fix(artifact): declare protobuf RPC runtime dependency

Prepare 6.3.1 and verify the packed production package in a clean consumer.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

CONTRIBUTIONS.md

@@ -29,6 +29,13 @@ To run unit tests for the `@actions/artifact` package:
 3. Change working directory to `packages/artifact`
 4. Run jest tests: `npm run test`
 
+After building the package, run `npm run test:package` from `packages/artifact`
+to pack it, install it in a temporary consumer with only production dependencies,
+and check that its public entry point and protobuf RPC runtime can be imported.
+This check requires access to the npm registry and also runs in the unit-test CI
+matrix, without monorepo hoisting or code-generation tooling masking missing
+runtime dependencies.
+
 ## Within upload-artifact or download-artifact actions
 
 Any easy way to test changes for the official upload/download actions is to fork them, compile changes and run them.

RELEASES.md

@@ -1,5 +1,9 @@
 # @actions/artifact Releases
 
+## 6.3.1
+
+- Declare `@protobuf-ts/runtime-rpc` as a production dependency so the package can be imported in clean consumers without the protobuf code-generation tooling.
+
 ## 6.3.0
 
 - Honor positive integer `Retry-After` seconds on HTTP 429 responses, including when the response body is not valid JSON. Unsupported or missing values use exponential backoff ([#2534](https://github.com/actions/toolkit/pull/2534)).

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@actions/artifact",
-  "version": "6.3.0",
+  "version": "6.3.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@actions/artifact",
-      "version": "6.3.0",
+      "version": "6.3.1",
       "license": "MIT",
       "dependencies": {
         "@actions/core": "^3.0.1",
@@ -19,6 +19,7 @@
         "@octokit/request": "^10.0.8",
         "@octokit/request-error": "^7.1.0",
         "@protobuf-ts/runtime": "^2.11.1",
+        "@protobuf-ts/runtime-rpc": "^2.11.1",
         "archiver": "^7.0.1",
         "jwt-decode": "^4.0.0",
         "unzip-stream": "^0.3.1"
@@ -681,7 +682,6 @@
       "version": "2.11.1",
       "resolved": "https://registry.npmjs.org/@protobuf-ts/runtime-rpc/-/runtime-rpc-2.11.1.tgz",
       "integrity": "sha512-4CqqUmNA+/uMz00+d3CYKgElXO9VrEbucjnBFEjqI4GuDrEQ32MaI3q+9qPBvIGOlL4PmHXrzM32vBPWRhQKWQ==",
-      "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
         "@protobuf-ts/runtime": "^2.11.1"

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@actions/artifact",
-  "version": "6.3.0",
+  "version": "6.3.1",
   "preview": true,
   "description": "Actions artifact lib",
   "keywords": [
@@ -38,6 +38,7 @@
   "scripts": {
     "audit-moderate": "npm install && npm audit --json --audit-level=moderate > audit.json",
     "test": "cd ../../ && npm run test ./packages/artifact",
+    "test:package": "node scripts/test-package.mjs",
     "bootstrap": "cd ../../ && npm run bootstrap",
     "tsc-run": "tsc && cp src/internal/shared/package-version.cjs lib/internal/shared/",
     "tsc": "npm run bootstrap && npm run tsc-run",
@@ -57,6 +58,7 @@
     "@octokit/request": "^10.0.8",
     "@octokit/request-error": "^7.1.0",
     "@protobuf-ts/runtime": "^2.11.1",
+    "@protobuf-ts/runtime-rpc": "^2.11.1",
     "archiver": "^7.0.1",
     "jwt-decode": "^4.0.0",
     "unzip-stream": "^0.3.1"

scripts/test-package.mjs

@@ -0,0 +1,77 @@
+import assert from 'node:assert/strict'
+import {execFileSync} from 'node:child_process'
+import {mkdtempSync, readFileSync, rmSync} from 'node:fs'
+import {tmpdir} from 'node:os'
+import {join} from 'node:path'
+import {fileURLToPath} from 'node:url'
+
+const packageDirectory = fileURLToPath(new URL('../', import.meta.url))
+const npm = process.env.npm_execpath
+assert.ok(npm, 'Run this check with npm run test:package')
+
+const consumer = mkdtempSync(join(tmpdir(), 'artifact-package-'))
+const env = {...process.env}
+delete env.NODE_PATH
+
+function runNpm(args, cwd) {
+  return execFileSync(process.execPath, [npm, ...args], {
+    cwd,
+    env,
+    encoding: 'utf8'
+  })
+}
+
+try {
+  const [{filename}] = JSON.parse(
+    runNpm(
+      ['pack', '--json', '--ignore-scripts', '--pack-destination', consumer],
+      packageDirectory
+    )
+  )
+  runNpm(
+    [
+      'install',
+      '--omit=dev',
+      '--ignore-scripts',
+      '--no-audit',
+      '--no-fund',
+      '--package-lock=false',
+      join(consumer, filename)
+    ],
+    consumer
+  )
+
+  const manifest = JSON.parse(
+    readFileSync(
+      join(consumer, 'node_modules/@actions/artifact/package.json'),
+      'utf8'
+    )
+  )
+  assert.equal(manifest.dependencies['@protobuf-ts/runtime-rpc'], '^2.11.1')
+  execFileSync(
+    process.execPath,
+    [
+      '--input-type=module',
+      '--eval',
+      `
+        import assert from 'node:assert/strict'
+        import {createRequire} from 'node:module'
+        import client, {DefaultArtifactClient} from '@actions/artifact'
+        import {ServiceType} from '@protobuf-ts/runtime-rpc'
+
+        assert.ok(client instanceof DefaultArtifactClient)
+        assert.equal(typeof ServiceType, 'function')
+        const require = createRequire(import.meta.url)
+        assert.throws(() => require.resolve('@protobuf-ts/plugin'), {
+          code: 'MODULE_NOT_FOUND'
+        })
+      `
+    ],
+    {cwd: consumer, env, stdio: 'inherit'}
+  )
+  console.log(
+    'Packed artifact imports successfully with production dependencies'
+  )
+} finally {
+  rmSync(consumer, {recursive: true, force: true})
+}