mirror of
https://github.com/pnpm/action-setup.git
synced 2026-08-14 14:02:10 +08:00
Zoltan Kochan
e6cb65ab2f
Saving in the post step left the whole job between the install and the upload. Anything running in that window — the job's tests, its build, a dependency's own install scripts — can rewrite the log on disk, and the job's own cache write would then publish a record claiming some other lockfile passed verification, for every later job to restore and trust. No cache credentials needed: the attacker rides the write the job performs anyway. The log is complete the moment the install finishes, so it is uploaded there. The post step still covers a job that installs in a step of its own, where that is the first point the log is known to be final; the save is idempotent across the two, and the process-local flags exist because main and post do not share state within a run.
49 lines
1.3 KiB
TypeScript
49 lines
1.3 KiB
TypeScript
import { setFailed, saveState, getState } from '@actions/core'
|
|
import restoreCache from './cache-restore'
|
|
import saveCache from './cache-save'
|
|
import getInputs, { Inputs } from './inputs'
|
|
import installPnpm from './install-pnpm'
|
|
import { saveVerificationCache } from './lockfile-verification-cache'
|
|
import setOutputs from './outputs'
|
|
import pnpmInstall from './pnpm-install'
|
|
import pruneStore from './pnpm-store-prune'
|
|
|
|
async function main() {
|
|
if (getState('is_post') === 'true') {
|
|
await runPost()
|
|
} else {
|
|
await runMain()
|
|
}
|
|
}
|
|
|
|
async function runMain() {
|
|
const inputs = getInputs()
|
|
saveState('inputs', inputs)
|
|
saveState('is_post', 'true')
|
|
|
|
const binDest = await installPnpm(inputs)
|
|
if (binDest === undefined) return
|
|
console.log('Installation Completed!')
|
|
setOutputs(inputs, binDest)
|
|
|
|
await restoreCache(inputs)
|
|
|
|
pnpmInstall(inputs)
|
|
await saveVerificationCache()
|
|
}
|
|
|
|
async function runPost() {
|
|
const inputs = JSON.parse(getState('inputs')) as Inputs
|
|
// Covers a job that installs in a later step of its own; when this action
|
|
// installed, the log was already saved then. Runs before the prune because
|
|
// pnpm versions before pnpm/pnpm#13893 delete the log during one.
|
|
await saveVerificationCache()
|
|
pruneStore(inputs)
|
|
await saveCache(inputs)
|
|
}
|
|
|
|
main().catch(error => {
|
|
console.error(error)
|
|
setFailed(error)
|
|
})
|