actions/setup-bun
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Use redactUrlForLogs

Browse Source
This commit is contained in:
tcely 2026-03-14 19:50:36 -04:00
parent 372f34d83a
commit 4f1ce51cf0
No known key found for this signature in database
GPG Key ID: 9F1DAF9D9070430F
1 changed files with 5 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/verify.ts
View File

@ -5,6 +5,7 @@ import { GITHUB_DIGEST_THRESHOLD } from "./github-api";
import { fetchAssetMetadata, getHexFromDigest } from "./github-asset"; import { fetchAssetMetadata, getHexFromDigest } from "./github-asset";
import { getVerifiedManifest } from "./manifest"; import { getVerifiedManifest } from "./manifest";
import { gitHubAssetDownloadUrl } from "./url"; import { gitHubAssetDownloadUrl } from "./url";
import { redactUrlForLogs } from "./utils";
class DigestVerificationError extends Error {} class DigestVerificationError extends Error {}
class UnsupportedAlgorithmError extends Error {} class UnsupportedAlgorithmError extends Error {}
@ -52,13 +53,12 @@ export async function verifyAsset(
algorithm: SupportedAlgorithmNames = "sha256", algorithm: SupportedAlgorithmNames = "sha256",
): Promise<string> { ): Promise<string> {
const manifestFile = getManifest(algorithm); const manifestFile = getManifest(algorithm);
const safeUrl = redactUrlForLogs(downloadUrl);
const urlObj = new URL(downloadUrl); const urlObj = new URL(downloadUrl);
const rawAssetName = urlObj.pathname.split("/").pop(); const rawAssetName = urlObj.pathname.split("/").pop();
if (!rawAssetName) { if (!rawAssetName) {
throw new Error( throw new Error(`Could not determine asset filename from URL: ${safeUrl}`);
`Could not determine asset filename from URL: ${downloadUrl}`,
);
} }
let assetName: string = rawAssetName; let assetName: string = rawAssetName;
@ -85,9 +85,7 @@ export async function verifyAsset(
metadata = await fetchAssetMetadata(downloadUrl, token); metadata = await fetchAssetMetadata(downloadUrl, token);
} catch (err) { } catch (err) {
const message = err instanceof Error ? err.message : String(err); const message = err instanceof Error ? err.message : String(err);
warning( warning(`Skipping GitHub API digest check for: ${safeUrl} (${message})`);
`Skipping GitHub API digest check for: ${downloadUrl} (${message})`,
);
} }
let manifestBaseUrl = ""; let manifestBaseUrl = "";
@ -144,7 +142,7 @@ export async function verifyAsset(
// Bun archives always follow the pattern: bun-<specifiers>.zip // Bun archives always follow the pattern: bun-<specifiers>.zip
if (!lastSegment.startsWith("bun-") || !lastSegment.endsWith(".zip")) { if (!lastSegment.startsWith("bun-") || !lastSegment.endsWith(".zip")) {
throw new Error( throw new Error(
`Cannot derive manifest URL: "${downloadUrl}" ` + `Cannot derive manifest URL: "${safeUrl}" ` +
`does not appear to be a direct Bun archive URL. ` + `does not appear to be a direct Bun archive URL. ` +
`The path was expected to end with a filename matching "bun-*.zip".`, `The path was expected to end with a filename matching "bun-*.zip".`,
); );