Merge pull request #23 from kubajanusz/main

feat: fix nondeterministic hash with globbing, update to node20 and update pipelines

.github/workflows/check-dist.yml

@@ -21,12 +21,12 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
-      - name: Set Node.js 16.x
-        uses: actions/setup-node@v3.6.0
+      - name: Set Node.js 20.x
+        uses: actions/setup-node@v4
         with:
-          node-version: 16.x
+          node-version: 20.x
 
       - name: Install dependencies
         run: npm ci
@@ -46,7 +46,7 @@ jobs:
         id: diff
 
       # If index.js was different than expected, upload the expected version as an artifact
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         if: ${{ failure() && steps.diff.conclusion == 'failure' }}
         with:
           name: dist

.github/workflows/codeql-analysis.yml

@@ -38,11 +38,11 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@v3
       with:
         languages: ${{ matrix.language }}
         source-root: src
@@ -54,7 +54,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v2
+      uses: github/codeql-action/autobuild@v3
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -68,4 +68,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@v3

.github/workflows/test.yml

@@ -10,7 +10,7 @@ jobs:
   build: # make sure build/ci work properly
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - run: |
           npm install
       - run: |
@@ -19,7 +19,7 @@ jobs:
   test: # make sure the action works on a clean machine without building
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - uses: ./
         id: get-hash

.vscode/settings.json

@@ -1,12 +1,15 @@
 {
-  // 保存时执行eslint
+  // Run eslint on save
   "editor.codeActionsOnSave": {
     "source.fixAll.eslint": true
   },
-  // 从不展示扩展缩写
+  // Never show expanded abbreviation
   "emmet.showExpandedAbbreviation": "never",
-  // 关闭代码区域小地图
+  // Disable code minimap
   "editor.minimap.enabled": false,
-  // 代码过长换行
-  "editor.wordWrap": "on"
+  // Wrap long lines
+  "editor.wordWrap": "on",
+  "yaml.schemas": {
+    "https://www.artillery.io/schema.json": []
+  }
 }

__tests__/main.test.ts

@@ -4,25 +4,26 @@ import * as process from 'process'
 import * as cp from 'child_process'
 import * as path from 'path'
 import {test} from '@jest/globals'
+import {expect} from '@jest/globals'
 
 test('test sha256', async () => {
-  console.log(hashHex('this is content'))
+  console.info(hashHex('this is content'))
 })
 
 test('test sha512', async () => {
-  console.log(hashHex('this is content', 'sha512'))
+  console.info(hashHex('this is content', 'sha512'))
 })
 
 test('test readFile', async () => {
   const content = await readFile('./.prettierignore')
-  console.log(content)
+  console.info(content)
 })
 
 test('test getFiles', async () => {
   const paths = await getFiles('./', ['**/*.ts', '**/package-lock.json'], {
     gitignore: true
   })
-  console.log(paths)
+  console.info(paths)
 })
 
 test('test runs', () => {
@@ -34,5 +35,27 @@ test('test runs', () => {
   const options: cp.ExecFileSyncOptions = {
     env: process.env
   }
-  console.log(cp.execFileSync(np, [ip], options).toString())
+  console.info(cp.execFileSync(np, [ip], options).toString())
+})
+
+test('test runs - hash is consistent', () => {
+  process.env['INPUT_WORKDIR'] = './'
+  process.env['INPUT_PATTERNS'] = '**/*.ts\n**/package-lock.json'
+  process.env['INPUT_GITIGNORE'] = 'true'
+  const np = process.execPath
+  const ip = path.join(__dirname, '..', 'lib', 'main.js')
+  const options: cp.ExecFileSyncOptions = {
+    env: process.env
+  }
+  const results: string[] = []
+  for (let i = 0; i < 5; i++) {
+    results.push(cp.execFileSync(np, [ip], options).toString())
+  }
+  // Extract hash from output and check all are the same
+  const hashes = results.map(output => {
+    const match = output.match(/Hash: ([a-fA-F0-9]+)/)
+    return match ? match[1] : null
+  })
+  expect(new Set(hashes).size).toBe(1)
+  console.info('All hashes:', hashes)
 })

action.yml

@@ -15,10 +15,10 @@ inputs:
   gitignore:
     description: >
       Respect ignore patterns in .gitignore files that apply to the globbed files.
-    default: true
+    default: 'true'
     required: false
   ignoreFiles:
-    descruption: >
+    description: >
       Glob patterns to look for ignore files, which are then used to ignore globbed files.
       This is a more generic form of the gitignore option, allowing you to find ignore files with a compatible syntax.
       For instance, this works with Babel's .babelignore, Prettier's .prettierignore, or ESLint's .eslintignore files.
@@ -29,5 +29,5 @@ outputs:
   matched-files:
     description: 'The files matched by the patterns'
 runs:
-  using: 'node16'
+  using: 'node20'
   main: 'dist/index.js'

dist/licenses.txt

@@ -10,6 +10,18 @@ The above copyright notice and this permission notice shall be included in all c
 
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
+@actions/exec
+MIT
+The MIT License (MIT)
+
+Copyright 2019 GitHub
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
 @actions/http-client
 MIT
 Actions Http Client for Node.js
@@ -35,6 +47,18 @@ WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
 SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 
+@actions/io
+MIT
+The MIT License (MIT)
+
+Copyright 2019 GitHub
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
 @cjs-exporter/globby
 MIT
 
@@ -61,16 +85,3 @@ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
-
-
-uuid
-MIT
-The MIT License (MIT)
-
-Copyright (c) 2010-2020 Robert Kieffer and other contributors
-
-Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package.json

@@ -25,21 +25,24 @@
   "author": "seepine",
   "license": "MIT",
   "dependencies": {
-    "@actions/core": "^1.10.0",
-    "@cjs-exporter/globby": "^13.1.3",
-    "crypto": "^1.0.1"
+    "@actions/core": "^1.11.1",
+    "@cjs-exporter/globby": "^13.1.3"
   },
   "devDependencies": {
-    "@types/node": "^18.16.3",
+    "@types/node": "^20.19.4",
     "@typescript-eslint/parser": "^5.59.2",
     "@vercel/ncc": "^0.36.1",
     "eslint": "^8.39.0",
     "eslint-plugin-github": "^4.7.0",
     "eslint-plugin-jest": "^27.2.1",
+    "eslint-plugin-prettier": "^5.5.3",
     "jest": "^29.5.0",
     "js-yaml": "^4.1.0",
-    "prettier": "^2.8.8",
+    "prettier": "^3.0.0",
     "ts-jest": "^29.1.0",
-    "typescript": "^5.0.4"
+    "typescript": "^5.8.3"
+  },
+  "engines": {
+    "node": ">=20"
   }
 }

src/main.ts

@@ -22,7 +22,9 @@ async function run(): Promise<void> {
     core.debug(`gitignore: ${gitignore}`)
     core.debug(`ignoreFiles: ${ignoreFiles}`)
 
-    const files = await getFiles(workdir, patterns, {gitignore, ignoreFiles})
+    const files = (
+      await getFiles(workdir, patterns, {gitignore, ignoreFiles})
+    ).sort((a, b) => a.localeCompare(b))
     let hash = ''
 
     const reads = files.map(async file => readFile(file))