- Being respectful of differing viewpoints and experiences
+- Gracefully accepting constructive criticism
+- Focusing on what is best for the community
+- Showing empathy towards other community members
+
+Examples of unacceptable behavior by participants include:
+
+- The use of sexualized language or imagery and unwelcome sexual attention or
+  advances
+- Trolling, insulting/derogatory comments, and personal or political attacks
+- Public or private harassment
+- Publishing others' private information, such as a physical or electronic
+  address, without explicit permission
+- Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Our Responsibilities
+
+Project maintainers are responsible for clarifying the standards of acceptable
+behavior and are expected to take appropriate and fair corrective action in
+response to any instances of unacceptable behavior.
+
+Project maintainers have the right and responsibility to remove, edit, or reject
+comments, commits, code, wiki edits, issues, and other contributions that are
+not aligned to this Code of Conduct, or to ban temporarily or permanently any
+contributor for other behaviors that they deem inappropriate, threatening,
+offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies both within project spaces and in public spaces
+when an individual is representing the project or its community. Examples of
+representing a project or community include using an official project e-mail
+address, posting via an official social media account, or acting as an appointed
+representative at an online or offline event. Representation of a project may be
+further defined and clarified by project maintainers.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported by contacting the project team at
+[opensource@github.com](mailto:opensource@github.com). All complaints will be
+reviewed and investigated and will result in a response that is deemed necessary
+and appropriate to the circumstances. The project team is obligated to maintain
+confidentiality with regard to the reporter of an incident. Further details of
+specific enforcement policies may be posted separately.
+
+Project maintainers who do not follow or enforce the Code of Conduct in good
+faith may face temporary or permanent repercussions as determined by other
+members of the project's leadership.
+
+## Attribution
+
+This Code of Conduct is adapted from the
+[Contributor Covenant](http://contributor-covenant.org), version 1.4, available
+at
+[http://contributor-covenant.org/version/1/4](http://contributor-covenant.org/version/1/4/).