1
0
mirror of https://github.com/actions/setup-node.git synced 2026-08-05 10:52:16 +08:00

Compare commits

...

8 Commits

Author SHA1 Message Date
dependabot[bot] 8b9e2b91a5 Bump typescript from 6.0.3 to 7.0.2
Bumps [typescript](https://github.com/microsoft/TypeScript) from 6.0.3 to 7.0.2.
- [Release notes](https://github.com/microsoft/TypeScript/releases)
- [Commits](https://github.com/microsoft/TypeScript/commits)

---
updated-dependencies:
- dependency-name: typescript
  dependency-version: 7.0.2
  dependency-type: direct:development
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-07-29 18:06:21 +00:00
Copilot e51e5fe84f fix: update brace-expansion to patch GHSA-3jxr-9vmj-r5cp (exponential-time DoS) (#1599)
* Initial plan

* fix: update brace-expansion to address GHSA-3jxr-9vmj-r5cp and rebuild dist

- brace-expansion 1.1.13 → 1.1.16 (GHSA-3jxr-9vmj-r5cp patched floor: 1.1.16)
- brace-expansion 2.1.1 → 2.1.2 (GHSA-3jxr-9vmj-r5cp patched floor: 2.1.2)
- brace-expansion 5.0.6 → 5.0.8 (GHSA-3jxr-9vmj-r5cp patched floor: 5.0.7; also fixes GHSA-mh99-v99m-4gvg)
- Regenerated package-lock.json
- Rebuilt dist/setup/index.js and dist/cache-save/index.js with patched dependency

Closes #1596

* fix: eliminate remaining brace-expansion vulnerabilities and update license cache

## Basic validation CI fix
Add `overrides` in package.json to eliminate all brace-expansion 1.x and 2.x
from the dependency tree, resolving GHSA-mh99-v99m-4gvg for all packages:
- `"@actions/glob": "$@actions/glob"` - forces @actions/cache to use the
  root @actions/glob@0.7.0 (minimatch@10.x → brace-expansion@5.0.8) instead
  of its bundled @actions/glob@0.6.1 (minimatch@3.x → brace-expansion@1.x)
- `"glob": {"minimatch": "^10.2.5"}` - forces glob@10.x to use
  minimatch@10.x → brace-expansion@5.0.8 instead of minimatch@9.x → brace-expansion@2.x
- `"test-exclude": "^7.0.2"` - upgrades test-exclude to a version that
  natively uses minimatch@10.x (instead of @3.x), removing brace-expansion@1.x
  from the jest coverage instrumentation path

`npm audit --audit-level=high` now reports 0 vulnerabilities.

## Licensed CI fix
Update .licenses/npm/ cache to match the new dependency tree:
- Add: brace-expansion-5.0.8.dep.yml
- Add: minimatch-10.2.6.dep.yml
- Remove stale: brace-expansion-1.1.13.dep.yml (already done in prev commit)
- Remove stale: brace-expansion-5.0.6.dep.yml (already done in prev commit)
- Remove stale: minimatch-3.1.5.dep.yml
- Remove stale: @actions/glob-0.6.1.dep.yml
- Remove stale: concat-map.dep.yml
- Remove stale: balanced-match-1.0.2.dep.yml

Rebuild dist artifacts to include updated brace-expansion.

* fix: replace brace-expansion workarounds with single override

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
2026-07-29 13:03:59 -05:00
gowridurgad 32f57ac043 docs: add V7 ESM migration and NODE_AUTH_TOKEN behavior change (#1593)
Co-authored-by: gowridurgad <gowridurgad@gmail.com>
2026-07-21 09:21:57 -05:00
Andreas Deininger b789df37d6 README.md: bump actions/checkout to latest version 7 (#1578)
Co-authored-by: Haritha <73516759+HarithaVattikuti@users.noreply.github.com>
2026-07-17 12:47:13 -05:00
Haritha 1b7c366466 Update workflow pins and migrate Node matrices to modern versions (#1583)
* Update workflow action pins and move Node 20 to 26

* fix: correct node version in v8-canary and update setup for node 22 x86

* chore: update setup-node action version from v6 to v7 in documentation

* fix: update pnpm/action-setup version to v6 in advanced usage documentation
2026-07-16 10:33:56 -05:00
Priya Gupta 05e62e6009 pin @types/node to v24 (#1585) 2026-07-16 10:33:23 -05:00
Philip Gai 391b8c7809 chore(deps): bump @actions/cache to 6.2.0 (#1584)
Bump @actions/cache from ^6.1.0 to ^6.2.0 and rebuild the vendored dist
bundles (dist/setup, dist/cache-save) via ncc. Update the licensed cache
record for @actions/cache to 6.2.0.

6.2.0 ships two transparent client behaviors: honor ACTIONS_CACHE_MODE to
skip restore/save when the effective cache-mode disallows it, and surface a
core.warning (not a run failure) when the cache service denies a read/write
due to token scopes.


Copilot-Session: 0acd1380-0102-4f9d-b613-192a6ddef737

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
2026-07-16 10:32:50 -05:00
v-jitenderpalsingh 363be39a57 Add Node version validation and manifest fetch retry (#1580)
* Add Node version validation and manifest fetch retry

* Add debug logs for expected and actual Node versions

* chore: rebuild dist

* refactor: enhance debug logging for Node installation failure

* update test cases

* Improve formatting of test cases

* revert package-lock.json
2026-07-14 17:55:44 -05:00
19 changed files with 4523 additions and 3538 deletions
+28 -28
View File
@@ -18,10 +18,10 @@ jobs:
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
node-version: [20, 22, 24]
os: [ubuntu-latest, windows-latest, macos-latest, macos-15-intel]
node-version: [22, 24, 26]
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Clean global cache
run: npm cache clean --force
- name: Setup Node
@@ -41,14 +41,14 @@ jobs:
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
node-version: [20, 22, 24]
os: [ubuntu-latest, windows-latest, macos-latest, macos-15-intel]
node-version: [22, 24, 26]
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Install pnpm
uses: pnpm/action-setup@v4
uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
with:
version: 6.10.0
version: 10
- name: Generate pnpm file
run: pnpm install
- name: Remove dependencies
@@ -74,10 +74,10 @@ jobs:
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
node-version: [20, 22, 24]
os: [ubuntu-latest, windows-latest, macos-latest, macos-15-intel]
node-version: [22, 24, 26]
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Yarn version
run: yarn --version
- name: Generate yarn file
@@ -106,10 +106,10 @@ jobs:
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
node-version: [20, 22, 24]
os: [ubuntu-latest, windows-latest, macos-latest, macos-15-intel]
node-version: [22, 24, 26]
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Update yarn
run: yarn set version 3.6.4
- name: Yarn version
@@ -139,11 +139,11 @@ jobs:
name: Test yarn subprojects
strategy:
matrix:
node-version: [20, 22, 24]
node-version: [22, 24, 26]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: prepare sub-projects
run: __tests__/prepare-yarn-subprojects.sh yarn1
@@ -166,11 +166,11 @@ jobs:
name: Test yarn subprojects all locally managed
strategy:
matrix:
node-version: [20, 22, 24]
node-version: [22, 24, 26]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: prepare sub-projects
run: __tests__/prepare-yarn-subprojects.sh keepcache keepcache
@@ -193,11 +193,11 @@ jobs:
name: Test yarn subprojects some locally managed
strategy:
matrix:
node-version: [20, 22, 24]
node-version: [22, 24, 26]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: prepare sub-projects
run: __tests__/prepare-yarn-subprojects.sh global
@@ -220,11 +220,11 @@ jobs:
name: Test yarn subprojects managed by git
strategy:
matrix:
node-version: [20, 22, 24]
node-version: [22, 24, 26]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: prepare sub-projects
run: /bin/bash __tests__/prepare-yarn-subprojects.sh keepcache
@@ -250,10 +250,10 @@ jobs:
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
node-version: [20, 22, 24]
os: [ubuntu-latest, windows-latest, macos-latest, macos-15-intel]
node-version: [22, 24, 26]
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Create package.json with packageManager field
run: |
echo '{ "name": "test-project", "version": "1.0.0", "packageManager": "npm@8.0.0" }' > package.json
@@ -275,10 +275,10 @@ jobs:
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
node-version: [20, 22, 24]
os: [ubuntu-latest, windows-latest, macos-latest, macos-15-intel]
node-version: [22, 24, 26]
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Create package.json with devEngines field
run: |
echo '{
+2 -2
View File
@@ -25,7 +25,7 @@ jobs:
env:
https_proxy: http://squid-proxy:3128
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Clear tool cache
run: rm -rf $RUNNER_TOOL_CACHE/*
- name: Setup node 24
@@ -41,7 +41,7 @@ jobs:
https_proxy: http://no-such-proxy:3128
no_proxy: api.github.com,github.com,nodejs.org,registry.npmjs.org,*.s3.amazonaws.com,s3.amazonaws.com
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Clear tool cache
run: rm -rf $RUNNER_TOOL_CACHE/*
- name: Setup node 24
@@ -14,7 +14,7 @@ jobs:
steps:
- name: Checking out
uses: actions/checkout@v6
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Publish
id: publish
uses: actions/publish-immutable-action@v0.0.4
uses: actions/publish-immutable-action@4bc8754ffc40f27910afb20287dbbbb675a4e978 # v0.0.4
+40 -40
View File
@@ -17,10 +17,10 @@ jobs:
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
node-version: [20, 22, 24]
os: [ubuntu-latest, windows-latest, macos-latest, macos-15-intel]
node-version: [22, 24, 26]
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Setup Node
uses: ./
with:
@@ -34,10 +34,10 @@ jobs:
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, windows-latest, macos-latest-large]
node-version: [lts/dubnium, lts/erbium, lts/fermium, lts/*, lts/-1]
os: [ubuntu-latest, windows-latest, macos-15-intel]
node-version: [lts/*, lts/-1]
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Setup Node
uses: ./
with:
@@ -56,15 +56,15 @@ jobs:
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
os: [ubuntu-latest, windows-latest, macos-latest, macos-15-intel]
node-version:
[
'20-v8-canary',
'20.0.0-v8-canary',
'20.0.0-v8-canary20221101e50e45c9f8'
'26-v8-canary',
'26.0.0-v8-canary',
'26.0.0-v8-canary20251016054584e5cf'
]
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Setup Node
uses: ./
with:
@@ -81,10 +81,10 @@ jobs:
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
node-version: [20-nightly, 25-nightly, 24.0.0-nightly]
os: [ubuntu-latest, windows-latest, macos-latest, macos-15-intel]
node-version: [26-nightly, 25-nightly, 24.0.0-nightly]
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Setup Node
uses: ./
with:
@@ -101,10 +101,10 @@ jobs:
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
node-version: [20.0.0-rc.1, 22.14.0-rc.1, 24.0.0-rc.4]
os: [ubuntu-latest, windows-latest, macos-latest, macos-15-intel]
node-version: [26.0.0-rc.1, 22.14.0-rc.1, 24.0.0-rc.4]
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Setup Node
uses: ./
with:
@@ -121,10 +121,10 @@ jobs:
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
node-version: [20.10.0, 22.0.0, 24.9.0]
os: [ubuntu-latest, windows-latest, macos-latest, macos-15-intel]
node-version: [26.5.0, 22.0.0, 24.9.0]
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Setup Node
uses: ./
with:
@@ -138,10 +138,10 @@ jobs:
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
node-version: [20, 22, 24]
os: [ubuntu-latest, windows-latest, macos-latest, macos-15-intel]
node-version: [22, 24, 26]
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Setup Node and check latest
uses: ./
with:
@@ -156,11 +156,11 @@ jobs:
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
os: [ubuntu-latest, windows-latest, macos-latest, macos-15-intel]
node-version-file:
[.nvmrc, .tool-versions, .tool-versions-node, package.json]
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Setup node from node version file
uses: ./
with:
@@ -175,22 +175,22 @@ jobs:
matrix:
os: [ubuntu-latest, windows-latest, macos-latest]
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Setup node from node version file
uses: ./
with:
node-version-file: '__tests__/data/package-dev-engines.json'
- name: Verify node
run: __tests__/verify-node.sh 20
run: __tests__/verify-node.sh 26
version-file-volta:
runs-on: ${{ matrix.os }}
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
os: [ubuntu-latest, windows-latest, macos-latest, macos-15-intel]
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Setup node from node version file
uses: ./
with:
@@ -203,9 +203,9 @@ jobs:
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
os: [ubuntu-latest, windows-latest, macos-latest, macos-15-intel]
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Setup node from node version file
uses: ./
with:
@@ -218,10 +218,10 @@ jobs:
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
os: [ubuntu-latest, windows-latest, macos-latest, macos-15-intel]
node-version: [21, 23]
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Setup Node from dist
uses: ./
with:
@@ -235,9 +235,9 @@ jobs:
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, windows-latest, macos-latest-large]
os: [ubuntu-latest, windows-latest, macos-15-intel]
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
# test old versions which didn't have npm and layout different
- name: Setup node 0.12.18 from dist
uses: ./
@@ -250,11 +250,11 @@ jobs:
arch:
runs-on: windows-latest
steps:
- uses: actions/checkout@v6
- name: Setup node 20 x86 from dist
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Setup node 22 x86 from dist
uses: ./
with:
node-version: '20'
node-version: '22'
architecture: 'x86'
- name: Verify node
run: __tests__/verify-arch.sh "ia32"
@@ -265,7 +265,7 @@ jobs:
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
os: [ubuntu-latest, windows-latest, macos-latest, macos-15-intel]
node-version: [current, latest, node]
steps:
- name: Get node version
@@ -274,7 +274,7 @@ jobs:
echo "LATEST_NODE_VERSION=$latestNodeVersion" >> $GITHUB_OUTPUT
id: version
shell: bash
- uses: actions/checkout@v6
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
- name: Setup Node
uses: ./
with:
Binary file not shown.
Binary file not shown.
Binary file not shown.
BIN
View File
Binary file not shown.
+19 -15
View File
@@ -12,9 +12,13 @@ This action provides the following functionality for GitHub Actions users:
- Registering problem matchers for error output
- Configuring authentication for GPR or npm
## Breaking changes in V7
## What's new in V7
- **Migrated to ESM** to enable support for the latest `@actions/*` package versions.
- Migrated action internals to ESM for compatibility with latest `@actions/*` packages. No changes to action inputs, outputs, or behavior.
### Breaking change
- The dummy `NODE_AUTH_TOKEN` fallback has been removed, as it could unintentionally affect the generated `.npmrc` with a non-functional token. With this change, if `registry-url` is set without `NODE_AUTH_TOKEN`, legacy Yarn Classic (1.x) and older Node/npm versions may fail, and pnpm may warn. npm Trusted Publishing (OIDC) is not affected, since it does not use `NODE_AUTH_TOKEN`.
## Breaking changes in V6
@@ -30,7 +34,7 @@ This action provides the following functionality for GitHub Actions users:
- Upgraded action from node20 to node24.
> Make sure your runner is on version v2.327.1 or later to ensure compatibility with this release. [See Release Notes](https://github.com/actions/runner/releases/tag/v2.327.1)
For more details, see the full release notes on the [releases page](https://github.com/actions/setup-node/releases/v5.0.0)
For more details, see the full release notes on the [releases page](https://github.com/actions/setup-node/releases)
## Usage
@@ -38,7 +42,7 @@ See [action.yml](action.yml)
<!-- start usage -->
```yaml
- uses: actions/setup-node@v6
- uses: actions/setup-node@v7
with:
# Version Spec of the version to use in SemVer notation.
# It also admits such aliases as lts/*, latest, nightly and canary builds
@@ -119,8 +123,8 @@ See [action.yml](action.yml)
```yaml
steps:
- uses: actions/checkout@v6
- uses: actions/setup-node@v6
- uses: actions/checkout@v7
- uses: actions/setup-node@v7
with:
node-version: 24
package-manager-cache: false # Disable automatic npm caching if not required
@@ -169,8 +173,8 @@ See the examples of using cache for `yarn`/`pnpm` and `cache-dependency-path` in
```yaml
steps:
- uses: actions/checkout@v6
- uses: actions/setup-node@v6
- uses: actions/checkout@v7
- uses: actions/setup-node@v7
with:
node-version: 24
cache: 'npm'
@@ -182,8 +186,8 @@ steps:
```yaml
steps:
- uses: actions/checkout@v6
- uses: actions/setup-node@v6
- uses: actions/checkout@v7
- uses: actions/setup-node@v7
with:
node-version: 24
cache: 'npm'
@@ -198,8 +202,8 @@ This behavior is controlled by the `package-manager-cache` input, which defaults
```yaml
steps:
- uses: actions/checkout@v6
- uses: actions/setup-node@v6
- uses: actions/checkout@v7
- uses: actions/setup-node@v7
with:
package-manager-cache: false
- run: npm ci
@@ -217,9 +221,9 @@ jobs:
node: [ 20, 22, 24 ]
name: Node ${{ matrix.node }} sample
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7
- name: Setup node
uses: actions/setup-node@v6
uses: actions/setup-node@v7
with:
node-version: ${{ matrix.node }}
package-manager-cache: false # Disable automatic npm caching if not required
@@ -234,7 +238,7 @@ jobs:
To get a higher rate limit, you can [generate a personal access token on github.com](https://github.com/settings/tokens/new) and pass it as the `token` input for the action:
```yaml
uses: actions/setup-node@v6
uses: actions/setup-node@v7
with:
token: ${{ secrets.GH_DOTCOM_TOKEN }}
node-version: 24
+1 -1
View File
@@ -5,7 +5,7 @@
"devEngines": {
"runtime": {
"name": "node",
"version": "^20"
"version": "^26"
}
}
}
+112 -6
View File
@@ -258,7 +258,11 @@ describe('setup-node', () => {
// @actions/exec
getExecOutputSpy = exec.getExecOutput as jest.Mock;
getExecOutputSpy.mockImplementation(() => 'v16.15.0');
getExecOutputSpy.mockImplementation(async () => ({
stdout: 'v16.15.0',
stderr: '',
exitCode: 0
}));
});
afterEach(() => {
@@ -379,6 +383,16 @@ describe('setup-node', () => {
whichSpy.mockImplementation((cmd: any) => {
return `some/${cmd}/path`;
});
getExecOutputSpy.mockImplementation(async (cmd: string) => ({
stdout:
cmd === 'node'
? `v${resolvedVersion}`
: cmd === 'npm'
? '11.12.1'
: '4.17.1',
stderr: '',
exitCode: 0
}));
await main.run();
@@ -756,7 +770,7 @@ describe('setup-node', () => {
`Attempting to download ${versionSpec}...`
);
expect(addPathSpy).toHaveBeenCalledWith(expPath);
});
}, 10000);
});
describe('LTS version', () => {
@@ -924,8 +938,10 @@ describe('setup-node', () => {
expect(dbgSpy).toHaveBeenCalledWith(
'Getting manifest from actions/node-versions@main'
);
expect(setFailedSpy).toHaveBeenCalledWith('Unable to download manifest');
});
expect(setFailedSpy).toHaveBeenCalledWith(
`Failed to fetch a valid manifest after 3 attempts. Last error: Unable to download manifest`
);
}, 10000);
});
describe('latest alias syntax', () => {
@@ -947,10 +963,13 @@ describe('setup-node', () => {
await main.run();
// assert
expect(logSpy).toHaveBeenCalledWith('Unable to download manifest');
expect(logSpy).toHaveBeenCalledWith(
'Failed to fetch a valid manifest after 3 attempts. Last error: Unable to download manifest'
);
expect(logSpy).toHaveBeenCalledWith('getting latest node version...');
}
},
10000
);
});
@@ -1020,4 +1039,91 @@ describe('setup-node', () => {
);
}
}, 100000);
describe('manifest retry and validation', () => {
beforeEach(() => {
os.platform = 'linux';
os.arch = 'x64';
inputs['node-version'] = 'lts/erbium';
findSpy.mockImplementation(() => '');
});
it('retries fetching the manifest and succeeds on a later attempt', async () => {
let calls = 0;
getManifestSpy.mockImplementation(() => {
calls++;
if (calls < 2) {
throw new Error('transient network failure');
}
return <tc.IToolRelease[]>nodeTestManifest;
});
dlSpy.mockImplementation(async () => '/some/temp/path');
const toolPath = path.normalize('/cache/node/12.16.2/x64');
exSpy.mockImplementation(async () => '/some/other/temp/path');
cacheSpy.mockImplementation(async () => toolPath);
getExecOutputSpy.mockImplementation(async () => ({
stdout: `v${path.basename(path.dirname(toolPath))}\n`,
stderr: '',
exitCode: 0
}));
await main.run();
expect(calls).toBe(2);
expect(logSpy).toHaveBeenCalledWith('Retrying to fetch the manifest...');
expect(dbgSpy).toHaveBeenCalledWith(
`Found LTS release '12.16.2' for Node version 'lts/erbium'`
);
}, 10000);
it('rejects an empty manifest as invalid and retries', async () => {
getManifestSpy.mockImplementation(() => []);
await main.run();
expect(getManifestSpy).toHaveBeenCalledTimes(3);
expect(setFailedSpy).toHaveBeenCalledWith(
`Failed to fetch a valid manifest after 3 attempts. Last error: The manifest fetched is empty, truncated, or does not contain any valid tool release entries.`
);
}, 10000);
});
describe('node version verification', () => {
beforeEach(() => {
os.platform = 'linux';
os.arch = 'x64';
inputs['node-version'] = '12';
});
it('fails when the installed node version does not match the expected version', async () => {
const toolPath = path.normalize('/cache/node/12.16.1/x64');
findSpy.mockReturnValue(toolPath);
getExecOutputSpy.mockImplementation(async () => ({
stdout: 'v22.22.3\n',
stderr: '',
exitCode: 0
}));
await main.run();
expect(setFailedSpy).toHaveBeenCalledWith(
`Node v12.16.1 installation failed, likely due to an incomplete or corrupted download.`
);
});
it('fails when the node executable cannot be invoked', async () => {
const toolPath = path.normalize('/cache/node/12.16.1/x64');
findSpy.mockReturnValue(toolPath);
getExecOutputSpy.mockImplementation(async () => {
throw new Error('node not found');
});
await main.run();
expect(setFailedSpy).toHaveBeenCalledWith(
`Node installation failed. Node may not be installed or not on PATH: node not found`
);
});
});
});
+1610 -1424
View File
File diff suppressed because it is too large Load Diff
+1657 -1429
View File
File diff suppressed because it is too large Load Diff
+49 -49
View File
@@ -45,8 +45,8 @@ To run without a lockfile:
```yaml
steps:
- uses: actions/checkout@v6
- uses: actions/setup-node@v6
- uses: actions/checkout@v7
- uses: actions/setup-node@v7
with:
node-version: '24'
package-manager-cache: false # Explicitly disable caching if you don't have a lockfile
@@ -64,8 +64,8 @@ If `check-latest` is set to `true`, the action first checks if the cached versio
```yaml
steps:
- uses: actions/checkout@v6
- uses: actions/setup-node@v6
- uses: actions/checkout@v7
- uses: actions/setup-node@v7
with:
node-version: '24'
check-latest: true
@@ -83,8 +83,8 @@ See [supported version syntax](https://github.com/actions/setup-node#supported-v
```yaml
steps:
- uses: actions/checkout@v6
- uses: actions/setup-node@v6
- uses: actions/checkout@v7
- uses: actions/setup-node@v7
with:
node-version-file: '.nvmrc'
package-manager-cache: false # Disable automatic npm caching if not required
@@ -128,8 +128,8 @@ jobs:
runs-on: windows-latest
name: Node sample
steps:
- uses: actions/checkout@v6
- uses: actions/setup-node@v6
- uses: actions/checkout@v7
- uses: actions/setup-node@v7
with:
node-version: '24'
architecture: 'x64' # optional, x64 or x86. If not specified, x64 will be used by default
@@ -150,8 +150,8 @@ jobs:
runs-on: ubuntu-latest
name: Node sample
steps:
- uses: actions/checkout@v6
- uses: actions/setup-node@v6
- uses: actions/checkout@v7
- uses: actions/setup-node@v7
with:
node-version: '24.0.0-v8-canary' # it will install the latest v8 canary release for node 24.0.0
package-manager-cache: false # Disable automatic npm caching if not required
@@ -166,8 +166,8 @@ jobs:
runs-on: ubuntu-latest
name: Node sample
steps:
- uses: actions/checkout@v6
- uses: actions/setup-node@v6
- uses: actions/checkout@v7
- uses: actions/setup-node@v7
with:
node-version: '24-v8-canary' # it will install the latest v8 canary release for node 24
package-manager-cache: false # Disable automatic npm caching if not required
@@ -183,8 +183,8 @@ jobs:
runs-on: ubuntu-latest
name: Node sample
steps:
- uses: actions/checkout@v6
- uses: actions/setup-node@v6
- uses: actions/checkout@v7
- uses: actions/setup-node@v7
with:
node-version: 'v24.0.0-v8-canary2025030537242e55ac'
package-manager-cache: false # Disable automatic npm caching if not required
@@ -204,8 +204,8 @@ jobs:
runs-on: ubuntu-latest
name: Node sample
steps:
- uses: actions/checkout@v6
- uses: actions/setup-node@v6
- uses: actions/checkout@v7
- uses: actions/setup-node@v7
with:
node-version: '24-nightly' # it will install the latest nightly release for node 24
package-manager-cache: false # Disable automatic npm caching if not required
@@ -221,8 +221,8 @@ jobs:
runs-on: ubuntu-latest
name: Node sample
steps:
- uses: actions/checkout@v6
- uses: actions/setup-node@v6
- uses: actions/checkout@v7
- uses: actions/setup-node@v7
with:
node-version: '24.0.0-nightly' # it will install the latest nightly release for node 24.0.0
package-manager-cache: false # Disable automatic npm caching if not required
@@ -238,8 +238,8 @@ jobs:
runs-on: ubuntu-latest
name: Node sample
steps:
- uses: actions/checkout@v6
- uses: actions/setup-node@v6
- uses: actions/checkout@v7
- uses: actions/setup-node@v7
with:
node-version: '24.0.0-nightly202505066102159fa1'
package-manager-cache: false # Disable automatic npm caching if not required
@@ -257,8 +257,8 @@ jobs:
runs-on: ubuntu-latest
name: Node sample
steps:
- uses: actions/checkout@v6
- uses: actions/setup-node@v6
- uses: actions/checkout@v7
- uses: actions/setup-node@v7
with:
node-version: '24.0.0-rc.4'
package-manager-cache: false # Disable automatic npm caching if not required
@@ -276,8 +276,8 @@ Yarn caching handles both Yarn Classic (v1) and Yarn Berry (v2, v3, v4+).
```yaml
steps:
- uses: actions/checkout@v6
- uses: actions/setup-node@v6
- uses: actions/checkout@v7
- uses: actions/setup-node@v7
with:
node-version: '24'
cache: 'yarn'
@@ -295,11 +295,11 @@ steps:
# NOTE: pnpm caching support requires pnpm version >= 6.10.0
steps:
- uses: actions/checkout@v6
- uses: pnpm/action-setup@v4
- uses: actions/checkout@v7
- uses: pnpm/action-setup@v6
with:
version: 10
- uses: actions/setup-node@v6
- uses: actions/setup-node@v7
with:
node-version: '24'
cache: 'pnpm'
@@ -314,8 +314,8 @@ steps:
**Using wildcard patterns to cache dependencies**
```yaml
steps:
- uses: actions/checkout@v6
- uses: actions/setup-node@v6
- uses: actions/checkout@v7
- uses: actions/setup-node@v7
with:
node-version: '24'
cache: 'npm'
@@ -327,8 +327,8 @@ steps:
**Using a list of file paths to cache dependencies**
```yaml
steps:
- uses: actions/checkout@v6
- uses: actions/setup-node@v6
- uses: actions/checkout@v7
- uses: actions/setup-node@v7
with:
node-version: '24'
cache: 'npm'
@@ -345,13 +345,13 @@ You can restore caches without saving new entries, which helps reduce cache writ
```yaml
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7
# - uses: pnpm/action-setup@v6
# with:
# version: 10
- name: Setup Node.js
uses: actions/setup-node@v6
uses: actions/setup-node@v7
with:
node-version: '24'
package-manager-cache: false # Disable automatic npm caching if not required
@@ -397,9 +397,9 @@ jobs:
- macos-latest
- windows-latest
node_version:
- 20
- 22
- 24
- 26
architecture:
- x64
# an extra windows-x86 run:
@@ -409,9 +409,9 @@ jobs:
architecture: x86
name: Node ${{ matrix.node_version }} - ${{ matrix.architecture }} on ${{ matrix.os }}
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7
- name: Setup node
uses: actions/setup-node@v6
uses: actions/setup-node@v7
with:
node-version: ${{ matrix.node_version }}
architecture: ${{ matrix.architecture }}
@@ -423,8 +423,8 @@ jobs:
## Publish to npmjs and GPR with npm
```yaml
steps:
- uses: actions/checkout@v6
- uses: actions/setup-node@v6
- uses: actions/checkout@v7
- uses: actions/setup-node@v7
with:
node-version: '24.x'
registry-url: 'https://registry.npmjs.org'
@@ -433,7 +433,7 @@ steps:
- run: npm publish
env:
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
- uses: actions/setup-node@v6
- uses: actions/setup-node@v7
with:
registry-url: 'https://npm.pkg.github.com'
package-manager-cache: false # Disable automatic npm dependency caching to reduce cache poisoning risk
@@ -445,8 +445,8 @@ steps:
## Publish to npmjs and GPR with yarn
```yaml
steps:
- uses: actions/checkout@v6
- uses: actions/setup-node@v6
- uses: actions/checkout@v7
- uses: actions/setup-node@v7
with:
node-version: '24.x'
registry-url: <registry url>
@@ -455,7 +455,7 @@ steps:
- run: yarn publish
env:
NODE_AUTH_TOKEN: ${{ secrets.YARN_TOKEN }}
- uses: actions/setup-node@v6
- uses: actions/setup-node@v7
with:
registry-url: 'https://npm.pkg.github.com'
package-manager-cache: false # Disable automatic npm dependency caching to reduce cache poisoning risk
@@ -467,8 +467,8 @@ steps:
## Use private packages
```yaml
steps:
- uses: actions/checkout@v6
- uses: actions/setup-node@v6
- uses: actions/checkout@v7
- uses: actions/setup-node@v7
with:
node-version: '24.x'
registry-url: 'https://registry.npmjs.org'
@@ -488,8 +488,8 @@ Below you can find a sample "Setup .yarnrc.yml" step, that is going to allow you
```yaml
steps:
- uses: actions/checkout@v6
- uses: actions/setup-node@v6
- uses: actions/checkout@v7
- uses: actions/setup-node@v7
with:
node-version: '24.x'
package-manager-cache: false # Disable automatic npm dependency caching to reduce cache poisoning risk
@@ -533,9 +533,9 @@ You must also configure a **Trusted Publisher** in npm for your package/scope th
id-token: write # Required for OIDC
steps:
- uses: actions/checkout@v6
- uses: actions/checkout@v7
- uses: actions/setup-node@v6
- uses: actions/setup-node@v7
with:
node-version: '24'
registry-url: 'https://registry.npmjs.org'
@@ -558,7 +558,7 @@ It is possible to specify a token to authenticate with the mirror using the `mir
The token will be passed in the `Authorization` header.
```yaml
- uses: actions/setup-node@v6
- uses: actions/setup-node@v7
with:
node-version: '24.x'
mirror: 'https://nodejs.org/dist'
+931 -530
View File
File diff suppressed because it is too large Load Diff
+6 -3
View File
@@ -29,7 +29,7 @@
"author": "GitHub",
"license": "MIT",
"dependencies": {
"@actions/cache": "^6.1.0",
"@actions/cache": "^6.2.0",
"@actions/core": "^3.0.1",
"@actions/exec": "^3.0.0",
"@actions/github": "^9.1.1",
@@ -39,10 +39,13 @@
"@actions/tool-cache": "^4.0.0",
"semver": "^7.8.5"
},
"overrides": {
"brace-expansion": "5.0.8"
},
"devDependencies": {
"@eslint/js": "^10.0.1",
"@jest/globals": "^30.4.1",
"@types/node": "^26.0.0",
"@types/node": "^24.1.0",
"@types/semver": "^7.7.0",
"@typescript-eslint/eslint-plugin": "^8.62.0",
"@typescript-eslint/parser": "^8.62.0",
@@ -56,6 +59,6 @@
"jest-each": "^30.4.1",
"prettier": "^3.8.4",
"ts-jest": "^29.4.11",
"typescript": "^6.0.3"
"typescript": "^7.0.2"
}
}
@@ -1,6 +1,7 @@
import * as core from '@actions/core';
import * as tc from '@actions/tool-cache';
import path from 'path';
import * as exec from '@actions/exec';
import BaseDistribution from '../base-distribution.js';
import {NodeInputs, INodeVersion, INodeVersionInfo} from '../base-models.js';
@@ -62,7 +63,9 @@ export default class OfficialBuilds extends BaseDistribution {
if (toolPath) {
core.info(`Found in cache @ ${toolPath}`);
const installedDir = toolPath;
this.addToolPath(toolPath);
await this.verifyNodeVersion(installedDir);
return;
}
@@ -123,11 +126,13 @@ export default class OfficialBuilds extends BaseDistribution {
toolPath = await this.downloadDirectlyFromNode();
}
const installedDir = toolPath;
if (this.osPlat != 'win32') {
toolPath = path.join(toolPath, 'bin');
}
core.addPath(toolPath);
await this.verifyNodeVersion(installedDir);
}
protected addToolPath(toolPath: string) {
@@ -185,15 +190,41 @@ export default class OfficialBuilds extends BaseDistribution {
return `${url}/dist`;
}
private getManifest(): Promise<tc.IToolRelease[]> {
core.debug('Getting manifest from actions/node-versions@main');
return tc.getManifestFromRepo(
'actions',
'node-versions',
this.nodeInfo.mirror && this.nodeInfo.mirrorToken
? this.nodeInfo.mirrorToken
: this.nodeInfo.auth,
'main'
private async getManifest(): Promise<tc.IToolRelease[]> {
let lastError: Error | undefined;
const maxAttempts = 3;
core.debug(`Getting manifest from actions/node-versions@main`);
for (let attempt = 1; attempt <= maxAttempts; attempt++) {
try {
const manifest = await tc.getManifestFromRepo(
'actions',
'node-versions',
this.nodeInfo.mirror && this.nodeInfo.mirrorToken
? this.nodeInfo.mirrorToken
: this.nodeInfo.auth,
'main'
);
if (Array.isArray(manifest) && manifest.length > 0) {
return manifest;
}
lastError = new Error(
`The manifest fetched is empty, truncated, or does not contain any valid tool release entries.`
);
} catch (err) {
lastError = err instanceof Error ? err : new Error(String(err));
}
core.debug(
`Attempt ${attempt}/${maxAttempts} to fetch the manifest failed: ${lastError.message}`
);
if (attempt < maxAttempts) {
core.info(`Retrying to fetch the manifest...`);
await new Promise(resolve =>
setTimeout(resolve, 1000 * 2 ** (attempt - 1))
); // Retry after a delay
}
}
throw new Error(
`Failed to fetch a valid manifest after ${maxAttempts} attempts. Last error: ${lastError?.message}`
);
}
@@ -298,4 +329,30 @@ export default class OfficialBuilds extends BaseDistribution {
private isLatestSyntax(versionSpec): boolean {
return ['current', 'latest', 'node'].includes(versionSpec);
}
private async verifyNodeVersion(installedDir: string) {
// tool-cache layout: <root>/node/<version>/<arch>
const expectedVersion = 'v' + path.basename(path.dirname(installedDir));
let actualVersion = '';
try {
const {stdout} = await exec.getExecOutput('node', ['--version'], {
silent: true
});
actualVersion = stdout.trim();
} catch (err) {
throw new Error(
`Node installation failed. Node may not be installed or not on PATH: ${(err as Error).message}`,
{cause: err}
);
}
if (actualVersion !== expectedVersion) {
core.debug(
`Node installation failed: expected ${expectedVersion} but "node --version" reported ${actualVersion || '(empty)'} (installedDir: ${installedDir}).`
);
throw new Error(
`Node ${expectedVersion} installation failed, likely due to an incomplete or corrupted download.`
);
}
}
}