From 6e2e32e729daccb04c7e0109766200a4f69dc3e8 Mon Sep 17 00:00:00 2001 From: Philip Gai Date: Wed, 15 Jul 2026 16:16:17 -0500 Subject: [PATCH] chore(deps): bump @actions/cache to 6.2.0 (#1128) * chore(deps): bump @actions/cache to 6.2.0 Bump @actions/cache from ^6.1.0 to ^6.2.0 and rebuild the vendored dist/ bundles. 6.2.0 honors ACTIONS_CACHE_MODE to skip restore/save when the effective cache-mode disallows it, and surfaces a core.warning (instead of failing the run) when the cache service denies a read/write due to token scopes. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0046a2b8-0238-4ac6-93f6-70c4e60b5630 * chore: update licensed record for @actions/cache 6.2.0 Refresh the cached licensed dependency record so the version matches the bumped @actions/cache 6.2.0. License text, summary, and homepage are unchanged; only the version field was stale, which failed the "Check licenses" CI job. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0046a2b8-0238-4ac6-93f6-70c4e60b5630 --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Bruno Borges --- .licenses/npm/@actions/cache.dep.yml | 2 +- dist/cleanup/index.js | 144 +++++++++++++++++++++------ dist/setup/index.js | 144 +++++++++++++++++++++------ package-lock.json | 38 +------ package.json | 2 +- 5 files changed, 236 insertions(+), 94 deletions(-) diff --git a/.licenses/npm/@actions/cache.dep.yml b/.licenses/npm/@actions/cache.dep.yml index 1ce82e83..9433ea0f 100644 --- a/.licenses/npm/@actions/cache.dep.yml +++ b/.licenses/npm/@actions/cache.dep.yml @@ -1,6 +1,6 @@ --- name: "@actions/cache" -version: 6.1.0 +version: 6.2.0 type: npm summary: Actions cache lib homepage: https://github.com/actions/toolkit/tree/main/packages/cache diff --git a/dist/cleanup/index.js b/dist/cleanup/index.js index 40b7bac3..35ee3747 100644 --- a/dist/cleanup/index.js +++ b/dist/cleanup/index.js @@ -39023,7 +39023,7 @@ module.exports = { version: packageJson.version } /***/ 4012: /***/ ((module) => { -module.exports = /*#__PURE__*/JSON.parse('{"name":"@actions/cache","version":"6.1.0","description":"Actions cache lib","keywords":["github","actions","cache"],"homepage":"https://github.com/actions/toolkit/tree/main/packages/cache","license":"MIT","type":"module","main":"lib/cache.js","types":"lib/cache.d.ts","exports":{".":{"types":"./lib/cache.d.ts","import":"./lib/cache.js"}},"directories":{"lib":"lib","test":"__tests__"},"files":["lib","!.DS_Store"],"publishConfig":{"access":"public"},"repository":{"type":"git","url":"git+https://github.com/actions/toolkit.git","directory":"packages/cache"},"scripts":{"audit-moderate":"npm install && npm audit --json --audit-level=moderate > audit.json","test":"echo \\"Error: run tests from root\\" && exit 1","tsc":"tsc && cp src/internal/shared/package-version.cjs lib/internal/shared/"},"bugs":{"url":"https://github.com/actions/toolkit/issues"},"dependencies":{"@actions/core":"^3.0.1","@actions/exec":"^3.0.0","@actions/glob":"^0.6.1","@actions/http-client":"^4.0.1","@actions/io":"^3.0.2","@azure/core-rest-pipeline":"^1.23.0","@azure/storage-blob":"^12.31.0","@protobuf-ts/runtime-rpc":"^2.11.1","semver":"^7.7.4"},"devDependencies":{"@protobuf-ts/plugin":"^2.11.1","@types/node":"^25.6.0","@types/semver":"^7.7.1","typescript":"^5.9.3"},"overrides":{"uri-js":"npm:uri-js-replace@^1.0.1","node-fetch":"^3.3.2"}}'); +module.exports = /*#__PURE__*/JSON.parse('{"name":"@actions/cache","version":"6.2.0","description":"Actions cache lib","keywords":["github","actions","cache"],"homepage":"https://github.com/actions/toolkit/tree/main/packages/cache","license":"MIT","type":"module","main":"lib/cache.js","types":"lib/cache.d.ts","exports":{".":{"types":"./lib/cache.d.ts","import":"./lib/cache.js"}},"directories":{"lib":"lib","test":"__tests__"},"files":["lib","!.DS_Store"],"publishConfig":{"access":"public"},"repository":{"type":"git","url":"git+https://github.com/actions/toolkit.git","directory":"packages/cache"},"scripts":{"audit-moderate":"npm install && npm audit --json --audit-level=moderate > audit.json","test":"echo \\"Error: run tests from root\\" && exit 1","tsc":"tsc && cp src/internal/shared/package-version.cjs lib/internal/shared/"},"bugs":{"url":"https://github.com/actions/toolkit/issues"},"dependencies":{"@actions/core":"^3.0.1","@actions/exec":"^3.0.0","@actions/glob":"^0.6.1","@actions/http-client":"^4.0.1","@actions/io":"^3.0.2","@azure/core-rest-pipeline":"^1.23.0","@azure/storage-blob":"^12.31.0","@protobuf-ts/runtime-rpc":"^2.11.1","semver":"^7.7.4"},"devDependencies":{"@protobuf-ts/plugin":"^2.11.1","@types/node":"^25.6.0","@types/semver":"^7.7.1","typescript":"^5.9.3"},"overrides":{"uri-js":"npm:uri-js-replace@^1.0.1","node-fetch":"^3.3.2"}}'); /***/ }) @@ -44068,6 +44068,10 @@ const SystemTarPathOnWindows = `${process.env['SYSTEMDRIVE']}\\Windows\\System32 const TarFilename = 'cache.tar'; const ManifestFilename = 'manifest.txt'; const CacheFileSizeLimit = 10 * Math.pow(1024, 3); // 10GiB per repository +// Prefix the cache backend embeds in a read-denial message (v2 twirp +// GetCacheEntryDownloadURL error or the GHES v1 `_apis/artifactcache` 403 body). +// Shared so cache.ts and cacheHttpClient.ts match the same contract value. +const constants_CacheReadDeniedMessagePrefix = 'cache read denied:'; //# sourceMappingURL=constants.js.map ;// CONCATENATED MODULE: ./node_modules/@actions/cache/lib/internal/cacheUtils.js var cacheUtils_awaiter = (undefined && undefined.__awaiter) || function (thisArg, _arguments, P, generator) { @@ -93948,6 +93952,24 @@ function config_getCacheServiceVersion() { return 'v1'; return process.env['ACTIONS_CACHE_SERVICE_V2'] ? 'v2' : 'v1'; } +// The cache-mode lattice: readable = {read, write}, writable = {write, +// write-only}, none = neither. +const KNOWN_CACHE_MODES = ['none', 'read', 'write', 'write-only']; +// The effective cache-mode exported by the runner, or '' when not set. +function config_getCacheMode() { + return (process.env['ACTIONS_CACHE_MODE'] || '').trim().toLowerCase(); +} +// Unset or unrecognized modes are permissive so behavior matches today. +function config_isCacheReadable(mode) { + if (!KNOWN_CACHE_MODES.includes(mode)) + return true; + return mode === 'read' || mode === 'write'; +} +function isCacheWritable(mode) { + if (!KNOWN_CACHE_MODES.includes(mode)) + return true; + return mode === 'write' || mode === 'write-only'; +} function getCacheServiceURL() { const version = config_getCacheServiceVersion(); // Based on the version of the cache service, we will determine which @@ -93997,6 +94019,7 @@ var cacheHttpClient_awaiter = (undefined && undefined.__awaiter) || function (th + function getCacheApiUrl(resource) { const baseUrl = getCacheServiceURL(); if (!baseUrl) { @@ -94024,6 +94047,7 @@ function createHttpClient() { } function getCacheEntry(keys, paths, options) { return cacheHttpClient_awaiter(this, void 0, void 0, function* () { + var _a; const httpClient = createHttpClient(); const version = utils.getCacheVersion(paths, options === null || options === void 0 ? void 0 : options.compressionMethod, options === null || options === void 0 ? void 0 : options.enableCrossOsArchive); const resource = `cache?keys=${encodeURIComponent(keys.join(','))}&version=${version}`; @@ -94037,6 +94061,12 @@ function getCacheEntry(keys, paths, options) { return null; } if (!isSuccessStatusCode(response.statusCode)) { + // Only surface the receiver's body for a `cache read denied:` policy denial + // so callers can dispatch on it; keep the generic message otherwise. + const errorMessage = (_a = response.error) === null || _a === void 0 ? void 0 : _a.message; + if (errorMessage === null || errorMessage === void 0 ? void 0 : errorMessage.includes(CacheReadDeniedMessagePrefix)) { + throw new Error(errorMessage); + } throw new Error(`Cache service responded with ${response.statusCode}`); } const cacheResult = response.result; @@ -95297,6 +95327,7 @@ var cache_awaiter = (undefined && undefined.__awaiter) || function (thisArg, _ar + class ValidationError extends Error { constructor(message) { super(message); @@ -95312,19 +95343,20 @@ class ReserveCacheError extends Error { } } /** - * Stable prefix the receiver writes into the cache reservation response when - * the issuer downgraded the cache token to read-only (for example, because + * Stable prefix the cache service writes into the cache reservation response + * when the issuer downgraded the cache token to read-only (for example, because * the run was triggered by an untrusted event). saveCacheV1 / saveCacheV2 - * dispatch on this prefix to re-classify the failure as a - * CacheWriteDeniedError so consumers (and the outer catch arm) can - * distinguish a policy denial from other reservation failures. + * dispatch on this prefix to re-classify the failure as a CacheWriteDeniedError + * so consumers and tests can distinguish a policy denial from other reservation + * failures. Internally it is logged as a non-fatal warning like other + * best-effort save failures. */ const CACHE_WRITE_DENIED_PREFIX = 'cache write denied:'; /** * Raised when the cache backend refuses to reserve a writable cache entry * because the JWT issued for this run was scoped read-only (for example, the * run was triggered by an event the repository administrator classified as - * untrusted). The receiver-supplied detail message always begins with + * untrusted). The service-supplied detail message always begins with * `cache write denied:` (the full error message includes additional context * like the cache key). * @@ -95340,6 +95372,19 @@ class CacheWriteDeniedError extends ReserveCacheError { Object.setPrototypeOf(this, CacheWriteDeniedError.prototype); } } +// Re-exported from constants so consumers keep referencing it here; the shared +// value also drives detection in cacheHttpClient without duplicating the string. +const CACHE_READ_DENIED_PREFIX = (/* unused pure expression or super */ null && (CacheReadDeniedMessagePrefix)); +// Raised when the cache backend denies a download URL because the run's token +// has no readable cache scopes. Caching is best-effort, so restoreCache logs a +// warning and reports a cache miss rather than rethrowing this. +class CacheReadDeniedError extends Error { + constructor(message) { + super(message); + this.name = 'CacheReadDeniedError'; + Object.setPrototypeOf(this, CacheReadDeniedError.prototype); + } +} class FinalizeCacheError extends Error { constructor(message) { super(message); @@ -95394,6 +95439,12 @@ function restoreCache(paths_1, primaryKey_1, restoreKeys_1, options_1) { const cacheServiceVersion = getCacheServiceVersion(); core.debug(`Cache service version: ${cacheServiceVersion}`); checkPaths(paths); + const cacheMode = getCacheMode(); + if (!isCacheReadable(cacheMode)) { + core.info(`Cache restore skipped: the effective cache-mode '${cacheMode}' does not permit reads.`); + core.debug(`Skipped restore for paths [${paths.join(', ')}] with primary key '${primaryKey}'.`); + return undefined; + } switch (cacheServiceVersion) { case 'v2': return yield restoreCacheV2(paths, primaryKey, restoreKeys, options, enableCrossOsArchive); @@ -95415,6 +95466,7 @@ function restoreCache(paths_1, primaryKey_1, restoreKeys_1, options_1) { */ function restoreCacheV1(paths_1, primaryKey_1, restoreKeys_1, options_1) { return cache_awaiter(this, arguments, void 0, function* (paths, primaryKey, restoreKeys, options, enableCrossOsArchive = false) { + var _a; restoreKeys = restoreKeys || []; const keys = [primaryKey, ...restoreKeys]; core.debug('Resolved Keys:'); @@ -95429,10 +95481,26 @@ function restoreCacheV1(paths_1, primaryKey_1, restoreKeys_1, options_1) { let archivePath = ''; try { // path are needed to compute version - const cacheEntry = yield cacheHttpClient.getCacheEntry(keys, paths, { - compressionMethod, - enableCrossOsArchive - }); + let cacheEntry; + try { + cacheEntry = yield cacheHttpClient.getCacheEntry(keys, paths, { + compressionMethod, + enableCrossOsArchive + }); + } + catch (error) { + // The v1 artifact cache service returns HTTP 403 with a + // `cache read denied:` body when the run's token has no readable cache + // scopes. getCacheEntry lives in a dependency-free internal module and + // cannot import CacheReadDeniedError without a circular dependency, so it + // only surfaces the raw denial message; we classify it into the typed + // error here so the outer catch and consumers can dispatch on it. + const errorMessage = (_a = error === null || error === void 0 ? void 0 : error.message) !== null && _a !== void 0 ? _a : ''; + if (errorMessage.includes(CACHE_READ_DENIED_PREFIX)) { + throw new CacheReadDeniedError(errorMessage); + } + throw error; + } if (!(cacheEntry === null || cacheEntry === void 0 ? void 0 : cacheEntry.archiveLocation)) { // Cache not found return undefined; @@ -95461,7 +95529,9 @@ function restoreCacheV1(paths_1, primaryKey_1, restoreKeys_1, options_1) { } else { // warn on cache restore failure and continue build - // Log server errors (5xx) as errors, all other errors as warnings + // Log server errors (5xx) as errors, all other errors as warnings. + // A read denied by policy (CacheReadDeniedError) is not an HttpClientError + // so it falls here and is warned, treated as a cache miss. if (typedError instanceof HttpClientError && typeof typedError.statusCode === 'number' && typedError.statusCode >= 500) { @@ -95496,6 +95566,7 @@ function restoreCacheV1(paths_1, primaryKey_1, restoreKeys_1, options_1) { */ function restoreCacheV2(paths_1, primaryKey_1, restoreKeys_1, options_1) { return cache_awaiter(this, arguments, void 0, function* (paths, primaryKey, restoreKeys, options, enableCrossOsArchive = false) { + var _a; // Override UploadOptions to force the use of Azure options = Object.assign(Object.assign({}, options), { useAzureSdk: true }); restoreKeys = restoreKeys || []; @@ -95517,7 +95588,20 @@ function restoreCacheV2(paths_1, primaryKey_1, restoreKeys_1, options_1) { restoreKeys, version: utils.getCacheVersion(paths, compressionMethod, enableCrossOsArchive) }; - const response = yield twirpClient.GetCacheEntryDownloadURL(request); + let response; + try { + response = yield twirpClient.GetCacheEntryDownloadURL(request); + } + catch (error) { + // The receiver returns twirp PermissionDenied (403) when the run's token + // has no readable cache scopes. The client wraps that 403, so the stable + // prefix is embedded in the message rather than leading it. + const errorMessage = (_a = error === null || error === void 0 ? void 0 : error.message) !== null && _a !== void 0 ? _a : ''; + if (errorMessage.includes(CACHE_READ_DENIED_PREFIX)) { + throw new CacheReadDeniedError(errorMessage); + } + throw error; + } if (!response.ok) { core.debug(`Cache not found for version ${request.version} of keys: ${keys.join(', ')}`); return undefined; @@ -95552,8 +95636,10 @@ function restoreCacheV2(paths_1, primaryKey_1, restoreKeys_1, options_1) { throw error; } else { - // Supress all non-validation cache related errors because caching should be optional - // Log server errors (5xx) as errors, all other errors as warnings + // Suppress all non-validation cache related errors because caching should be optional + // Log server errors (5xx) as errors, all other errors as warnings. + // A read denied by policy (CacheReadDeniedError) is not an HttpClientError + // so it falls here and is warned, treated as a cache miss. if (typedError instanceof HttpClientError && typeof typedError.statusCode === 'number' && typedError.statusCode >= 500) { @@ -95592,6 +95678,12 @@ function cache_saveCache(paths_1, key_1, options_1) { core_debug(`Cache service version: ${cacheServiceVersion}`); checkPaths(paths); checkKey(key); + const cacheMode = config_getCacheMode(); + if (!isCacheWritable(cacheMode)) { + info(`Cache save skipped: the effective cache-mode '${cacheMode}' does not permit writes.`); + core_debug(`Skipped save for paths [${paths.join(', ')}] with key '${key}'.`); + return -1; + } switch (cacheServiceVersion) { case 'v2': return yield saveCacheV2(paths, key, options, enableCrossOsArchive); @@ -95669,17 +95761,14 @@ function saveCacheV1(paths_1, key_1, options_1) { if (typedError.name === ValidationError.name) { throw error; } - else if (typedError.name === CacheWriteDeniedError.name) { - // Cache write was denied by policy (read-only token). Surface to the - // customer at warning level so it is visible in the workflow log - // without failing the run. - warning(`Failed to save: ${typedError.message}`); - } else if (typedError.name === ReserveCacheError.name) { info(`Failed to save: ${typedError.message}`); } else { - // Log server errors (5xx) as errors, all other errors as warnings + // Log server errors (5xx) as errors, all other errors as warnings. + // A write denied by policy (CacheWriteDeniedError) is not an + // HttpClientError and its name does not match the ReserveCacheError arm, + // so it falls here and is warned without failing the run. if (typedError instanceof lib_HttpClientError && typeof typedError.statusCode === 'number' && typedError.statusCode >= 500) { @@ -95790,12 +95879,6 @@ function saveCacheV2(paths_1, key_1, options_1) { if (typedError.name === ValidationError.name) { throw error; } - else if (typedError.name === CacheWriteDeniedError.name) { - // Cache write was denied by policy (read-only token). Surface to the - // customer at warning level so it is visible in the workflow log - // without failing the run. - warning(`Failed to save: ${typedError.message}`); - } else if (typedError.name === ReserveCacheError.name) { info(`Failed to save: ${typedError.message}`); } @@ -95803,7 +95886,10 @@ function saveCacheV2(paths_1, key_1, options_1) { warning(typedError.message); } else { - // Log server errors (5xx) as errors, all other errors as warnings + // Log server errors (5xx) as errors, all other errors as warnings. + // A write denied by policy (CacheWriteDeniedError) is not an + // HttpClientError and its name does not match the ReserveCacheError arm, + // so it falls here and is warned without failing the run. if (typedError instanceof lib_HttpClientError && typeof typedError.statusCode === 'number' && typedError.statusCode >= 500) { diff --git a/dist/setup/index.js b/dist/setup/index.js index ee21689e..680bf87a 100644 --- a/dist/setup/index.js +++ b/dist/setup/index.js @@ -70021,7 +70021,7 @@ module.exports = { version: packageJson.version } /***/ 4012: /***/ ((module) => { -module.exports = /*#__PURE__*/JSON.parse('{"name":"@actions/cache","version":"6.1.0","description":"Actions cache lib","keywords":["github","actions","cache"],"homepage":"https://github.com/actions/toolkit/tree/main/packages/cache","license":"MIT","type":"module","main":"lib/cache.js","types":"lib/cache.d.ts","exports":{".":{"types":"./lib/cache.d.ts","import":"./lib/cache.js"}},"directories":{"lib":"lib","test":"__tests__"},"files":["lib","!.DS_Store"],"publishConfig":{"access":"public"},"repository":{"type":"git","url":"git+https://github.com/actions/toolkit.git","directory":"packages/cache"},"scripts":{"audit-moderate":"npm install && npm audit --json --audit-level=moderate > audit.json","test":"echo \\"Error: run tests from root\\" && exit 1","tsc":"tsc && cp src/internal/shared/package-version.cjs lib/internal/shared/"},"bugs":{"url":"https://github.com/actions/toolkit/issues"},"dependencies":{"@actions/core":"^3.0.1","@actions/exec":"^3.0.0","@actions/glob":"^0.6.1","@actions/http-client":"^4.0.1","@actions/io":"^3.0.2","@azure/core-rest-pipeline":"^1.23.0","@azure/storage-blob":"^12.31.0","@protobuf-ts/runtime-rpc":"^2.11.1","semver":"^7.7.4"},"devDependencies":{"@protobuf-ts/plugin":"^2.11.1","@types/node":"^25.6.0","@types/semver":"^7.7.1","typescript":"^5.9.3"},"overrides":{"uri-js":"npm:uri-js-replace@^1.0.1","node-fetch":"^3.3.2"}}'); +module.exports = /*#__PURE__*/JSON.parse('{"name":"@actions/cache","version":"6.2.0","description":"Actions cache lib","keywords":["github","actions","cache"],"homepage":"https://github.com/actions/toolkit/tree/main/packages/cache","license":"MIT","type":"module","main":"lib/cache.js","types":"lib/cache.d.ts","exports":{".":{"types":"./lib/cache.d.ts","import":"./lib/cache.js"}},"directories":{"lib":"lib","test":"__tests__"},"files":["lib","!.DS_Store"],"publishConfig":{"access":"public"},"repository":{"type":"git","url":"git+https://github.com/actions/toolkit.git","directory":"packages/cache"},"scripts":{"audit-moderate":"npm install && npm audit --json --audit-level=moderate > audit.json","test":"echo \\"Error: run tests from root\\" && exit 1","tsc":"tsc && cp src/internal/shared/package-version.cjs lib/internal/shared/"},"bugs":{"url":"https://github.com/actions/toolkit/issues"},"dependencies":{"@actions/core":"^3.0.1","@actions/exec":"^3.0.0","@actions/glob":"^0.6.1","@actions/http-client":"^4.0.1","@actions/io":"^3.0.2","@azure/core-rest-pipeline":"^1.23.0","@azure/storage-blob":"^12.31.0","@protobuf-ts/runtime-rpc":"^2.11.1","semver":"^7.7.4"},"devDependencies":{"@protobuf-ts/plugin":"^2.11.1","@types/node":"^25.6.0","@types/semver":"^7.7.1","typescript":"^5.9.3"},"overrides":{"uri-js":"npm:uri-js-replace@^1.0.1","node-fetch":"^3.3.2"}}'); /***/ }) @@ -75101,6 +75101,10 @@ const SystemTarPathOnWindows = `${process.env['SYSTEMDRIVE']}\\Windows\\System32 const TarFilename = 'cache.tar'; const constants_ManifestFilename = 'manifest.txt'; const CacheFileSizeLimit = 10 * Math.pow(1024, 3); // 10GiB per repository +// Prefix the cache backend embeds in a read-denial message (v2 twirp +// GetCacheEntryDownloadURL error or the GHES v1 `_apis/artifactcache` 403 body). +// Shared so cache.ts and cacheHttpClient.ts match the same contract value. +const CacheReadDeniedMessagePrefix = 'cache read denied:'; //# sourceMappingURL=constants.js.map ;// CONCATENATED MODULE: ./node_modules/@actions/cache/lib/internal/cacheUtils.js var cacheUtils_awaiter = (undefined && undefined.__awaiter) || function (thisArg, _arguments, P, generator) { @@ -124982,6 +124986,24 @@ function config_getCacheServiceVersion() { return 'v1'; return process.env['ACTIONS_CACHE_SERVICE_V2'] ? 'v2' : 'v1'; } +// The cache-mode lattice: readable = {read, write}, writable = {write, +// write-only}, none = neither. +const KNOWN_CACHE_MODES = ['none', 'read', 'write', 'write-only']; +// The effective cache-mode exported by the runner, or '' when not set. +function config_getCacheMode() { + return (process.env['ACTIONS_CACHE_MODE'] || '').trim().toLowerCase(); +} +// Unset or unrecognized modes are permissive so behavior matches today. +function isCacheReadable(mode) { + if (!KNOWN_CACHE_MODES.includes(mode)) + return true; + return mode === 'read' || mode === 'write'; +} +function config_isCacheWritable(mode) { + if (!KNOWN_CACHE_MODES.includes(mode)) + return true; + return mode === 'write' || mode === 'write-only'; +} function getCacheServiceURL() { const version = config_getCacheServiceVersion(); // Based on the version of the cache service, we will determine which @@ -125031,6 +125053,7 @@ var cacheHttpClient_awaiter = (undefined && undefined.__awaiter) || function (th + function getCacheApiUrl(resource) { const baseUrl = getCacheServiceURL(); if (!baseUrl) { @@ -125058,6 +125081,7 @@ function createHttpClient() { } function getCacheEntry(keys, paths, options) { return cacheHttpClient_awaiter(this, void 0, void 0, function* () { + var _a; const httpClient = createHttpClient(); const version = getCacheVersion(paths, options === null || options === void 0 ? void 0 : options.compressionMethod, options === null || options === void 0 ? void 0 : options.enableCrossOsArchive); const resource = `cache?keys=${encodeURIComponent(keys.join(','))}&version=${version}`; @@ -125071,6 +125095,12 @@ function getCacheEntry(keys, paths, options) { return null; } if (!requestUtils_isSuccessStatusCode(response.statusCode)) { + // Only surface the receiver's body for a `cache read denied:` policy denial + // so callers can dispatch on it; keep the generic message otherwise. + const errorMessage = (_a = response.error) === null || _a === void 0 ? void 0 : _a.message; + if (errorMessage === null || errorMessage === void 0 ? void 0 : errorMessage.includes(CacheReadDeniedMessagePrefix)) { + throw new Error(errorMessage); + } throw new Error(`Cache service responded with ${response.statusCode}`); } const cacheResult = response.result; @@ -126332,6 +126362,7 @@ var cache_awaiter = (undefined && undefined.__awaiter) || function (thisArg, _ar + class ValidationError extends Error { constructor(message) { super(message); @@ -126347,19 +126378,20 @@ class ReserveCacheError extends Error { } } /** - * Stable prefix the receiver writes into the cache reservation response when - * the issuer downgraded the cache token to read-only (for example, because + * Stable prefix the cache service writes into the cache reservation response + * when the issuer downgraded the cache token to read-only (for example, because * the run was triggered by an untrusted event). saveCacheV1 / saveCacheV2 - * dispatch on this prefix to re-classify the failure as a - * CacheWriteDeniedError so consumers (and the outer catch arm) can - * distinguish a policy denial from other reservation failures. + * dispatch on this prefix to re-classify the failure as a CacheWriteDeniedError + * so consumers and tests can distinguish a policy denial from other reservation + * failures. Internally it is logged as a non-fatal warning like other + * best-effort save failures. */ const CACHE_WRITE_DENIED_PREFIX = 'cache write denied:'; /** * Raised when the cache backend refuses to reserve a writable cache entry * because the JWT issued for this run was scoped read-only (for example, the * run was triggered by an event the repository administrator classified as - * untrusted). The receiver-supplied detail message always begins with + * untrusted). The service-supplied detail message always begins with * `cache write denied:` (the full error message includes additional context * like the cache key). * @@ -126375,6 +126407,19 @@ class CacheWriteDeniedError extends ReserveCacheError { Object.setPrototypeOf(this, CacheWriteDeniedError.prototype); } } +// Re-exported from constants so consumers keep referencing it here; the shared +// value also drives detection in cacheHttpClient without duplicating the string. +const CACHE_READ_DENIED_PREFIX = CacheReadDeniedMessagePrefix; +// Raised when the cache backend denies a download URL because the run's token +// has no readable cache scopes. Caching is best-effort, so restoreCache logs a +// warning and reports a cache miss rather than rethrowing this. +class CacheReadDeniedError extends Error { + constructor(message) { + super(message); + this.name = 'CacheReadDeniedError'; + Object.setPrototypeOf(this, CacheReadDeniedError.prototype); + } +} class FinalizeCacheError extends Error { constructor(message) { super(message); @@ -126429,6 +126474,12 @@ function restoreCache(paths_1, primaryKey_1, restoreKeys_1, options_1) { const cacheServiceVersion = config_getCacheServiceVersion(); core_debug(`Cache service version: ${cacheServiceVersion}`); checkPaths(paths); + const cacheMode = config_getCacheMode(); + if (!isCacheReadable(cacheMode)) { + info(`Cache restore skipped: the effective cache-mode '${cacheMode}' does not permit reads.`); + core_debug(`Skipped restore for paths [${paths.join(', ')}] with primary key '${primaryKey}'.`); + return undefined; + } switch (cacheServiceVersion) { case 'v2': return yield restoreCacheV2(paths, primaryKey, restoreKeys, options, enableCrossOsArchive); @@ -126450,6 +126501,7 @@ function restoreCache(paths_1, primaryKey_1, restoreKeys_1, options_1) { */ function restoreCacheV1(paths_1, primaryKey_1, restoreKeys_1, options_1) { return cache_awaiter(this, arguments, void 0, function* (paths, primaryKey, restoreKeys, options, enableCrossOsArchive = false) { + var _a; restoreKeys = restoreKeys || []; const keys = [primaryKey, ...restoreKeys]; core_debug('Resolved Keys:'); @@ -126464,10 +126516,26 @@ function restoreCacheV1(paths_1, primaryKey_1, restoreKeys_1, options_1) { let archivePath = ''; try { // path are needed to compute version - const cacheEntry = yield getCacheEntry(keys, paths, { - compressionMethod, - enableCrossOsArchive - }); + let cacheEntry; + try { + cacheEntry = yield getCacheEntry(keys, paths, { + compressionMethod, + enableCrossOsArchive + }); + } + catch (error) { + // The v1 artifact cache service returns HTTP 403 with a + // `cache read denied:` body when the run's token has no readable cache + // scopes. getCacheEntry lives in a dependency-free internal module and + // cannot import CacheReadDeniedError without a circular dependency, so it + // only surfaces the raw denial message; we classify it into the typed + // error here so the outer catch and consumers can dispatch on it. + const errorMessage = (_a = error === null || error === void 0 ? void 0 : error.message) !== null && _a !== void 0 ? _a : ''; + if (errorMessage.includes(CACHE_READ_DENIED_PREFIX)) { + throw new CacheReadDeniedError(errorMessage); + } + throw error; + } if (!(cacheEntry === null || cacheEntry === void 0 ? void 0 : cacheEntry.archiveLocation)) { // Cache not found return undefined; @@ -126496,7 +126564,9 @@ function restoreCacheV1(paths_1, primaryKey_1, restoreKeys_1, options_1) { } else { // warn on cache restore failure and continue build - // Log server errors (5xx) as errors, all other errors as warnings + // Log server errors (5xx) as errors, all other errors as warnings. + // A read denied by policy (CacheReadDeniedError) is not an HttpClientError + // so it falls here and is warned, treated as a cache miss. if (typedError instanceof lib_HttpClientError && typeof typedError.statusCode === 'number' && typedError.statusCode >= 500) { @@ -126531,6 +126601,7 @@ function restoreCacheV1(paths_1, primaryKey_1, restoreKeys_1, options_1) { */ function restoreCacheV2(paths_1, primaryKey_1, restoreKeys_1, options_1) { return cache_awaiter(this, arguments, void 0, function* (paths, primaryKey, restoreKeys, options, enableCrossOsArchive = false) { + var _a; // Override UploadOptions to force the use of Azure options = Object.assign(Object.assign({}, options), { useAzureSdk: true }); restoreKeys = restoreKeys || []; @@ -126552,7 +126623,20 @@ function restoreCacheV2(paths_1, primaryKey_1, restoreKeys_1, options_1) { restoreKeys, version: getCacheVersion(paths, compressionMethod, enableCrossOsArchive) }; - const response = yield twirpClient.GetCacheEntryDownloadURL(request); + let response; + try { + response = yield twirpClient.GetCacheEntryDownloadURL(request); + } + catch (error) { + // The receiver returns twirp PermissionDenied (403) when the run's token + // has no readable cache scopes. The client wraps that 403, so the stable + // prefix is embedded in the message rather than leading it. + const errorMessage = (_a = error === null || error === void 0 ? void 0 : error.message) !== null && _a !== void 0 ? _a : ''; + if (errorMessage.includes(CACHE_READ_DENIED_PREFIX)) { + throw new CacheReadDeniedError(errorMessage); + } + throw error; + } if (!response.ok) { core_debug(`Cache not found for version ${request.version} of keys: ${keys.join(', ')}`); return undefined; @@ -126587,8 +126671,10 @@ function restoreCacheV2(paths_1, primaryKey_1, restoreKeys_1, options_1) { throw error; } else { - // Supress all non-validation cache related errors because caching should be optional - // Log server errors (5xx) as errors, all other errors as warnings + // Suppress all non-validation cache related errors because caching should be optional + // Log server errors (5xx) as errors, all other errors as warnings. + // A read denied by policy (CacheReadDeniedError) is not an HttpClientError + // so it falls here and is warned, treated as a cache miss. if (typedError instanceof lib_HttpClientError && typeof typedError.statusCode === 'number' && typedError.statusCode >= 500) { @@ -126627,6 +126713,12 @@ function cache_saveCache(paths_1, key_1, options_1) { core.debug(`Cache service version: ${cacheServiceVersion}`); checkPaths(paths); checkKey(key); + const cacheMode = getCacheMode(); + if (!isCacheWritable(cacheMode)) { + core.info(`Cache save skipped: the effective cache-mode '${cacheMode}' does not permit writes.`); + core.debug(`Skipped save for paths [${paths.join(', ')}] with key '${key}'.`); + return -1; + } switch (cacheServiceVersion) { case 'v2': return yield saveCacheV2(paths, key, options, enableCrossOsArchive); @@ -126704,17 +126796,14 @@ function saveCacheV1(paths_1, key_1, options_1) { if (typedError.name === ValidationError.name) { throw error; } - else if (typedError.name === CacheWriteDeniedError.name) { - // Cache write was denied by policy (read-only token). Surface to the - // customer at warning level so it is visible in the workflow log - // without failing the run. - core.warning(`Failed to save: ${typedError.message}`); - } else if (typedError.name === ReserveCacheError.name) { core.info(`Failed to save: ${typedError.message}`); } else { - // Log server errors (5xx) as errors, all other errors as warnings + // Log server errors (5xx) as errors, all other errors as warnings. + // A write denied by policy (CacheWriteDeniedError) is not an + // HttpClientError and its name does not match the ReserveCacheError arm, + // so it falls here and is warned without failing the run. if (typedError instanceof HttpClientError && typeof typedError.statusCode === 'number' && typedError.statusCode >= 500) { @@ -126825,12 +126914,6 @@ function saveCacheV2(paths_1, key_1, options_1) { if (typedError.name === ValidationError.name) { throw error; } - else if (typedError.name === CacheWriteDeniedError.name) { - // Cache write was denied by policy (read-only token). Surface to the - // customer at warning level so it is visible in the workflow log - // without failing the run. - core.warning(`Failed to save: ${typedError.message}`); - } else if (typedError.name === ReserveCacheError.name) { core.info(`Failed to save: ${typedError.message}`); } @@ -126838,7 +126921,10 @@ function saveCacheV2(paths_1, key_1, options_1) { core.warning(typedError.message); } else { - // Log server errors (5xx) as errors, all other errors as warnings + // Log server errors (5xx) as errors, all other errors as warnings. + // A write denied by policy (CacheWriteDeniedError) is not an + // HttpClientError and its name does not match the ReserveCacheError arm, + // so it falls here and is warned without failing the run. if (typedError instanceof HttpClientError && typeof typedError.statusCode === 'number' && typedError.statusCode >= 500) { diff --git a/package-lock.json b/package-lock.json index fcf8753f..19dfa942 100644 --- a/package-lock.json +++ b/package-lock.json @@ -9,7 +9,7 @@ "version": "6.0.0", "license": "MIT", "dependencies": { - "@actions/cache": "^6.1.0", + "@actions/cache": "^6.2.0", "@actions/core": "^3.0.1", "@actions/exec": "^3.0.0", "@actions/glob": "^0.7.0", @@ -44,9 +44,9 @@ } }, "node_modules/@actions/cache": { - "version": "6.1.0", - "resolved": "https://registry.npmjs.org/@actions/cache/-/cache-6.1.0.tgz", - "integrity": "sha512-LVqybSbzhBp2uAETOQ3HnVjXA4AcjavgMH+LCr+cjgO+PZfciv/1QAgoW+esXBaAhvDid+vXeV70GGJpAh4V5Q==", + "version": "6.2.0", + "resolved": "https://registry.npmjs.org/@actions/cache/-/cache-6.2.0.tgz", + "integrity": "sha512-Nv0xWRmbxfDbAn/70flO/F6tj2Nv4XTYMAsQHiDFSojCDfso/Zni+fRKa14ToI9hnmOW/rQcY1WYb6wsM7Pgwg==", "license": "MIT", "dependencies": { "@actions/core": "^3.0.1", @@ -2365,9 +2365,6 @@ "arm64" ], "dev": true, - "libc": [ - "glibc" - ], "license": "MIT", "optional": true, "os": [ @@ -2382,9 +2379,6 @@ "arm64" ], "dev": true, - "libc": [ - "musl" - ], "license": "MIT", "optional": true, "os": [ @@ -2399,9 +2393,6 @@ "loong64" ], "dev": true, - "libc": [ - "glibc" - ], "license": "MIT", "optional": true, "os": [ @@ -2416,9 +2407,6 @@ "loong64" ], "dev": true, - "libc": [ - "musl" - ], "license": "MIT", "optional": true, "os": [ @@ -2433,9 +2421,6 @@ "ppc64" ], "dev": true, - "libc": [ - "glibc" - ], "license": "MIT", "optional": true, "os": [ @@ -2450,9 +2435,6 @@ "riscv64" ], "dev": true, - "libc": [ - "glibc" - ], "license": "MIT", "optional": true, "os": [ @@ -2467,9 +2449,6 @@ "riscv64" ], "dev": true, - "libc": [ - "musl" - ], "license": "MIT", "optional": true, "os": [ @@ -2484,9 +2463,6 @@ "s390x" ], "dev": true, - "libc": [ - "glibc" - ], "license": "MIT", "optional": true, "os": [ @@ -2501,9 +2477,6 @@ "x64" ], "dev": true, - "libc": [ - "glibc" - ], "license": "MIT", "optional": true, "os": [ @@ -2518,9 +2491,6 @@ "x64" ], "dev": true, - "libc": [ - "musl" - ], "license": "MIT", "optional": true, "os": [ diff --git a/package.json b/package.json index cab9cdbd..31e88b55 100644 --- a/package.json +++ b/package.json @@ -42,7 +42,7 @@ "author": "GitHub", "license": "MIT", "dependencies": { - "@actions/cache": "^6.1.0", + "@actions/cache": "^6.2.0", "@actions/core": "^3.0.1", "@actions/exec": "^3.0.0", "@actions/glob": "^0.7.0",