@ronaldphilipsen/local-action 7.1.0 → 7.2.1

package/.env.example

@@ -4,16 +4,16 @@
 ################################################################################
 
 ################################################################################
-#                        @github/local-action Variables                        #
+#                        @ronaldphilipsen/local-action Variables                        #
 ################################################################################
 
-# Environment variables specific to the @github/local-action tool.
+# Environment variables specific to the @ronaldphilipsen/local-action tool.
 
 ######################################################################
-# The path to a workspace that can be used by `@github/local-action` #
+# The path to a workspace that can be used by `@ronaldphilipsen/local-action` #
 # during local testing. This will be used as the root directory for  #
 # any files created by your action, as well as any environment files #
-# that are created automatically by `@github/local-action`. If you   #
+# that are created automatically by `@ronaldphilipsen/local-action`. If you   #
 # try to interact with the `@actions/artifact` or `@actions/cache`   #
 # packages, this tool will throw an error if this is not set to a    #
 # valid path.                                                        #
@@ -347,7 +347,7 @@ RUNNER_NAME="Local Action"
 # to set environment variables, outputs, and other information. These files    #
 # are created and managed by GitHub Actions.                                   #
 #                                                                              #
-# Currently these are not used by `@github/local-action`.                      #
+# Currently these are not used by `@ronaldphilipsen/local-action`.                      #
 ################################################################################
 
 ######################################################################

package/.github/workflows/codeql-analysis.yml

@@ -34,11 +34,11 @@ jobs:
     steps:
       - name: Checkout
         id: checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Initialize CodeQL
         id: initialize
-        uses: github/codeql-action/init@v4
+        uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4
         with:
           languages: ${{ matrix.language }}
           source-root: src
@@ -46,8 +46,8 @@ jobs:
 
       - name: Autobuild
         id: autobuild
-        uses: github/codeql-action/autobuild@v4
+        uses: github/codeql-action/autobuild@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4
 
       - name: Perform CodeQL Analysis
         id: analyze
-        uses: github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4

package/.github/workflows/continuous-integration.yml

@@ -8,9 +8,7 @@ on:
 
 permissions:
   actions: read
-  checks: write
   contents: read
-  statuses: write
 
 jobs:
   continuous-integration:
@@ -24,11 +22,11 @@ jobs:
     steps:
       - name: Checkout
         id: checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Setup Node.js
         id: setup-node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version-file: .node-version
           cache: npm
@@ -60,28 +58,28 @@ jobs:
     runs-on: ${{ matrix.os }}
 
     steps:
-      - name: Checkout @github/local-action
+      - name: Checkout @ronaldphilipsen/local-action
         id: checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           path: local-action
 
       - name: Checkout TypeScript Template
         id: checkout-typescript
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           path: typescript-action
-          repository: actions/typescript-action
+          repository: RonaldPhilipsen/typescript-action
 
       - name: Setup Node.js
         id: setup-node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version-file: local-action/.node-version
           cache: npm
           cache-dependency-path: local-action/package-lock.json
 
-      - name: Install @github/local-action Dependencies
+      - name: Install @ronaldphilipsen/local-action Dependencies
         id: install
         run: npm ci
         working-directory: local-action
@@ -90,10 +88,10 @@ jobs:
         id: install-typescript
         run: |
           npm ci
-          npm uninstall @github/local-action
+          npm uninstall @ronaldphilipsen/local-action
         working-directory: typescript-action
 
-      - name: Link @github/local-action
+      - name: Link @ronaldphilipsen/local-action
         id: link
         run: npm link
         working-directory: local-action
@@ -121,28 +119,28 @@ jobs:
     runs-on: ${{ matrix.os }}
 
     steps:
-      - name: Checkout @github/local-action
+      - name: Checkout @ronaldphilipsen/local-action
         id: checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           path: local-action
 
       - name: Checkout JavaScript Template
         id: checkout-javascript
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           path: javascript-action
-          repository: actions/javascript-action
+          repository: RonaldPhilipsen/javascript-action
 
       - name: Setup Node.js
         id: setup-node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version-file: local-action/.node-version
           cache: npm
           cache-dependency-path: local-action/package-lock.json
 
-      - name: Install @github/local-action Dependencies
+      - name: Install @ronaldphilipsen/local-action Dependencies
         id: install
         run: npm ci
         working-directory: local-action
@@ -151,10 +149,10 @@ jobs:
         id: install-javascript
         run: |
           npm ci
-          npm uninstall @github/local-action
+          npm uninstall @ronaldphilipsen/local-action
         working-directory: javascript-action
 
-      - name: Link @github/local-action
+      - name: Link @ronaldphilipsen/local-action
         id: link
         run: npm link
         working-directory: local-action
@@ -182,34 +180,34 @@ jobs:
     runs-on: ${{ matrix.os }}
 
     steps:
-      - name: Checkout @github/local-action
+      - name: Checkout @ronaldphilipsen/local-action
         id: checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           path: local-action
 
       - name: Checkout TypeScript Template
         id: checkout-typescript
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           path: typescript-pnpm-esm-action
-          repository: ncalteen/typescript-pnpm-esm-action
+          repository: RonaldPhilipsen/typescript-pnpm-esm-action
 
       - name: Install pnpm
         id: pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
         with:
           version: latest
 
       - name: Setup Node.js
         id: setup-node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version-file: local-action/.node-version
           cache: npm
           cache-dependency-path: local-action/package-lock.json
 
-      - name: Install @github/local-action Dependencies
+      - name: Install @ronaldphilipsen/local-action Dependencies
         id: install
         run: npm ci
         working-directory: local-action
@@ -218,7 +216,7 @@ jobs:
         id: install-typescript
         run: |
           pnpm install
-          pnpm uninstall @github/local-action
+          pnpm uninstall @ronaldphilipsen/local-action
         working-directory: typescript-pnpm-esm-action
 
       - name: Create Global Link
@@ -254,34 +252,34 @@ jobs:
     runs-on: ${{ matrix.os }}
 
     steps:
-      - name: Checkout @github/local-action
+      - name: Checkout @ronaldphilipsen/local-action
         id: checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           path: local-action
 
       - name: Checkout TypeScript Template
         id: checkout-typescript
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           path: typescript-pnpm-cjs-action
-          repository: ncalteen/typescript-pnpm-cjs-action
+          repository: RonaldPhilipsen/typescript-pnpm-cjs-action
 
       - name: Install pnpm
         id: pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
         with:
           version: latest
 
       - name: Setup Node.js
         id: setup-node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version-file: local-action/.node-version
           cache: npm
           cache-dependency-path: local-action/package-lock.json
 
-      - name: Install @github/local-action Dependencies
+      - name: Install @ronaldphilipsen/local-action Dependencies
         id: install
         run: npm ci
         working-directory: local-action
@@ -290,7 +288,7 @@ jobs:
         id: install-typescript
         run: |
           pnpm install
-          pnpm uninstall @github/local-action
+          pnpm uninstall @ronaldphilipsen/local-action
         working-directory: typescript-pnpm-cjs-action
 
       - name: Create Global Link
@@ -325,28 +323,28 @@ jobs:
         working-directory: local-action
 
     steps:
-      - name: Checkout @github/local-action
+      - name: Checkout @ronaldphilipsen/local-action
         id: checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           path: local-action
 
       - name: Checkout TypeScript Template
         id: checkout-typescript
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           path: typescript-yarn-esm-action
-          repository: ncalteen/typescript-yarn-esm-action
+          repository: RonaldPhilipsen/typescript-yarn-esm-action
 
       - name: Setup Node.js
         id: setup-node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version-file: local-action/.node-version
           cache: npm
           cache-dependency-path: local-action/package-lock.json
 
-      - name: Install @github/local-action Dependencies
+      - name: Install @ronaldphilipsen/local-action Dependencies
         id: install
         run: npm ci
         working-directory: local-action

package/.github/workflows/linter.yml

@@ -24,13 +24,13 @@ jobs:
     steps:
       - name: Checkout
         id: checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
 
       - name: Setup Node.js
         id: setup-node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version-file: .node-version
           cache: npm
@@ -44,4 +44,4 @@ jobs:
         env:
           DEFAULT_WORKSPACE: ${{ github.workspace }}
           GITHUB_TOKEN: ${{ github.token }}
-        uses: oxsecurity/megalinter/flavors/cupcake@v9
+        uses: oxsecurity/megalinter/flavors/cupcake@f2fe8c1cba37091848df3e524066c8c23ef353ed # v10

package/.github/workflows/release.yaml

@@ -54,7 +54,7 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
       - name: Install Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         timeout-minutes: 5
         with:
           node-version: '26'
@@ -63,18 +63,32 @@ jobs:
         run: |
           npm version "$VERSION" --no-git-tag-version
       - name: npm publish
-        run: npm publish
-      - name: publish to GitHub Packages
+        run: |
+          npm publish || {
+            echo "npm publish failed; checking if the version already exists..."
+            if npm view "@ronaldphilipsen/local-action@$VERSION" version --registry https://registry.npmjs.org; then
+              echo "$VERSION is already published; skipping"
+            else
+              exit 1
+            fi
+          }
+      - name: Install Node.js (GitHub Packages)
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
+        timeout-minutes: 5
         env:
           NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: npm publish --registry https://npm.pkg.github.com
+        with:
+          node-version: '26'
+          registry-url: 'https://npm.pkg.github.com'
+      - name: publish to GitHub Packages
+        run: npm publish
       - name: Commit version bump
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
           git config user.name 'github-actions[bot]'
           git config user.email 'github-actions[bot]@users.noreply.github.com'
-          git remote set-url origin https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git
+          git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${{ github.repository }}.git"
           git switch -c "release-$VERSION"
           git add package.json package-lock.json
           git commit -m "chore: bump version to $VERSION"
@@ -92,7 +106,7 @@ jobs:
           gh release create "$TAG" \
             --title "$TAG" \
             --notes "$RELEASE_NOTES" \
-            $( [[ "$PRERELEASE" == 'true' ]] && echo '--prerelease' || echo '' )
+            "$( [[ "$PRERELEASE" == 'true' ]] && echo '--prerelease' || echo '' )"
       - name: clean up branch
         if: always()
         run: |

package/.mega-linter.yml

@@ -1,6 +1,11 @@
 # Mega-Linter Configuration File
 # https://megalinter.io/latest/config-file/
 
+# Allow zizmor to authenticate with GITHUB_TOKEN so it can resolve
+# external action refs (ref-confusion audit)
+ACTION_ZIZMOR_UNSECURED_ENV_VARIABLES:
+  - GITHUB_TOKEN
+
 # Activates formatting and autofix
 APPLY_FIXES: none
 
@@ -26,6 +31,8 @@ DISABLE_LINTERS:
   - MARKDOWN_MARKDOWN_LINK_CHECK
   - MARKDOWN_MARKDOWN_TABLE_FORMATTER
   - REPOSITORY_KICS
+  # Redundant with grype/trivy and has no severity gating
+  - REPOSITORY_OSV_SCANNER
   - REPOSITORY_SEMGREP
   - TYPESCRIPT_STANDARD
   - YAML_V8R
@@ -45,6 +52,8 @@ DISABLE_LINTERS:
 
 # List of excluded directory basenames.
 EXCLUDED_DIRECTORIES:
+  # Intentionally broken test data, not lintable source
+  - __fixtures__
   - .git
   - coverage
   - dist
@@ -52,6 +61,11 @@ EXCLUDED_DIRECTORIES:
   - node_modules
   - reports
 
+# List of excluded file paths. bin/local-action.js is excluded from the
+# repo's own eslint project and cannot be type-aware linted.
+EXCLUDED_FILES:
+  - bin/local-action.js
+
 # If set to true, MegaLinter fails if a linter is missing in the selected flavor
 FAIL_IF_MISSING_LINTER_IN_FLAVOR: false
 

package/.node-version

@@ -1 +1 @@
-26.12.1
+26.13.0

package/.trivy.yml

@@ -0,0 +1,5 @@
+# Fail only on high/critical vulnerabilities; medium findings in
+# transitive dependencies are tracked, not release-blocking.
+severity:
+  - HIGH
+  - CRITICAL

package/CHANGELOG.md

@@ -46,7 +46,7 @@ This version adds **experimental** support for [pnpm](https://pnpm.io/) and
 [yarn](https://yarnpkg.com/).
 
 Depending on the package manager and version, the invocation of the `tsx`
-command that drives `@github/local-action` is invoked differently.
+command that drives `@ronaldphilipsen/local-action` is invoked differently.
 
 | Package Manager | Version | Command     |
 | --------------- | ------- | ----------- |
@@ -57,7 +57,8 @@ command that drives `@github/local-action` is invoked differently.
 
 Alongside this, yarn PnP support is implemented via
 [unplugging](https://yarnpkg.com/cli/unplug) any modules stubbed by
-`@github/local-action` and "re-plugging" after completion of the action run.
+`@ronaldphilipsen/local-action` and "re-plugging" after completion of the action
+run.
 
 This support is still a work in progress. Any feedback or issues are welcome!
 

package/CONTRIBUTING.md

@@ -64,7 +64,7 @@ against various repositories with different configurations.
 Once you're finished testing, make sure to unlink!
 
 ```bash
-npm unlink @github/local-action
+npm unlink @ronaldphilipsen/local-action
 ```
 
 #### Example Actions to Test

package/README.md

@@ -64,8 +64,8 @@ issues, please [file an issue](https://github.com/github/local-action/issues).
 
 Some caveats to this support are listed below.
 
-- The `@github/local-action` package should be run using
-  `yarn dlx @github/local-action` instead of `yarn local-action`.
+- The `@ronaldphilipsen/local-action` package should be run using
+  `yarn dlx @ronaldphilipsen/local-action` instead of `yarn local-action`.
 - This tool does not support CommonJS actions using `yarn`.
 
 ## Prerequisites
@@ -153,7 +153,7 @@ For additional information about transpiled action code, see
 1. Install via `npm`
 
    ```bash
-   npm i -g @github/local-action
+   npm i -g @ronaldphilipsen/local-action
    ```
 
 ### Option 2: Clone this Repository
@@ -274,7 +274,7 @@ values).
 Possible errors that can arise from not having `allowJs: false`:
 
 - `TypeError [ERR_INVALID_URL_SCHEME]: The URL must be of scheme file` from tsx
-  when trying to run `npx @github/local-action`.
+  when trying to run `npx @ronaldphilipsen/local-action`.
 
 ## Features
 

package/bin/local-action.js

@@ -53,6 +53,24 @@ function entrypoint() {
       return
     }
 
+    // If the package ships its own tsx (development install or npm link),
+    // run it directly. This avoids package manager sandboxes such as yarn
+    // PnP, which cannot resolve dependencies for files outside the project.
+    const bundledTsx = path.join(
+      packagePath,
+      'node_modules',
+      'tsx',
+      'dist',
+      'cli.mjs'
+    )
+    if (fs.existsSync(bundledTsx)) {
+      execSync(
+        `node "${bundledTsx}" "${path.join(packagePath, 'src', 'index.ts')}" -- ${args.join(' ')}`,
+        { stdio: 'inherit' }
+      )
+      return
+    }
+
     // Starting in the TARGET_ACTION_PATH, locate the package.json file and
     // determine the package manager.
     const actionPackageDirs = path

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@ronaldphilipsen/local-action",
   "description": "Local Debugging for GitHub Actions",
-  "version": "7.1.0",
+  "version": "7.2.1",
   "type": "module",
   "author": "Nick Alteen <ncalteen@github.com>",
   "private": false,
@@ -55,17 +55,17 @@
     "@octokit/plugin-retry": "^8.0.3",
     "@octokit/rest": "^22.0.1",
     "archiver": "^7.0.1",
-    "chalk": "^5.6.2",
+    "chalk": "^6.0.0",
     "commander": "^14.0.3",
     "comment-json": "^4.5.1",
     "dotenv": "^17.3.1",
-    "figlet": "^1.10.0",
+    "figlet": "^1.12.0",
     "quibble": "^0.9.2",
     "semver": "^7.7.4",
     "tsconfig-paths": "^4.2.0",
     "tsx": "^4.21.0",
     "typescript": "^5.9.3",
-    "yaml": "^2.8.2"
+    "yaml": "^2.9.1"
   },
   "devDependencies": {
     "@eslint/compat": "^2.0.2",
@@ -74,7 +74,7 @@
     "@jest/globals": "^30.2.0",
     "@types/archiver": "^7.0.0",
     "@types/jest": "^30.0.0",
-    "@types/node": "^25.2.3",
+    "@types/node": "^26.0.0",
     "@types/semver": "^7.7.1",
     "@types/unzip-stream": "^0.3.4",
     "@typescript-eslint/eslint-plugin": "^8.56.0",
@@ -82,7 +82,7 @@
     "eslint": "^10.0.0",
     "eslint-plugin-prettier": "^5.5.5",
     "jest": "^30.2.0",
-    "jest-junit": "^16.0.0",
+    "jest-junit": "^17.0.0",
     "make-coverage-badge": "^1.2.0",
     "prettier": "^3.8.1",
     "ts-jest": "^29.4.6",

package/renovate.json

@@ -0,0 +1,4 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:recommended"]
+}

package/.github/workflows/continuous-delivery.yml

@@ -1,93 +0,0 @@
-name: Continuous Delivery
-
-on:
-  pull_request:
-    types:
-      - closed
-    branches:
-      - main
-    paths:
-      - bin/**/*
-      - src/**/*
-      - .node-version
-      - package-lock.json
-      - package.json
-      - tsconfig.base.json
-      - tsconfig.eslint.json
-      - tsconfig.json
-  workflow_dispatch:
-
-permissions:
-  contents: write
-  id-token: write
-
-jobs:
-  publish:
-    name: Publish to npm
-    runs-on: ubuntu-latest
-
-    # Only run this job if one of the following is true:
-    # - It was run manually.
-    # - A PR was merged that was not from Dependabot or a fork.
-    if: |
-      github.event_name == 'workflow_dispatch' ||
-      (
-        github.event.pull_request.merged == true &&
-        startsWith(github.head_ref, 'dependabot/') == false &&
-        github.event.pull_request.head.repo.fork == false
-      )
-
-    steps:
-      - name: Checkout
-        id: checkout
-        uses: actions/checkout@v6
-        with:
-          fetch-tags: true
-
-      - name: Setup Node.js
-        id: setup-node
-        uses: actions/setup-node@v6
-        with:
-          cache: npm
-          node-version-file: .node-version
-          registry-url: https://registry.npmjs.org/
-
-      - name: Install Dependencies
-        id: install
-        run: npm ci
-
-      - name: Test
-        id: test
-        run: npm run ci-test
-
-      - name: Publish
-        id: publish
-        run: |
-          npm publish --ignore-scripts --access public
-
-  release:
-    name: Create Release
-    runs-on: ubuntu-latest
-
-    needs: publish
-
-    steps:
-      - name: Checkout
-        id: checkout
-        uses: actions/checkout@v6
-        with:
-          fetch-tags: true
-
-      - name: Tag
-        id: tag
-        uses: issue-ops/semver@v3
-        with:
-          manifest-path: package.json
-          workspace: ${{ github.workspace }}
-          ref: main
-
-      - name: Create Release
-        id: release
-        uses: issue-ops/releaser@v3
-        with:
-          tag: v${{ steps.tag.outputs.version }}

package/.github/workflows/version-check.yml

@@ -1,44 +0,0 @@
-name: Version Check
-
-on:
-  pull_request:
-    branches:
-      - main
-    paths:
-      - bin/**/*
-      - src/**/*
-      - .node-version
-      - package-lock.json
-      - package.json
-      - tsconfig.base.json
-      - tsconfig.eslint.json
-      - tsconfig.json
-
-permissions:
-  checks: write
-  contents: read
-  pull-requests: write
-
-jobs:
-  check-version:
-    name: Version Check
-    runs-on: ubuntu-latest
-
-    if: ${{ startsWith(github.head_ref, 'dependabot/') == false }}
-
-    steps:
-      - name: Checkout
-        id: checkout
-        uses: actions/checkout@v6
-        with:
-          fetch-tags: true
-          fetch-depth: 0
-
-      - name: Check Version
-        id: check-version
-        uses: issue-ops/semver@v3
-        with:
-          check-only: true
-          comment: true
-          manifest-path: package.json
-          workspace: ${{ github.workspace }}