From 0e775766222f3bc96369646389b45dc5b370b7b6 Mon Sep 17 00:00:00 2001 From: tunc-d <46646394+tunc-d@users.noreply.github.com> Date: Tue, 6 Oct 2026 14:15:16 +0200 Subject: [PATCH 1/2] fix(artifact): declare protobuf RPC runtime dependency Prepare 6.3.1 and verify the packed production package in a clean consumer. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- CONTRIBUTIONS.md | 7 ++++ RELEASES.md | 4 +++ package-lock.json | 6 ++-- package.json | 4 ++- scripts/test-package.mjs | 77 ++++++++++++++++++++++++++++++++++++++++ 5 files changed, 94 insertions(+), 4 deletions(-) create mode 100644 scripts/test-package.mjs diff --git a/CONTRIBUTIONS.md b/CONTRIBUTIONS.md index 171b015..bb614bf 100644 --- a/CONTRIBUTIONS.md +++ b/CONTRIBUTIONS.md @@ -29,6 +29,13 @@ To run unit tests for the `@actions/artifact` package: 3. Change working directory to `packages/artifact` 4. Run jest tests: `npm run test` +After building the package, run `npm run test:package` from `packages/artifact` +to pack it, install it in a temporary consumer with only production dependencies, +and check that its public entry point and protobuf RPC runtime can be imported. +This check requires access to the npm registry and also runs in the unit-test CI +matrix, without monorepo hoisting or code-generation tooling masking missing +runtime dependencies. + ## Within upload-artifact or download-artifact actions Any easy way to test changes for the official upload/download actions is to fork them, compile changes and run them. diff --git a/RELEASES.md b/RELEASES.md index f444648..0f81b8a 100644 --- a/RELEASES.md +++ b/RELEASES.md @@ -1,5 +1,9 @@ # @actions/artifact Releases +## 6.3.1 + +- Declare `@protobuf-ts/runtime-rpc` as a production dependency so the package can be imported in clean consumers without the protobuf code-generation tooling. + ## 6.3.0 - Honor positive integer `Retry-After` seconds on HTTP 429 responses, including when the response body is not valid JSON. Unsupported or missing values use exponential backoff ([#2534](https://github.com/actions/toolkit/pull/2534)). diff --git a/package-lock.json b/package-lock.json index eb3f82d..6ae59d6 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "@actions/artifact", - "version": "6.3.0", + "version": "6.3.1", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "@actions/artifact", - "version": "6.3.0", + "version": "6.3.1", "license": "MIT", "dependencies": { "@actions/core": "^3.0.1", @@ -19,6 +19,7 @@ "@octokit/request": "^10.0.8", "@octokit/request-error": "^7.1.0", "@protobuf-ts/runtime": "^2.11.1", + "@protobuf-ts/runtime-rpc": "^2.11.1", "archiver": "^7.0.1", "jwt-decode": "^4.0.0", "unzip-stream": "^0.3.1" @@ -681,7 +682,6 @@ "version": "2.11.1", "resolved": "https://registry.npmjs.org/@protobuf-ts/runtime-rpc/-/runtime-rpc-2.11.1.tgz", "integrity": "sha512-4CqqUmNA+/uMz00+d3CYKgElXO9VrEbucjnBFEjqI4GuDrEQ32MaI3q+9qPBvIGOlL4PmHXrzM32vBPWRhQKWQ==", - "dev": true, "license": "Apache-2.0", "dependencies": { "@protobuf-ts/runtime": "^2.11.1" diff --git a/package.json b/package.json index 4d99ef8..e509374 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@actions/artifact", - "version": "6.3.0", + "version": "6.3.1", "preview": true, "description": "Actions artifact lib", "keywords": [ @@ -38,6 +38,7 @@ "scripts": { "audit-moderate": "npm install && npm audit --json --audit-level=moderate > audit.json", "test": "cd ../../ && npm run test ./packages/artifact", + "test:package": "node scripts/test-package.mjs", "bootstrap": "cd ../../ && npm run bootstrap", "tsc-run": "tsc && cp src/internal/shared/package-version.cjs lib/internal/shared/", "tsc": "npm run bootstrap && npm run tsc-run", @@ -57,6 +58,7 @@ "@octokit/request": "^10.0.8", "@octokit/request-error": "^7.1.0", "@protobuf-ts/runtime": "^2.11.1", + "@protobuf-ts/runtime-rpc": "^2.11.1", "archiver": "^7.0.1", "jwt-decode": "^4.0.0", "unzip-stream": "^0.3.1" diff --git a/scripts/test-package.mjs b/scripts/test-package.mjs new file mode 100644 index 0000000..f7ee612 --- /dev/null +++ b/scripts/test-package.mjs @@ -0,0 +1,77 @@ +import assert from 'node:assert/strict' +import {execFileSync} from 'node:child_process' +import {mkdtempSync, readFileSync, rmSync} from 'node:fs' +import {tmpdir} from 'node:os' +import {join} from 'node:path' +import {fileURLToPath} from 'node:url' + +const packageDirectory = fileURLToPath(new URL('../', import.meta.url)) +const npm = process.env.npm_execpath +assert.ok(npm, 'Run this check with npm run test:package') + +const consumer = mkdtempSync(join(tmpdir(), 'artifact-package-')) +const env = {...process.env} +delete env.NODE_PATH + +function runNpm(args, cwd) { + return execFileSync(process.execPath, [npm, ...args], { + cwd, + env, + encoding: 'utf8' + }) +} + +try { + const [{filename}] = JSON.parse( + runNpm( + ['pack', '--json', '--ignore-scripts', '--pack-destination', consumer], + packageDirectory + ) + ) + runNpm( + [ + 'install', + '--omit=dev', + '--ignore-scripts', + '--no-audit', + '--no-fund', + '--package-lock=false', + join(consumer, filename) + ], + consumer + ) + + const manifest = JSON.parse( + readFileSync( + join(consumer, 'node_modules/@actions/artifact/package.json'), + 'utf8' + ) + ) + assert.equal(manifest.dependencies['@protobuf-ts/runtime-rpc'], '^2.11.1') + execFileSync( + process.execPath, + [ + '--input-type=module', + '--eval', + ` + import assert from 'node:assert/strict' + import {createRequire} from 'node:module' + import client, {DefaultArtifactClient} from '@actions/artifact' + import {ServiceType} from '@protobuf-ts/runtime-rpc' + + assert.ok(client instanceof DefaultArtifactClient) + assert.equal(typeof ServiceType, 'function') + const require = createRequire(import.meta.url) + assert.throws(() => require.resolve('@protobuf-ts/plugin'), { + code: 'MODULE_NOT_FOUND' + }) + ` + ], + {cwd: consumer, env, stdio: 'inherit'} + ) + console.log( + 'Packed artifact imports successfully with production dependencies' + ) +} finally { + rmSync(consumer, {recursive: true, force: true}) +} From 7b81ecbf50fc32abc343aab1247cd92e01a2d5f2 Mon Sep 17 00:00:00 2001 From: tunc-d <46646394+tunc-d@users.noreply.github.com> Date: Tue, 6 Oct 2026 14:17:06 +0200 Subject: [PATCH 2/2] chore(artifact): keep runtime dependency fix minimal Remove the packed-package test, CI step, and related documentation. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- CONTRIBUTIONS.md | 7 ---- package.json | 1 - scripts/test-package.mjs | 77 ---------------------------------------- 3 files changed, 85 deletions(-) delete mode 100644 scripts/test-package.mjs diff --git a/CONTRIBUTIONS.md b/CONTRIBUTIONS.md index bb614bf..171b015 100644 --- a/CONTRIBUTIONS.md +++ b/CONTRIBUTIONS.md @@ -29,13 +29,6 @@ To run unit tests for the `@actions/artifact` package: 3. Change working directory to `packages/artifact` 4. Run jest tests: `npm run test` -After building the package, run `npm run test:package` from `packages/artifact` -to pack it, install it in a temporary consumer with only production dependencies, -and check that its public entry point and protobuf RPC runtime can be imported. -This check requires access to the npm registry and also runs in the unit-test CI -matrix, without monorepo hoisting or code-generation tooling masking missing -runtime dependencies. - ## Within upload-artifact or download-artifact actions Any easy way to test changes for the official upload/download actions is to fork them, compile changes and run them. diff --git a/package.json b/package.json index e509374..2f0179b 100644 --- a/package.json +++ b/package.json @@ -38,7 +38,6 @@ "scripts": { "audit-moderate": "npm install && npm audit --json --audit-level=moderate > audit.json", "test": "cd ../../ && npm run test ./packages/artifact", - "test:package": "node scripts/test-package.mjs", "bootstrap": "cd ../../ && npm run bootstrap", "tsc-run": "tsc && cp src/internal/shared/package-version.cjs lib/internal/shared/", "tsc": "npm run bootstrap && npm run tsc-run", diff --git a/scripts/test-package.mjs b/scripts/test-package.mjs deleted file mode 100644 index f7ee612..0000000 --- a/scripts/test-package.mjs +++ /dev/null @@ -1,77 +0,0 @@ -import assert from 'node:assert/strict' -import {execFileSync} from 'node:child_process' -import {mkdtempSync, readFileSync, rmSync} from 'node:fs' -import {tmpdir} from 'node:os' -import {join} from 'node:path' -import {fileURLToPath} from 'node:url' - -const packageDirectory = fileURLToPath(new URL('../', import.meta.url)) -const npm = process.env.npm_execpath -assert.ok(npm, 'Run this check with npm run test:package') - -const consumer = mkdtempSync(join(tmpdir(), 'artifact-package-')) -const env = {...process.env} -delete env.NODE_PATH - -function runNpm(args, cwd) { - return execFileSync(process.execPath, [npm, ...args], { - cwd, - env, - encoding: 'utf8' - }) -} - -try { - const [{filename}] = JSON.parse( - runNpm( - ['pack', '--json', '--ignore-scripts', '--pack-destination', consumer], - packageDirectory - ) - ) - runNpm( - [ - 'install', - '--omit=dev', - '--ignore-scripts', - '--no-audit', - '--no-fund', - '--package-lock=false', - join(consumer, filename) - ], - consumer - ) - - const manifest = JSON.parse( - readFileSync( - join(consumer, 'node_modules/@actions/artifact/package.json'), - 'utf8' - ) - ) - assert.equal(manifest.dependencies['@protobuf-ts/runtime-rpc'], '^2.11.1') - execFileSync( - process.execPath, - [ - '--input-type=module', - '--eval', - ` - import assert from 'node:assert/strict' - import {createRequire} from 'node:module' - import client, {DefaultArtifactClient} from '@actions/artifact' - import {ServiceType} from '@protobuf-ts/runtime-rpc' - - assert.ok(client instanceof DefaultArtifactClient) - assert.equal(typeof ServiceType, 'function') - const require = createRequire(import.meta.url) - assert.throws(() => require.resolve('@protobuf-ts/plugin'), { - code: 'MODULE_NOT_FOUND' - }) - ` - ], - {cwd: consumer, env, stdio: 'inherit'} - ) - console.log( - 'Packed artifact imports successfully with production dependencies' - ) -} finally { - rmSync(consumer, {recursive: true, force: true}) -}