mirror of
https://github.com/pnpm/action-setup.git
synced 2026-08-14 05:52:09 +08:00
Zoltan Kochan
987541b4df
Moving the upload to just after the install left one window open: pnpm runs a package's lifecycle scripts during the install, so an allow-listed dependency can still append a record claiming some other lockfile passed verification, and the upload would publish it. Writing pnpm's own record after those scripts would not help — the log is appended to, so the forged record survives whatever pnpm writes next to it. What does distinguish the two is shape: an install appends its own verdict and leaves earlier records untouched. So the log is uploaded only when every record that predated the install is still there, and no more records were added than there were installs. Both failure modes cost a re-verification in the next job and nothing else, which is also the price of pnpm compacting the log past a thousand records — rare enough in CI, where a job restores at most one record.
49 lines
1.4 KiB
TypeScript
49 lines
1.4 KiB
TypeScript
import { setFailed, saveState, getState } from '@actions/core'
|
|
import restoreCache from './cache-restore'
|
|
import saveCache from './cache-save'
|
|
import getInputs, { Inputs } from './inputs'
|
|
import installPnpm from './install-pnpm'
|
|
import { saveVerificationCache } from './lockfile-verification-cache'
|
|
import setOutputs from './outputs'
|
|
import pnpmInstall from './pnpm-install'
|
|
import pruneStore from './pnpm-store-prune'
|
|
|
|
async function main() {
|
|
if (getState('is_post') === 'true') {
|
|
await runPost()
|
|
} else {
|
|
await runMain()
|
|
}
|
|
}
|
|
|
|
async function runMain() {
|
|
const inputs = getInputs()
|
|
saveState('inputs', inputs)
|
|
saveState('is_post', 'true')
|
|
|
|
const binDest = await installPnpm(inputs)
|
|
if (binDest === undefined) return
|
|
console.log('Installation Completed!')
|
|
setOutputs(inputs, binDest)
|
|
|
|
await restoreCache(inputs)
|
|
|
|
pnpmInstall(inputs)
|
|
await saveVerificationCache(inputs.runInstall.length)
|
|
}
|
|
|
|
async function runPost() {
|
|
const inputs = JSON.parse(getState('inputs')) as Inputs
|
|
// Covers a job that installs in a later step of its own; when this action
|
|
// installed, the log was already saved then. Runs before the prune because
|
|
// pnpm versions before pnpm/pnpm#13893 delete the log during one.
|
|
await saveVerificationCache()
|
|
pruneStore(inputs)
|
|
await saveCache(inputs)
|
|
}
|
|
|
|
main().catch(error => {
|
|
console.error(error)
|
|
setFailed(error)
|
|
})
|