Merge c955c43bf4 into 48b90677b6

* Update versions.yml

* Update versions.yml

* ubuntu-24, macos-13 updates

* check -failure fix

.github/workflows/e2e-cache.yml

@@ -18,7 +18,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-13]
         node-version: [18, 20, 22]
     steps:
       - uses: actions/checkout@v4
@@ -41,7 +41,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-13]
         node-version: [18, 20, 22]
     steps:
       - uses: actions/checkout@v4
@@ -74,7 +74,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-13]
         node-version: [18, 20]
     steps:
       - uses: actions/checkout@v4
@@ -106,7 +106,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-13]
         node-version: [18, 20, 22]
     steps:
       - uses: actions/checkout@v4

.github/workflows/release-new-action-version.yml

@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Update the ${{ env.TAG_NAME }} tag
-        uses: actions/publish-action@v0.2.2
+        uses: actions/publish-action@v0.3.0
         with:
           source-tag: ${{ env.TAG_NAME }}
           slack-webhook: ${{ secrets.SLACK_WEBHOOK }}

.github/workflows/versions.yml

@@ -17,7 +17,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-13]
         node-version: [18, 20, 22]
     steps:
       - uses: actions/checkout@v4
@@ -56,7 +56,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-13]
         node-version:
           [
             '20-v8-canary',
@@ -81,7 +81,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-13]
         node-version:
           [20.11.0-nightly202312211a0be537da, 21-nightly, 18.0.0-nightly]
     steps:
@@ -102,7 +102,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-13]
         node-version: [20.0.0-rc.1, 18.0.0-rc.2, 19.0.0-rc.0]
     steps:
       - uses: actions/checkout@v4
@@ -122,7 +122,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-13]
         node-version: [18.20.0, 20.10.0, 22.0.0]
     steps:
       - uses: actions/checkout@v4
@@ -139,7 +139,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-13]
         node-version: [18, 20, 22]
     steps:
       - uses: actions/checkout@v4
@@ -157,7 +157,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-13]
         node-version-file:
           [.nvmrc, .tool-versions, .tool-versions-node, package.json]
     steps:
@@ -174,7 +174,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-13]
     steps:
       - uses: actions/checkout@v4
       - name: Setup node from node version file
@@ -189,7 +189,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-13]
     steps:
       - uses: actions/checkout@v4
       - name: Setup node from node version file
@@ -204,7 +204,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-13]
         node-version: [17, 19]
     steps:
       - uses: actions/checkout@v4
@@ -251,7 +251,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest]
+        os: [ubuntu-latest, windows-latest, macos-latest, macos-13]
         node-version: [current, latest, node]
     steps:
       - name: Get node version

.gitignore

@@ -93,3 +93,6 @@ typings/
 
 # DynamoDB Local files
 .dynamodb/
+
+# Built artifacts
+dist/

README.md

@@ -76,6 +76,10 @@ See [action.yml](action.yml)
     # Set always-auth option in npmrc file.
     # Default: ''
     always-auth: ''
+
+    # Set ignore-scripts in npmrc file to prevent pre and postinstall scripts from running as they are a potential security problem.
+    # Default: false
+    ignore-scripts: false 
 ```
 <!-- end usage -->
 

__tests__/ignore-scripts.test.ts

@@ -0,0 +1,46 @@
+import path from 'path';
+import fs from 'fs';
+import * as ignorescripts from '../src/ignore-scripts';
+import {getNpmrcLocation} from '../src/util';
+
+let rcFile: string;
+
+describe('ignore-scripts tests', () => {
+  const runnerDir = path.join(__dirname, 'runner');
+
+  beforeEach(async () => {
+    rcFile = getNpmrcLocation();
+  }, 5000);
+
+  afterEach(async () => {
+    fs.unlinkSync(rcFile);
+    rcFile = getNpmrcLocation();
+  }, 10000);
+
+  it('sets the value to true according to input', async () => {
+    ignorescripts.ignoreScriptsInNpmConfig('true');
+    const rcContents = fs.readFileSync(rcFile).toString();
+    expect(rcContents).toMatch('\nignore-scripts=true\n');
+  });
+
+  it('sets the value to false according to input', async () => {
+    ignorescripts.ignoreScriptsInNpmConfig('false');
+    const rcContents = fs.readFileSync(rcFile).toString();
+    expect(rcContents).toMatch('\nignore-scripts=false\n');
+  });
+
+  it('defaults to false on empty input', async () => {
+    ignorescripts.ignoreScriptsInNpmConfig('');
+    const rcContents = fs.readFileSync(rcFile).toString();
+    expect(rcContents).toMatch('\nignore-scripts=false\n');
+  });
+
+  it('preserves existing npmrc file contents', async () => {
+    fs.writeFileSync(getNpmrcLocation(), 'something\nwhatever\nstuff');
+    ignorescripts.ignoreScriptsInNpmConfig('true');
+    const rcContents = fs.readFileSync(rcFile).toString();
+    expect(rcContents).toMatch(
+      'something\nwhatever\nstuff\nignore-scripts=true\n'
+    );
+  });
+});

action.yml

@@ -25,6 +25,9 @@ inputs:
     description: 'Used to specify a package manager for caching in the default directory. Supported values: npm, yarn, pnpm.'
   cache-dependency-path:
     description: 'Used to specify the path to a dependency file: package-lock.json, yarn.lock, etc. Supports wildcards or a list of file names for caching multiple dependencies.'
+  ignore-scripts:
+    description: 'Set ignore-scripts in npmrc to prevent pre and postinstall scripts from running as they are a potential security problem.'
+    default: 'false'
 # TODO: add input to control forcing to pull from cloud or dist.
 #       escape valve for someone having issues or needing the absolute latest which isn't cached yet
 outputs:

dist/cache-save/index.js

@@ -84068,7 +84068,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.unique = exports.printEnvDetailsAndSetOutput = exports.getNodeVersionFromFile = void 0;
+exports.defaultIfEmpty = exports.getNpmrcLocation = exports.unique = exports.printEnvDetailsAndSetOutput = exports.getNodeVersionFromFile = void 0;
 const core = __importStar(__nccwpck_require__(2186));
 const exec = __importStar(__nccwpck_require__(1514));
 const io = __importStar(__nccwpck_require__(7436));
@@ -84166,6 +84166,12 @@ const unique = () => {
     };
 };
 exports.unique = unique;
+const getNpmrcLocation = () => {
+    return path_1.default.resolve(process.env['RUNNER_TEMP'] || process.cwd(), '.npmrc');
+};
+exports.getNpmrcLocation = getNpmrcLocation;
+const defaultIfEmpty = (input, defaultValue) => input.length === 0 ? defaultValue : input;
+exports.defaultIfEmpty = defaultIfEmpty;
 
 
 /***/ }),

dist/setup/index.js

@@ -94377,6 +94377,29 @@ class CanaryBuild extends base_distribution_prerelease_1.default {
 exports["default"] = CanaryBuild;
 
 
+/***/ }),
+
+/***/ 6572:
+/***/ ((__unused_webpack_module, exports, __nccwpck_require__) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.ignoreScriptsInNpmConfig = void 0;
+const fs_1 = __nccwpck_require__(7147);
+const util_1 = __nccwpck_require__(2629);
+const ignoreScriptsInNpmConfig = (ignore) => {
+    const nonEmptyInput = (0, util_1.defaultIfEmpty)(ignore, 'false');
+    const ignored = JSON.parse(nonEmptyInput);
+    appendToNpmrc(ignored);
+};
+exports.ignoreScriptsInNpmConfig = ignoreScriptsInNpmConfig;
+const appendToNpmrc = (ignoreScripts) => {
+    const npmrc = (0, util_1.getNpmrcLocation)();
+    (0, fs_1.writeFileSync)(npmrc, `\nignore-scripts=${ignoreScripts}\n`, { flag: 'a' });
+};
+
+
 /***/ }),
 
 /***/ 399:
@@ -94430,6 +94453,7 @@ const cache_utils_1 = __nccwpck_require__(1678);
 const installer_factory_1 = __nccwpck_require__(5617);
 const util_1 = __nccwpck_require__(2629);
 const constants_1 = __nccwpck_require__(9042);
+const ignore_scripts_1 = __nccwpck_require__(6572);
 function run() {
     return __awaiter(this, void 0, void 0, function* () {
         try {
@@ -94469,6 +94493,8 @@ function run() {
             if (registryUrl) {
                 auth.configAuthentication(registryUrl, alwaysAuth);
             }
+            const ignoreScripts = core.getInput('ignore-scripts');
+            (0, ignore_scripts_1.ignoreScriptsInNpmConfig)(ignoreScripts);
             if (cache && (0, cache_utils_1.isCacheFeatureAvailable)()) {
                 core.saveState(constants_1.State.CachePackageManager, cache);
                 const cacheDependencyPath = core.getInput('cache-dependency-path');
@@ -94552,7 +94578,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", ({ value: true }));
-exports.unique = exports.printEnvDetailsAndSetOutput = exports.getNodeVersionFromFile = void 0;
+exports.defaultIfEmpty = exports.getNpmrcLocation = exports.unique = exports.printEnvDetailsAndSetOutput = exports.getNodeVersionFromFile = void 0;
 const core = __importStar(__nccwpck_require__(2186));
 const exec = __importStar(__nccwpck_require__(1514));
 const io = __importStar(__nccwpck_require__(7436));
@@ -94650,6 +94676,12 @@ const unique = () => {
     };
 };
 exports.unique = unique;
+const getNpmrcLocation = () => {
+    return path_1.default.resolve(process.env['RUNNER_TEMP'] || process.cwd(), '.npmrc');
+};
+exports.getNpmrcLocation = getNpmrcLocation;
+const defaultIfEmpty = (input, defaultValue) => input.length === 0 ? defaultValue : input;
+exports.defaultIfEmpty = defaultIfEmpty;
 
 
 /***/ }),

package-lock.json

@@ -2588,9 +2588,9 @@
       }
     },
     "node_modules/cross-spawn": {
-      "version": "7.0.3",
+      "version": "7.0.6",
-      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.3.tgz",
+      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
-      "integrity": "sha512-iRDPJKUPVEND7dHPO8rkbOnPpyDygcDFtWjpeWNCgy8WP2rXcxXL8TskReQl6OrB2G7+UJrags1q15Fudc7G6w==",
+      "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
       "dev": true,
       "dependencies": {
         "path-key": "^3.1.0",

src/ignore-scripts.ts

@@ -0,0 +1,13 @@
+import {writeFileSync} from 'fs';
+import {defaultIfEmpty, getNpmrcLocation} from './util';
+
+export const ignoreScriptsInNpmConfig = (ignore: string): void => {
+  const nonEmptyInput: string = defaultIfEmpty(ignore, 'false');
+  const ignored: boolean = JSON.parse(nonEmptyInput);
+  appendToNpmrc(ignored);
+};
+
+const appendToNpmrc = (ignoreScripts: boolean): void => {
+  const npmrc = getNpmrcLocation();
+  writeFileSync(npmrc, `\nignore-scripts=${ignoreScripts}\n`, {flag: 'a'});
+};

src/main.ts

@@ -9,6 +9,7 @@ import {isCacheFeatureAvailable} from './cache-utils';
 import {getNodejsDistribution} from './distributions/installer-factory';
 import {getNodeVersionFromFile, printEnvDetailsAndSetOutput} from './util';
 import {State} from './constants';
+import {ignoreScriptsInNpmConfig} from './ignore-scripts';
 
 export async function run() {
   try {
@@ -59,6 +60,9 @@ export async function run() {
       auth.configAuthentication(registryUrl, alwaysAuth);
     }
 
+    const ignoreScripts: string = core.getInput('ignore-scripts');
+    ignoreScriptsInNpmConfig(ignoreScripts);
+
     if (cache && isCacheFeatureAvailable()) {
       core.saveState(State.CachePackageManager, cache);
       const cacheDependencyPath = core.getInput('cache-dependency-path');

src/util.ts

@@ -106,3 +106,10 @@ export const unique = () => {
     return true;
   };
 };
+
+export const getNpmrcLocation: () => string = () => {
+  return path.resolve(process.env['RUNNER_TEMP'] || process.cwd(), '.npmrc');
+};
+
+export const defaultIfEmpty = (input: string, defaultValue: string): string =>
+  input.length === 0 ? defaultValue : input;