Skip to content

fix: Resolve CVE-2025-25288 by migrating to ESM and upgrading depende… #104

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
+35,575 −27,341
Open

fix: Resolve CVE-2025-25288 by migrating to ESM and upgrading depende… #104

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 7 additions & 11 deletions action.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,16 +3,12 @@
* SPDX-License-Identifier: MPL-2.0
*/

'use strict'

const fs = require('fs').promises
const os = require('os')
const crypto = require('crypto')

const core = require('@actions/core')
const tc = require('@actions/tool-cache')

const octokit = require('./octokit')
import { promises as fs } from 'fs'
import os from 'os'
import crypto from 'crypto'
import core from '@actions/core'
import tc from '@actions/tool-cache'
import octokit from './octokit.js'

const owner = 'hashicorp'
const repo = 'copywrite'
Expand Down Expand Up @@ -108,4 +104,4 @@ async function run () {
}
}

module.exports = run
export default run
45 changes: 23 additions & 22 deletions action.test.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,12 +3,18 @@
* SPDX-License-Identifier: MPL-2.0
*/

const fs = require('fs')
const nock = require('nock')
const path = require('path')
const os = require('os')

const core = require('@actions/core')
import fs from 'fs'
import nock from 'nock'
import path from 'path'
import os from 'os'
import { vi, describe, test, beforeAll, beforeEach, expect } from 'vitest'
import core from '@actions/core'
import { fileURLToPath } from 'url'
import { dirname } from 'path'
import action from './action.js'

const __filename = fileURLToPath(import.meta.url)
const __dirname = dirname(__filename)

const mockRelease = {
assets: [
Expand Down Expand Up @@ -45,9 +51,9 @@ beforeEach(() => {
process.env.INPUT_VERSION = 'latest'
process.env['INPUT_VERSION-CHECKSUM'] = '5663389ef1a8ec48af6ca622e66bf0f54ba8f22c127f14cb8a3f429e40868582'

const spyOsArch = jest.spyOn(os, 'arch')
const spyOsArch = vi.spyOn(os, 'arch')
spyOsArch.mockReturnValue('x64')
const spyOsPlatform = jest.spyOn(os, 'platform')
const spyOsPlatform = vi.spyOn(os, 'platform')
spyOsPlatform.mockReturnValue('win32')
})

Expand All @@ -61,18 +67,17 @@ describe('action', () => {
// const scopeWeb = nock('https://github.com')
// .get('/hashicorp/copywrite/releases/download/v0.1.3/copywrite_0.1.3_windows_x86_64.zip')
// .replyWithFile(200, path.resolve(__dirname, 'test.zip'), { 'content-type': 'application/octet-stream' })
const spyCoreAddPath = jest.spyOn(core, 'addPath')
const spyCoreSetOutput = jest.spyOn(core, 'setOutput')
const spyCoreAddPath = vi.spyOn(core, 'addPath')
const spyCoreSetOutput = vi.spyOn(core, 'setOutput')

fs.mkdtemp(path.join(os.tmpdir(), 'setup-copywrite-'), async (err, directory) => {
if (err) throw err

process.env.RUNNER_TEMP = directory

const spyOsHomedir = jest.spyOn(os, 'homedir')
const spyOsHomedir = vi.spyOn(os, 'homedir')
spyOsHomedir.mockReturnValue(directory)

const action = require('./action')
await expect(await action()).resolves
expect(scopeAPI.isDone()).toBeTruthy()
expect(spyCoreAddPath).toHaveBeenCalled()
Expand All @@ -90,19 +95,18 @@ describe('action', () => {
// const scopeWeb = nock('https://github.com')
// .get('/hashicorp/copywrite/releases/download/v0.1.3/copywrite_0.1.3_windows_x86_64.zip')
// .replyWithFile(200, path.resolve(__dirname, 'test.zip'), { 'content-type': 'application/octet-stream' })
const spyCoreAddPath = jest.spyOn(core, 'addPath')
const spyCoreSetOutput = jest.spyOn(core, 'setOutput')
const spyCoreAddPath = vi.spyOn(core, 'addPath')
const spyCoreSetOutput = vi.spyOn(core, 'setOutput')

fs.mkdtemp(path.join(os.tmpdir(), 'setup-copywrite-'), async (err, directory) => {
if (err) throw err

process.env.INPUT_VERSION = 'v0.1.3'
process.env.RUNNER_TEMP = directory

const spyOsHomedir = jest.spyOn(os, 'homedir')
const spyOsHomedir = vi.spyOn(os, 'homedir')
spyOsHomedir.mockReturnValue(directory)

const action = require('./action')
await expect(await action()).resolves
expect(scopeAPI.isDone()).toBeTruthy()
expect(spyCoreAddPath).toHaveBeenCalled()
Expand All @@ -126,10 +130,9 @@ describe('action', () => {
process.env.INPUT_VERSION = 'v0.1.3'
process.env.RUNNER_TEMP = directory

const spyOsHomedir = jest.spyOn(os, 'homedir')
const spyOsHomedir = vi.spyOn(os, 'homedir')
spyOsHomedir.mockReturnValue(directory)

const action = require('./action')
await expect(await action()).resolves
expect(scope.isDone()).toBeTruthy()
done()
Expand All @@ -154,10 +157,9 @@ describe('action', () => {
process.env.INPUT_VERSION = 'v0.1.3'
process.env.RUNNER_TEMP = directory

const spyOsHomedir = jest.spyOn(os, 'homedir')
const spyOsHomedir = vi.spyOn(os, 'homedir')
spyOsHomedir.mockReturnValue(directory)

const action = require('./action')
await expect(await action()).resolves
expect(scope.isDone()).toBeTruthy()
done()
Expand All @@ -179,10 +181,9 @@ describe('action', () => {
process.env.INPUT_VERSION = 'v0.1.3'
process.env.RUNNER_TEMP = directory

const spyOsHomedir = jest.spyOn(os, 'homedir')
const spyOsHomedir = vi.spyOn(os, 'homedir')
spyOsHomedir.mockReturnValue(directory)

const action = require('./action')
await expect(await action()).resolves
expect(scope.isDone()).toBeTruthy()
done()
Expand Down
2 changes: 1 addition & 1 deletion action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ outputs:
description: 'The version of the copywrite CLI that was installed.'
runs:
using: 'node20'
main: 'dist/index.js'
main: 'dist/index.cjs'
branding:
icon: "file-text"
color: "gray-dark"
18 changes: 18 additions & 0 deletions build.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,18 @@
import { build } from 'esbuild'

// Build as CommonJS for GitHub Actions
// Using .cjs extension so Node treats it as CommonJS regardless of package.json "type"
await build({
entryPoints: ['index.js'],
bundle: true,
platform: 'node',
target: 'node20',
format: 'cjs',
outfile: 'dist/index.cjs',
sourcemap: true,
banner: {
js: '// Copyright IBM Corp. 2023, 2025\n// SPDX-License-Identifier: MPL-2.0\n'
}
})

console.log('✓ Bundle created successfully: dist/index.cjs')
Loading
Loading