refactor(actions): use the helpers provided by GitHub Script

Author: neilime

.github/workflows/__test-action-setup-node.yml

@@ -65,7 +65,7 @@ jobs:
             const path = require('node:path');
             const directory = fs.mkdtempSync(path.join(process.env.GITHUB_WORKSPACE, 'install-hooks-'));
             const dependency = path.join(directory, 'dependency');
-            fs.mkdirSync(dependency);
+            await io.mkdirP(dependency);
             const hook = `node -e "require('node:fs').writeFileSync('install-hook-ran', '')"`;
             fs.writeFileSync(path.join(dependency, 'package.json'), JSON.stringify({
               name: 'lifecycle-dependency', version: '1.0.0', scripts: { postinstall: hook },
@@ -78,7 +78,7 @@ jobs:
               dependencies: { 'lifecycle-dependency': 'file:./lifecycle-dependency-1.0.0.tgz' },
               scripts: { postinstall: hook, build: `node -e "require('node:fs').writeFileSync('build-ran', '')"` },
             }));
-            fs.copyFileSync('.node-version', path.join(directory, '.node-version'));
+            await io.cp('.node-version', path.join(directory, '.node-version'));
             const manager = process.env.RUN_SCRIPT_COMMAND.split(' ')[0];
             if (manager === 'pnpm') {
               const { stdout } = await exec.getExecOutput('pnpm', ['--version']);
@@ -88,7 +88,7 @@ jobs:
             const installArgs = ['install', '--ignore-scripts'];
             if (manager === 'pnpm') installArgs.push('--no-frozen-lockfile');
             await exec.exec(manager, installArgs, { cwd: directory });
-            fs.rmSync(path.join(directory, 'node_modules'), { recursive: true, force: true });
+            await io.rmRF(path.join(directory, 'node_modules'));
             core.setOutput('directory', directory);
 
       - name: Act - Install with default script policy

.github/workflows/__test-workflow-continuous-integration.yml

@@ -53,8 +53,8 @@ jobs:
             const fs = require('node:fs');
             const path = require('node:path');
             const directory = path.join(process.env.RUNNER_TEMP, 'prebuilt-fixture');
-            fs.mkdirSync(path.join(directory, 'dist'), { recursive: true });
-            fs.copyFileSync('tests/npm/dist/test.txt', path.join(directory, 'dist/test.txt'));
+            await io.mkdirP(path.join(directory, 'dist'));
+            await io.cp('tests/npm/dist/test.txt', path.join(directory, 'dist/test.txt'));
             const scripts = Object.fromEntries(['preinstall', 'postinstall', 'prepack', 'prepare', 'postpack'].map(name => [name, 'node -e "process.exit(1)"']));
             fs.writeFileSync(path.join(directory, 'package.json'), JSON.stringify({ name: 'prebuilt-fixture', version: '1.2.3', files: ['dist'], scripts, dependencies: { 'must-not-install': 'file:./missing' } }));
       - id: fixture

.github/workflows/release.md

@@ -396,6 +396,11 @@ implementation directly, mocking GitHub and registry responses for focused failu
 and recovery cases. Shared `package-identity` and `github-release` tests cover package
 identity and release lookup.
 
+Scripts use the `core`, `exec`, `io` and `glob` helpers provided by
+`actions/github-script`. Pass the required helpers into action modules; tests use
+the actual toolkit packages declared in `actions/package.json`. Node APIs handle
+file contents, hashing and filesystem checks without a toolkit equivalent.
+
 `release/prepare/index.test.js` uses temporary local Git remotes to check staged-file
 identity, already-versioned source, signature rejection, tag conflicts and atomic
 push rejection after concurrent branch changes. GitHub API responses, including

actions/package-lock.json

@@ -5,5 +5,9 @@
   "scripts": {
     "test": "node --test",
     "test:ci": "node --test"
+  },
+  "devDependencies": {
+    "@actions/exec": "^1.1.1",
+    "@actions/glob": "^0.4.0"
   }
 }

actions/package.json

@@ -203,7 +203,7 @@ runs:
           const uniqueTarballPath = path.join(runnerTemp, `${sanitizedArtifactName}${tarballExtension}`);
 
           if (path.resolve(tarballPath) !== path.resolve(uniqueTarballPath)) {
-            fs.renameSync(tarballPath, uniqueTarballPath);
+            await io.mv(tarballPath, uniqueTarballPath);
           }
 
           core.info(`Generated package tarball: ${uniqueTarballPath}`);

actions/package/create/action.yml

@@ -120,24 +120,13 @@ runs:
             return core.setFailed(`Package tarball download path does not exist: ${downloadPath}`);
           }
 
-          function findTarballs(directory) {
-            return fs.readdirSync(directory, { withFileTypes: true }).flatMap(entry => {
-              const entryPath = path.join(directory, entry.name);
-
-              if (entry.isDirectory()) {
-                return findTarballs(entryPath);
-              }
-
-              if (entry.isFile() && entry.name.endsWith('.tgz')) {
-                return [entryPath];
-              }
-
-              return [];
-            });
-          }
-
+          const globber = await glob.create(path.join(downloadPath, '**/*.tgz'), {
+            followSymbolicLinks: false,
+            matchDirectories: false,
+            implicitDescendants: false,
+          });
           const packageTarballPaths = fs.statSync(downloadPath).isDirectory()
-            ? findTarballs(downloadPath)
+            ? (await globber.glob()).filter(file => fs.lstatSync(file).isFile())
             : downloadPath.endsWith('.tgz') ? [downloadPath] : [];
 
           if (packageTarballPaths.length === 0) {
@@ -159,9 +148,9 @@ runs:
         PACKAGE_TARBALL_PATH: ${{ steps.package-tarball.outputs.path }}
       with:
         script: |
-          const { execFileSync } = require('node:child_process');
           const tarballPath = process.env.PACKAGE_TARBALL_PATH;
-          const { name, version } = JSON.parse(execFileSync('tar', ['-xOf', tarballPath, 'package/package.json'], { encoding: 'utf8' }));
+          const { stdout } = await exec.getExecOutput('tar', ['-xOf', tarballPath, 'package/package.json'], { silent: true });
+          const { name, version } = JSON.parse(stdout);
           core.setOutput('name', name);
           core.setOutput('version', version);
 

actions/package/publish/action.yml

@@ -1,18 +1,18 @@
 const { createHash } = require("node:crypto");
 const fs = require("node:fs");
-const { execFileSync } = require("node:child_process");
 
 class PackageRecovery {
   constructor(fetchPackage = fetch) {
     this.fetchPackage = fetchPackage;
   }
 
-  static verifyTarball({ name, version, tarballPath }) {
-    const manifest = JSON.parse(
-      execFileSync("tar", ["-xOf", tarballPath, "package/package.json"], {
-        encoding: "utf8",
-      }),
+  static async verifyTarball({ exec, name, version, tarballPath }) {
+    const { stdout } = await exec.getExecOutput(
+      "tar",
+      ["-xOf", tarballPath, "package/package.json"],
+      { silent: true },
     );
+    const manifest = JSON.parse(stdout);
     if (
       manifest.name !== name ||
       manifest.version !== version ||

actions/package/restore/PackageRecovery.js

@@ -1,4 +1,5 @@
 const assert = require("node:assert/strict");
+const exec = require("@actions/exec");
 const { test } = require("node:test");
 const { createHash } = require("node:crypto");
 const fs = require("node:fs");
@@ -115,7 +116,7 @@ test("rejects unexpected registry identities, download hosts, and failed downloa
   );
 });
 
-test("checks the packaged manifest without executing package lifecycle scripts", (t) => {
+test("checks the packaged manifest without executing package lifecycle scripts", async (t) => {
   const directory = fs.mkdtempSync(path.join(os.tmpdir(), "release-tarball-"));
   t.after(() => fs.rmSync(directory, { recursive: true, force: true }));
   fs.mkdirSync(path.join(directory, "package"));
@@ -139,7 +140,7 @@ test("checks the packaged manifest without executing package lifecycle scripts",
     );
     execFileSync("tar", ["-czf", tarballPath, "package"], { cwd: directory });
     const verify = () =>
-      PackageRecovery.verifyTarball({ ...item, tarballPath });
+      PackageRecovery.verifyTarball({ exec, ...item, tarballPath });
     if (
       manifest.name === item.name &&
       manifest.version === item.version &&
@@ -148,7 +149,11 @@ test("checks the packaged manifest without executing package lifecycle scripts",
       !manifest.optionalDependencies &&
       !manifest.peerDependencies
     )
-      assert.doesNotThrow(verify);
-    else assert.throws(verify, /expected public package|unresolved workspace/);
+      await assert.doesNotReject(verify);
+    else
+      await assert.rejects(
+        verify,
+        /expected public package|unresolved workspace/,
+      );
   }
 });

actions/package/restore/PackageRecovery.test.js

@@ -32,6 +32,6 @@ runs:
         script: |
           const { PackageRecovery } = require(`${process.env.ACTION_PATH}/PackageRecovery.js`);
           const options = { name: process.env.PACKAGE_NAME, version: process.env.PACKAGE_VERSION, tarballPath: process.env.TARBALL_PATH };
-          PackageRecovery.verifyTarball(options);
+          await PackageRecovery.verifyTarball({ exec, ...options });
           const published = await new PackageRecovery().restorePackage(options);
           core.setOutput('published', String(published));