Migrate dev environment and workflows to node16 #1278

fhammerl · 2022-12-20T14:25:02Z

To fix critical audit vulnerabilities, we needed to upgrade (dev) dependencies to versions that are no longer compatible with our current workflows using node12.

Node12 and node16 are the versions used by the runner. With Node12 being deprecated, we've targeted node16 for this project as well. It makes sense to keep in sync with the runner, as most eventual applications of actions/tookit's packages end up being executed by the runner.

Also contains numerous fixes to satisfy audit-all

johnsudol

LGTM

fhammerl · 2022-12-22T10:27:10Z

packages/artifact/src/internal/download-http-client.ts

@@ -219,6 +219,13 @@ export class DownloadHttpClient {
      fileDownloadPath: string
    ): Promise<void> => {
      destinationStream.close()
+      // await until file is created at downloadpath; node15 and up fs.createWriteStream had not created a file yet


Node16 regression:

The single code change we need in node16: awaiting destinationStream.on('close', ensures that the file has been created so we can rmFile delete it on line 229.

Phantsure · 2022-12-22T11:06:36Z

.github/workflows/artifact-tests.yml

@@ -24,10 +24,10 @@ jobs:
    - name: Checkout
      uses: actions/checkout@v2

-    - name: Set Node.js 12.x
+    - name: Set Node.js 16.x
      uses: actions/setup-node@v1


setup-node can also be updated to v3?

…rl/node-v16-and-toolkit-fixes

Releases can be made or PRs can be merged even if the workflow is failing

Bumps [actions/download-artifact](https://github.com/actions/download-artifact) from 3 to 4. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/download-artifact/releases">actions/download-artifact's releases</a>.</em></p> <blockquote> <h2>v4.0.0</h2> <h2>What's Changed</h2> <p>The release of upload-artifact@v4 and download-artifact@v4 are major changes to the backend architecture of Artifacts. They have numerous performance and behavioral improvements.</p> <p>For more information, see the <a href="https://github.com/actions/toolkit/tree/main/packages/artifact"><code>@actions/artifact</code></a> documentation.</p> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/bflad"><code>@bflad</code></a> made their first contribution in <a href="https://redirect.github.com/actions/download-artifact/pull/194">actions/download-artifact#194</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/download-artifact/compare/v3...v4.0.0">https://github.com/actions/download-artifact/compare/v3...v4.0.0</a></p> <h2>v3.0.2</h2> <ul> <li>Bump <code>@actions/artifact</code> to v1.1.1 - <a href="https://redirect.github.com/actions/download-artifact/pull/195">actions/download-artifact#195</a></li> <li>Fixed a bug in Node16 where if an HTTP download finished too quickly (<1ms, e.g. when it's mocked) we attempt to delete a temp file that has not been created yet <a href="hhttps://redirect.github.com/actions/toolkit/pull/1278">actions/toolkit#1278</a></li> </ul> <h2>v3.0.1</h2> <ul> <li><a href="https://redirect.github.com/actions/download-artifact/pull/178">Bump <code>@actions/core</code> to 1.10.0</a></li> </ul> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/download-artifact/commit/f44cd7b40bfd40b6aa1cc1b9b5b7bf03d3c67110"><code>f44cd7b</code></a> Merge pull request <a href="https://redirect.github.com/actions/download-artifact/issues/259">#259</a> from actions/robherley/glob-downloads</li> <li><a href="https://github.com/actions/download-artifact/commit/3181fe853d2c9a606cd326853bf4c5b8ced5df02"><code>3181fe8</code></a> add some migration docs</li> <li><a href="https://github.com/actions/download-artifact/commit/aaaac7b403f278b6b7eebdca69ca1658616f1c57"><code>aaaac7b</code></a> licensed cache</li> <li><a href="https://github.com/actions/download-artifact/commit/7c9182f0e18dadedfbca3189ab7a22a416aa6714"><code>7c9182f</code></a> update readme</li> <li><a href="https://github.com/actions/download-artifact/commit/b94e7015566b40b2de5eeeda514f239968da2dd7"><code>b94e701</code></a> licensed cache</li> <li><a href="https://github.com/actions/download-artifact/commit/0b55470e40ab7435f445813ebc18b1107ecf7e32"><code>0b55470</code></a> add test case for globbed downloads to same directory</li> <li><a href="https://github.com/actions/download-artifact/commit/0b51c2ef9042b581aded9711127e4a6d5f71c550"><code>0b51c2e</code></a> update prettier/eslint versions</li> <li><a href="https://github.com/actions/download-artifact/commit/c4c6db724f9510b2b3cff5ebcc417c87a2b2fa97"><code>c4c6db7</code></a> support globbing artifact list & merging download directory</li> <li><a href="https://github.com/actions/download-artifact/commit/1bd0606e08fcaa4c28afc1fc7d45830ab5482dac"><code>1bd0606</code></a> Merge pull request <a href="https://redirect.github.com/actions/download-artifact/issues/252">#252</a> from stchr/patch-1</li> <li><a href="https://github.com/actions/download-artifact/commit/eff4d42b1f6ff704c7a0f37152ed8793673560ef"><code>eff4d42</code></a> fix default for run-id</li> <li>Additional commits viewable in <a href="https://github.com/actions/download-artifact/compare/v3...v4">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=actions/download-artifact&package-manager=github_actions&previous-version=3&new-version=4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

fhammerl added 10 commits December 13, 2022 18:21

Update nock to work with node 16

23811ac

Update ts types to node16

c91bdba

Test out checking for fileexists in rmFile

cc9ec04

Run workflows on 16

e1a991f

Fix audit

56c4606

Fix missing typescript casts

6b18932

Quote workflows for windows

4abb5a2

Fix linting

1d61e5f

Await finish of filestream so file is created for node16

b9de68a

Fix linting

80d9927

fhammerl requested review from a team as code owners December 20, 2022 14:25

Try sequential jest tests

2afea66

johnsudol approved these changes Dec 20, 2022

View reviewed changes

fhammerl changed the title ~~Bump workflows to node16 (the version used by the runner) and apply fixes to prevent regressions~~ Migrate dev environment and workflows to node16 Dec 22, 2022

fhammerl commented Dec 22, 2022

View reviewed changes

Phantsure reviewed Dec 22, 2022

View reviewed changes

fhammerl added 5 commits January 3, 2023 11:58

Merge branch 'main' of https://github.com/actions/toolkit into fhamme…

894a049

…rl/node-v16-and-toolkit-fixes

Add disabling explanation in audit-allow-list

3d46598

Remove allow-list from audit

af2d2ff

Releases can be made or PRs can be merged even if the workflow is failing

Update title with hint

5e9bcac

Fix json5 vuln

4ea0831

rentziass approved these changes Jan 3, 2023

View reviewed changes

fhammerl merged commit f5024e4 into main Jan 3, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Migrate dev environment and workflows to node16 #1278

Migrate dev environment and workflows to node16 #1278

fhammerl commented Dec 20, 2022 •

edited

johnsudol left a comment

fhammerl Dec 22, 2022 •

edited

Phantsure Dec 22, 2022

Migrate dev environment and workflows to node16 #1278

Migrate dev environment and workflows to node16 #1278

Conversation

fhammerl commented Dec 20, 2022 • edited

johnsudol left a comment

Choose a reason for hiding this comment

fhammerl Dec 22, 2022 • edited

Choose a reason for hiding this comment

Phantsure Dec 22, 2022

Choose a reason for hiding this comment

fhammerl commented Dec 20, 2022 •

edited

fhammerl Dec 22, 2022 •

edited