Skip to content

Conversation

@pull
Copy link

@pull pull bot commented Oct 15, 2024

See Commits and Changes for more details.


Created by pull[bot]

Can you help keep this open source service alive? 💖 Please sponsor : )

@sourcery-ai
Copy link

sourcery-ai bot commented Oct 15, 2024

Reviewer's Guide by Sourcery

This pull request includes several significant changes across multiple packages in the actions/toolkit repository. The changes primarily focus on updating dependencies, improving error handling, enhancing security, and refactoring code for better performance and maintainability. Key updates include modifications to the artifact upload process, changes to OIDC token handling, improvements to the HTTP client, and updates to the glob and attest packages.

Class diagram for OIDC Token Handling

classDiagram
    class OIDCConfig {
        string issuer
        string jwks_uri
    }

    class ClaimSet {
        string iss
        string ref
        string sha
        string repository
        string event_name
        string job_workflow_ref
        string workflow_ref
        string repository_id
        string repository_owner_id
    }

    class OIDC {
        +getIDTokenClaims(issuer: string): Promise<ClaimSet>
        +decodeOIDCToken(token: string, issuer: string): Promise<JWTPayload>
        +getJWKS(issuer: string): Promise<JSONWebKeySet>
        +getIssuer(): string
    }

    OIDC --> OIDCConfig
    OIDC --> ClaimSet
Loading

Class diagram for HTTP Client Proxy Handling

classDiagram
    class DecodedURL {
        string username
        string password
        string href
    }

    class HttpClient {
        +getProxyUrl(reqUrl: URL): URL | undefined
        +getAgent(url: string): any
    }

    HttpClient --> DecodedURL
Loading

File-Level Changes

Change Details Files
Refactored artifact upload process
  • Updated chunk timeout logic
  • Implemented lazy stream to prevent issues with open file limits
  • Fixed a regression with symlinks not being automatically resolved
  • Improved error handling for upload progress stalling
packages/artifact/__tests__/upload-artifact.test.ts
packages/artifact/src/internal/upload/blob-upload.ts
packages/artifact/src/internal/upload/upload-zip-specification.ts
packages/artifact/src/internal/upload/zip.ts
Enhanced OIDC token handling and attestation process
  • Updated OIDC token claim validation
  • Improved handling of enterprise-specific OIDC issuers
  • Added support for custom HTTP headers in attestation requests
  • Updated SLSA provenance predicate generation
packages/attest/src/oidc.ts
packages/attest/src/provenance.ts
packages/attest/src/attest.ts
packages/attest/src/store.ts
Improved HTTP client functionality
  • Fixed handling of proxy usernames and passwords
  • Updated URL decoding for proxy authentication
  • Improved error handling for network requests
packages/http-client/src/index.ts
packages/http-client/src/proxy.ts
Updated glob package with new features
  • Added option to exclude hidden files in glob searches
  • Improved handling of symlinks in glob results
packages/glob/src/internal-glob-options.ts
packages/glob/src/internal-globber.ts
General dependency updates and security improvements
  • Updated various dependencies across packages
  • Replaced uuid package with native crypto.randomUUID()
  • Improved error messages and debugging information
packages/artifact/RELEASES.md
packages/attest/RELEASES.md
packages/core/RELEASES.md
packages/glob/RELEASES.md
packages/http-client/RELEASES.md

Tips and commands

Interacting with Sourcery

  • Trigger a new review: Comment @sourcery-ai review on the pull request.
  • Continue discussions: Reply directly to Sourcery's review comments.
  • Generate a GitHub issue from a review comment: Ask Sourcery to create an
    issue from a review comment by replying to it.
  • Generate a pull request title: Write @sourcery-ai anywhere in the pull
    request title to generate a title at any time.
  • Generate a pull request summary: Write @sourcery-ai summary anywhere in
    the pull request body to generate a PR summary at any time. You can also use
    this command to specify where the summary should be inserted.

Customizing Your Experience

Access your dashboard to:

  • Enable or disable review features such as the Sourcery-generated pull request
    summary, the reviewer's guide, and others.
  • Change the review language.
  • Add, remove or edit custom review instructions.
  • Adjust other review settings.

Getting Help

Copy link

@sourcery-ai sourcery-ai bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We have skipped reviewing this pull request. It seems to have been created by a bot (hey, pull[bot]!). We assume it knows what it's doing!

@pull pull bot added the ⤵️ pull label Oct 15, 2024
salmanmkc and others added 27 commits March 17, 2025 17:14
…-release

Prepare Cache v4.0.3 & Artifact v2.3.2 releases
fix link in `@actions/artifact` `RELEASES.md`
Bumps [@octokit/endpoint](https://github.com/octokit/endpoint.js) from 9.0.5 to 9.0.6.
- [Release notes](https://github.com/octokit/endpoint.js/releases)
- [Commits](octokit/endpoint.js@v9.0.5...v9.0.6)

---
updated-dependencies:
- dependency-name: "@octokit/endpoint"
  dependency-version: 9.0.6
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Bumps [@octokit/request-error](https://github.com/octokit/request-error.js) from 5.1.0 to 5.1.1.
- [Release notes](https://github.com/octokit/request-error.js/releases)
- [Commits](octokit/request-error.js@v5.1.0...v5.1.1)

---
updated-dependencies:
- dependency-name: "@octokit/request-error"
  dependency-version: 5.1.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
…s/attest/octokit/request-error-5.1.1

Bump @octokit/request-error from 5.1.0 to 5.1.1 in /packages/attest
…s/attest/octokit/endpoint-9.0.6

Bump @octokit/endpoint from 9.0.5 to 9.0.6 in /packages/attest
Bumps [undici](https://github.com/nodejs/undici) from 5.28.5 to 5.29.0.
- [Release notes](https://github.com/nodejs/undici/releases)
- [Commits](nodejs/undici@v5.28.5...v5.29.0)

---
updated-dependencies:
- dependency-name: undici
  dependency-version: 5.29.0
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
…s/attest/undici-5.29.0

Bump undici from 5.28.5 to 5.29.0 in /packages/attest
bdehamer and others added 30 commits December 10, 2025 14:19
chore(cache): bump @actions/* dependencies to v2/v3
chore(artifact): bump dependencies for Node.js 24 support
docs(artifact): add v5.0.0 release notes
… deprecation

- Removed direct @azure/core-http dependency
- Updated @azure/storage-blob from ^12.15.0 to ^12.29.1
- Newer storage-blob uses @azure/core-rest-pipeline instead of deprecated @azure/core-http
- Fixes Node.js 24 deprecation warning for punycode module
…precation

- Updated @azure/storage-blob from ^12.13.0 to ^12.29.1
- Newer storage-blob uses @azure/core-rest-pipeline instead of deprecated @azure/core-http
- Fixes Node.js 24 deprecation warning for punycode module
fix(cache): update @azure/storage-blob to fix Node.js 24 punycode deprecation
fix(artifact): update @azure/storage-blob to fix Node.js 24 punycode deprecation
docs(cache): release @actions/cache v5.0.1
docs(artifact): release @actions/artifact v5.0.1
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.