Compare commits

..

5 Commits

Author SHA1 Message Date
Satishchoudhary94
273d25e939 Merge 844d397646 into 774c1d6296 2026-02-25 19:16:18 +05:00
Ferdinand Thiessen
774c1d6296 feat(node-version-file): support parsing devEngines field (#1283)
* feat(node-version-file): support parsing `devEngines` field

Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>

* test: adjust for array like `devEngines`

Co-authored-by: Grigory <grigory.orlov.set@gmail.com>
Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>

* ci(versions.yml): update actions and reduce duplicated tests

Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>

* docs: consolidate advanced usage

Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>

* chore: compile assets

Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>

---------

Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>
Co-authored-by: Grigory <grigory.orlov.set@gmail.com>
2026-02-23 12:10:57 -06:00
Marco Ippolito
efcb663fc6 fix: remove hardcoded bearer (#1467) 2026-02-19 11:58:14 -06:00
gowridurgad
d02c89dce7 Fix npm audit issues (#1491)
Co-authored-by: gowridurgad <gowridurgad@gmail.com>
2026-02-10 09:37:41 -06:00
Satishchoudhary94
844d397646 fix(#1027): Improve yarn v4+ corepack support with better error handling
This change improves the action's handling of yarn v4+ which requires corepack.

Changes:
- Add enableCorepackIfSupported() helper function to automatically enable corepack
- Update yarn getCacheFolderPath to call corepack enable before checking yarn version
- Detect corepack-related errors and provide clear, actionable error messages
- Users can either enable corepack before the action or disable caching

The error message now clearly explains:
- The requirement for corepack with yarn v4+
- How to enable corepack: 'corepack enable'
- Alternative: disable caching with 'package-manager-cache: false'
- Link to GitHub issue for more context

Fixes #1027
Related: https://github.com/actions/setup-node/issues/1027
2026-01-18 14:11:36 +00:00
15 changed files with 55309 additions and 56 deletions

View File

@@ -168,6 +168,21 @@ jobs:
- name: Verify node
run: __tests__/verify-node.sh 24
version-file-dev-engines:
runs-on: ${{ matrix.os }}
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, windows-latest, macos-latest]
steps:
- uses: actions/checkout@v6
- name: Setup node from node version file
uses: ./
with:
node-version-file: '__tests__/data/package-dev-engines.json'
- name: Verify node
run: __tests__/verify-node.sh 20
version-file-volta:
runs-on: ${{ matrix.os }}
strategy:

View File

@@ -12,4 +12,5 @@ allowed:
- unlicense
reviewed:
npm:
npm:
- "@actions/http-client"

View File

@@ -1,10 +1,10 @@
---
name: "@actions/http-client"
version: 3.0.0
version: 3.0.2
type: npm
summary: Actions Http Client
homepage: https://github.com/actions/toolkit/tree/main/packages/http-client
license: mit
license: other
licenses:
- sources: LICENSE
text: |

View File

@@ -1,6 +1,6 @@
---
name: fast-xml-parser
version: 5.3.3
version: 5.3.4
type: npm
summary: Validate XML, Parse XML, Build XML without C/C++ based libraries
homepage:

34
.licenses/npm/undici-6.23.0.dep.yml generated Normal file
View File

@@ -0,0 +1,34 @@
---
name: undici
version: 6.23.0
type: npm
summary: An HTTP/1.1 client, written from scratch for Node.js
homepage: https://undici.nodejs.org
license: mit
licenses:
- sources: LICENSE
text: |
MIT License
Copyright (c) Matteo Collina and Undici contributors
Permission is hereby granted, free of charge, to any person obtaining a copy
of this software and associated documentation files (the "Software"), to deal
in the Software without restriction, including without limitation the rights
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
copies of the Software, and to permit persons to whom the Software is
furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
- sources: README.md
text: MIT
notices: []

View File

@@ -0,0 +1,11 @@
{
"engines": {
"node": "^19"
},
"devEngines": {
"runtime": {
"name": "node",
"version": "^20"
}
}
}

View File

@@ -94,22 +94,24 @@ describe('main tests', () => {
describe('getNodeVersionFromFile', () => {
each`
contents | expected
${'12'} | ${'12'}
${'12.3'} | ${'12.3'}
${'12.3.4'} | ${'12.3.4'}
${'v12.3.4'} | ${'12.3.4'}
${'lts/erbium'} | ${'lts/erbium'}
${'lts/*'} | ${'lts/*'}
${'nodejs 12.3.4'} | ${'12.3.4'}
${'ruby 2.3.4\nnodejs 12.3.4\npython 3.4.5'} | ${'12.3.4'}
${''} | ${''}
${'unknown format'} | ${'unknown format'}
${' 14.1.0 '} | ${'14.1.0'}
${'{"volta": {"node": ">=14.0.0 <=17.0.0"}}'}| ${'>=14.0.0 <=17.0.0'}
${'{"volta": {"extends": "./package.json"}}'}| ${'18.0.0'}
${'{"engines": {"node": "17.0.0"}}'} | ${'17.0.0'}
${'{}'} | ${null}
contents | expected
${'12'} | ${'12'}
${'12.3'} | ${'12.3'}
${'12.3.4'} | ${'12.3.4'}
${'v12.3.4'} | ${'12.3.4'}
${'lts/erbium'} | ${'lts/erbium'}
${'lts/*'} | ${'lts/*'}
${'nodejs 12.3.4'} | ${'12.3.4'}
${'ruby 2.3.4\nnodejs 12.3.4\npython 3.4.5'} | ${'12.3.4'}
${''} | ${''}
${'unknown format'} | ${'unknown format'}
${' 14.1.0 '} | ${'14.1.0'}
${'{}'} | ${null}
${'{"volta": {"node": ">=14.0.0 <=17.0.0"}}'} | ${'>=14.0.0 <=17.0.0'}
${'{"volta": {"extends": "./package.json"}}'} | ${'18.0.0'}
${'{"engines": {"node": "17.0.0"}}'} | ${'17.0.0'}
${'{"devEngines": {"runtime": {"name": "node", "version": "22.0.0"}}}'} | ${'22.0.0'}
${'{"devEngines": {"runtime": [{"name": "bun"}, {"name": "node", "version": "22.0.0"}]}}'} | ${'22.0.0'}
`.it('parses "$contents"', ({contents, expected}) => {
const existsSpy = jest.spyOn(fs, 'existsSync');
existsSpy.mockImplementation(() => true);

27572
dist/cache-save/index.js vendored

File diff suppressed because one or more lines are too long

27574
dist/setup/index.js vendored

File diff suppressed because one or more lines are too long

View File

@@ -90,21 +90,31 @@ steps:
- run: npm test
```
When using the `package.json` input, the action will look for `volta.node` first. If `volta.node` isn't defined, then it will look for `engines.node`.
When using the `package.json` input, the action will look in the following fields for a specified Node version:
1. It checks `volta.node` first.
2. Then it checks `devEngines.runtime` for an entry with `"name": "node"`.
3. Then it will look for `engines.node`.
4. Otherwise it tries to resolve the file defined by [`volta.extends`](https://docs.volta.sh/advanced/workspaces)
and look for `volta.node`, `devEngines.runtime`, or `engines.node` recursively.
```json
{
"engines": {
"node": ">=16.0.0"
"node": "^22 || ^24"
},
"devEngines": {
"runtime": {
"name": "node",
"version": "^24.3"
}
},
"volta": {
"node": "16.0.0"
"node": "24.11.1"
}
}
```
Otherwise, when [`volta.extends`](https://docs.volta.sh/advanced/workspaces) is defined, then it will resolve the corresponding file and look for `volta.node` or `engines.node` recursively.
## Architecture
You can use any of the [supported operating systems](https://docs.github.com/en/actions/using-github-hosted-runners/about-github-hosted-runners), and the compatible `architecture` can be selected using `architecture`. Values are `x86`, `x64`, `arm64`, `armv6l`, `armv7l`, `ppc64le`, `s390x` (not all of the architectures are available on all platforms).
@@ -470,7 +480,7 @@ Please refer to the [Ensuring workflow access to your package - Configuring a pa
It is possible to use a private mirror hosting Node.js binaries. This mirror must be a full mirror of the official Node.js distribution.
The mirror URL can be set using the `mirror` input.
It is possible to specify a token to authenticate with the mirror using the `mirror-token` input.
The token will be passed as a bearer token in the `Authorization` header.
The token will be passed in the `Authorization` header.
```yaml
- uses: actions/setup-node@v6

31
package-lock.json generated
View File

@@ -80,13 +80,13 @@
}
},
"node_modules/@actions/cache/node_modules/@actions/http-client": {
"version": "3.0.0",
"resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-3.0.0.tgz",
"integrity": "sha512-1s3tXAfVMSz9a4ZEBkXXRQD4QhY3+GAsWSbaYpeknPOKEeyRiU3lH+bHiLMZdo2x/fIeQ/hscL1wCkDLVM2DZQ==",
"version": "3.0.2",
"resolved": "https://registry.npmjs.org/@actions/http-client/-/http-client-3.0.2.tgz",
"integrity": "sha512-JP38FYYpyqvUsz+Igqlc/JG6YO9PaKuvqjM3iGvaLqFnJ7TFmcLyy2IDrY0bI0qCQug8E9K+elv5ZNfw62ZJzA==",
"license": "MIT",
"dependencies": {
"tunnel": "^0.0.6",
"undici": "^5.28.5"
"undici": "^6.23.0"
}
},
"node_modules/@actions/cache/node_modules/@actions/io": {
@@ -104,6 +104,15 @@
"semver": "bin/semver.js"
}
},
"node_modules/@actions/cache/node_modules/undici": {
"version": "6.23.0",
"resolved": "https://registry.npmjs.org/undici/-/undici-6.23.0.tgz",
"integrity": "sha512-VfQPToRA5FZs/qJxLIinmU59u0r7LXqoJkCzinq3ckNJp3vKEh7jTWN589YQ5+aoAC/TGRLyJLCPKcLQbM8r9g==",
"license": "MIT",
"engines": {
"node": ">=18.17"
}
},
"node_modules/@actions/core": {
"version": "1.11.1",
"resolved": "https://registry.npmjs.org/@actions/core/-/core-1.11.1.tgz",
@@ -1619,7 +1628,6 @@
"resolved": "https://registry.npmjs.org/@octokit/core/-/core-5.2.2.tgz",
"integrity": "sha512-/g2d4sW9nUDJOMz3mabVQvOGhVa4e/BN/Um7yca9Bb2XTzPPnfTWHWQg+IsEYO7M3Vx+EXvaM/I2pJWIMun1bg==",
"license": "MIT",
"peer": true,
"dependencies": {
"@octokit/auth-token": "^4.0.0",
"@octokit/graphql": "^7.1.0",
@@ -1953,7 +1961,6 @@
"integrity": "sha512-TiZzBSJja/LbhNPvk6yc0JrX9XqhQ0hdh6M2svYfsHGejaKFIAGd9MQ+ERIMzLGlN/kZoYIgdxFV0PuljTKXag==",
"dev": true,
"license": "MIT",
"peer": true,
"dependencies": {
"@eslint-community/regexpp": "^4.4.0",
"@typescript-eslint/scope-manager": "5.62.0",
@@ -1989,7 +1996,6 @@
"integrity": "sha512-VlJEV0fOQ7BExOsHYAGrgbEiZoi8D+Bl2+f6V2RrXerRSylnp+ZBHmPvaIa8cz0Ajx7WO7Z5RqfgYg7ED1nRhA==",
"dev": true,
"license": "BSD-2-Clause",
"peer": true,
"dependencies": {
"@typescript-eslint/scope-manager": "5.62.0",
"@typescript-eslint/types": "5.62.0",
@@ -2182,7 +2188,6 @@
"integrity": "sha512-NZyJarBfL7nWwIq+FDL6Zp/yHEhePMNnnJ0y3qfieCrmNvYct8uvtiV41UvlSe6apAfk0fY1FbWx+NwfmpvtTg==",
"dev": true,
"license": "MIT",
"peer": true,
"bin": {
"acorn": "bin/acorn"
},
@@ -2503,7 +2508,6 @@
}
],
"license": "MIT",
"peer": true,
"dependencies": {
"baseline-browser-mapping": "^2.9.0",
"caniuse-lite": "^1.0.30001759",
@@ -2910,7 +2914,6 @@
"deprecated": "This version is no longer supported. Please see https://eslint.org/version-support for other options.",
"dev": true,
"license": "MIT",
"peer": true,
"dependencies": {
"@eslint-community/eslint-utils": "^4.2.0",
"@eslint-community/regexpp": "^4.6.1",
@@ -3340,9 +3343,9 @@
"license": "MIT"
},
"node_modules/fast-xml-parser": {
"version": "5.3.3",
"resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.3.3.tgz",
"integrity": "sha512-2O3dkPAAC6JavuMm8+4+pgTk+5hoAs+CjZ+sWcQLkX9+/tHRuTkQh/Oaifr8qDmZ8iEHb771Ea6G8CdwkrgvYA==",
"version": "5.3.4",
"resolved": "https://registry.npmjs.org/fast-xml-parser/-/fast-xml-parser-5.3.4.tgz",
"integrity": "sha512-EFd6afGmXlCx8H8WTZHhAoDaWaGyuIBoZJ2mknrNxug+aZKjkp0a0dlars9Izl+jF+7Gu1/5f/2h68cQpe0IiA==",
"funding": [
{
"type": "github",
@@ -3950,7 +3953,6 @@
"integrity": "sha512-NIy3oAFp9shda19hy4HK0HRTWKtPJmGdnvywu01nOqNC2vZg+Z+fvJDxpMQA88eb2I9EcafcdjYgsDthnYTvGw==",
"dev": true,
"license": "MIT",
"peer": true,
"dependencies": {
"@jest/core": "^29.7.0",
"@jest/types": "^29.6.3",
@@ -5789,7 +5791,6 @@
"integrity": "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==",
"dev": true,
"license": "Apache-2.0",
"peer": true,
"bin": {
"tsc": "bin/tsc",
"tsserver": "bin/tsserver"

View File

@@ -40,11 +40,32 @@ export const supportedPackageManagers: SupportedPackageManagers = {
name: 'yarn',
lockFilePatterns: ['yarn.lock'],
getCacheFolderPath: async projectDir => {
const yarnVersion = await getCommandOutputNotEmpty(
`yarn --version`,
'Could not retrieve version of yarn',
projectDir
);
// Try to enable corepack first if available
// This helps with yarn v2+ which requires corepack
await enableCorepackIfSupported();
let yarnVersion: string;
try {
yarnVersion = await getCommandOutputNotEmpty(
`yarn --version`,
'Could not retrieve version of yarn',
projectDir
);
} catch (err) {
// Check if this is a corepack error message
const errorMsg = (err as Error).message;
if (
errorMsg.includes('packageManager') &&
errorMsg.includes('Corepack')
) {
throw new Error(
`Yarn v4+ requires corepack to be enabled. Please run 'corepack enable' before using ` +
`actions/setup-node with yarn, or disable caching with 'package-manager-cache: false'. ` +
`See: https://github.com/actions/setup-node/issues/1027 for more information.`
);
}
throw err;
}
core.debug(
`Consumed yarn version is ${yarnVersion} (working dir: "${
@@ -66,6 +87,24 @@ export const supportedPackageManagers: SupportedPackageManagers = {
}
};
/**
* Tries to enable corepack for Node.js versions that support it (16.9+)
* This helps with yarn v2+ which requires corepack
* See: https://github.com/actions/setup-node/issues/1027
*/
const enableCorepackIfSupported = async (): Promise<void> => {
try {
await exec.exec('corepack', ['enable'], {
ignoreReturnCode: true,
silent: true
});
core.debug('Corepack enabled successfully');
} catch {
// Corepack not available or failed silently
core.debug('Corepack not available on this system');
}
};
export const getCommandOutput = async (
toolCommand: string,
cwd?: string

View File

@@ -103,7 +103,7 @@ export default abstract class BaseDistribution {
const headers = {};
if (this.nodeInfo.mirrorToken) {
headers['Authorization'] = `Bearer ${this.nodeInfo.mirrorToken}`;
headers['Authorization'] = this.nodeInfo.mirrorToken;
}
const response = await this.httpClient.getJson<INodeVersion[]>(

View File

@@ -26,6 +26,18 @@ export function getNodeVersionFromFile(versionFilePath: string): string | null {
return manifest.volta.node;
}
// support devEngines from npm 11
if (manifest.devEngines?.runtime) {
// find an entry with name set to node and having set a version.
// the devEngines.runtime can either be an object or an array of objects
const nodeEntry = [manifest.devEngines.runtime]
.flat()
.find(({name, version}) => name?.toLowerCase() === 'node' && version);
if (nodeEntry) {
return nodeEntry.version;
}
}
if (manifest.engines?.node) {
return manifest.engines.node;
}