Add Publish Immutable Action (#584)

* Upgrade-actions/cache for v3

* Upgrade actions/upload-artifact from v3 to v4

* audit fix

* Replaced macos-latest with macos-13

* fix check failures

.github/workflows/check-dist.yml

@@ -27,6 +27,7 @@ jobs:
         uses: actions/setup-node@v3
         with:
           node-version: 16.x
+          cache: npm
 
       - name: Install dependencies
         run: npm ci
@@ -44,7 +45,7 @@ jobs:
         id: diff
 
       # If index.js was different than expected, upload the expected version as an artifact
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         if: ${{ failure() && steps.diff.conclusion == 'failure' }}
         with:
           name: dist

.github/workflows/publish-immutable-actions.yml

@@ -0,0 +1,20 @@
+name: 'Publish Immutable Action Version'
+
+on:
+  release:
+    types: [published]
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+      packages: write
+
+    steps:
+      - name: Checking out
+        uses: actions/checkout@v4
+      - name: Publish
+        id: publish
+        uses: actions/publish-immutable-action@v0.0.4

.github/workflows/release-new-action-version.yml

@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Update the ${{ env.TAG_NAME }} tag
-        uses: actions/publish-action@v0.1.0
+        uses: actions/publish-action@v0.2.1
         with:
           source-tag: ${{ env.TAG_NAME }}
           slack-webhook: ${{ secrets.SLACK_WEBHOOK }}

.github/workflows/versions.yml

@@ -12,6 +12,57 @@ on:
     - cron: 0 0 * * *
 
 jobs:
+  stable:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+    steps:
+      - uses: actions/checkout@v3
+      - name: Setup Go Stable
+        uses: ./
+        with:
+          go-version: stable
+      - name: Verify Go
+        run: go version
+
+  oldstable:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+    steps:
+      - uses: actions/checkout@v3
+      - name: Setup Go oldStable
+        uses: ./
+        with:
+          go-version: oldstable
+      - name: Verify Go
+        run: go version
+  
+  aliases-arch:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+        version: [stable, oldstable]
+        architecture: [x64, x32]
+        exclude:
+        - os: macos-latest
+          architecture: x32
+    steps:
+      - uses: actions/checkout@v3
+      - name: Setup Go ${{ matrix.version }} ${{ matrix.architecture }}
+        uses: ./
+        with:
+          go-version: ${{ matrix.version }}
+          architecture: ${{ matrix.architecture }}
+      - name: Verify Go
+        run: go version
+
   local-cache:
     name: Setup local-cache version
     runs-on: ${{ matrix.os }}
@@ -55,7 +106,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, windows-latest, macos-latest]
+        os: [ubuntu-latest, windows-latest, macos-13]
     steps:
       - uses: actions/checkout@v3
       - name: Setup Go and check latest
@@ -66,13 +117,29 @@ jobs:
         run: __tests__/verify-go.sh 1.14
         shell: bash
 
+  go-version-file-with-gowork:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-latest]
+    steps:
+      - uses: actions/checkout@v3
+      - name: Setup Go and check latest
+        uses: ./
+        with:
+          go-version-file: __tests__/data/go.work
+      - name: verify go
+        run: __tests__/verify-go.sh 1.19
+        shell: bash
+
   setup-versions-from-manifest:
     name: Setup ${{ matrix.go }} ${{ matrix.os }}
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
       matrix:
-        os: [macos-latest, windows-latest, ubuntu-latest]
+        os: [macos-13, windows-latest, ubuntu-latest]
         go: [1.12.16, 1.13.11, 1.14.3]
     steps:
       - name: Checkout
@@ -93,8 +160,11 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [macos-latest, windows-latest, ubuntu-latest]
+        os: [macos-13, windows-latest, ubuntu-latest]
-        go: [1.9, 1.8.6]
+        go: [1.11.12, 1.8.6]
+        exclude:
+          - os: macos-13
+            go: 1.8.6
     steps:
       - name: Checkout
         uses: actions/checkout@v3

README.md

@@ -16,6 +16,7 @@ The V3 edition of the action offers:
 - Proxy support
 - Check latest version
 - Caching packages dependencies
+- stable and oldstable aliases
 - Bug Fixes (including issues around version matching and semver)
 
 The action will first check the local cache for a version match. If a version is not found locally, it will pull it from the `main` branch of the [go-versions](https://github.com/actions/go-versions/blob/main/versions-manifest.json) repository. On miss or failure, it will fall back to downloading directly from [go dist](https://storage.googleapis.com/golang). To change the default behavior, please use the [check-latest input](#check-latest-version).
@@ -95,6 +96,33 @@ steps:
       check-latest: true
   - run: go run hello.go
 ```
+
+## Using stable/oldstable aliases
+
+If `stable` is provided, action will get the latest stable version from the [`go-versions`](https://github.com/actions/go-versions/blob/main/versions-manifest.json) repository manifest. 
+
+If `oldstable` is provided, when current release is 1.19.x, action will resolve version as 1.18.x, where x is the latest patch release.
+
+**Note:** using these aliases will result in same version as using corresponding minor release with `check-latest` input set to `true`
+
+```yaml
+steps:
+  - uses: actions/checkout@v3
+  - uses: actions/setup-go@v3
+    with:
+      go-version: 'stable'
+  - run: go run hello.go
+```
+
+```yaml
+steps:
+  - uses: actions/checkout@v3
+  - uses: actions/setup-go@v3
+    with:
+      go-version: 'oldstable'
+  - run: go run hello.go
+```
+
 ## Caching dependency files and build outputs:
 
 The action has a built-in functionality for caching and restoring go modules and build outputs. It uses [actions/cache](https://github.com/actions/cache) under the hood but requires less configuration settings. The `cache` input is optional, and caching is turned off by default.
@@ -127,7 +155,7 @@ steps:
   ```
 ## Getting go version from the go.mod file
 
-The `go-version-file` input accepts a path to a `go.mod` file containing the version of Go to be used by a project. As the `go.mod` file contains only major and minor (e.g. 1.18) tags, the action will search for the latest available patch version sequentially in the runner's directory with the cached tools, in the [version-manifest.json](https://github.com/actions/go-versions/blob/main/versions-manifest.json) file or at the go servers.
+The `go-version-file` input accepts a path to a `go.mod` file or a `go.work` file that contains the version of Go to be used by a project. As the `go.mod` file contains only major and minor (e.g. 1.18) tags, the action will search for the latest available patch version sequentially in the runner's directory with the cached tools, in the [version-manifest.json](https://github.com/actions/go-versions/blob/main/versions-manifest.json) file or at the go servers.
 
 If both the `go-version` and the `go-version-file` inputs are provided then the `go-version` input is used.
 > The action will search for the `go.mod` file relative to the repository root
@@ -169,6 +197,21 @@ The `go-version` input supports the following syntax:
 
 For more information about semantic versioning, please refer to [semver](https://github.com/npm/node-semver) documentation.
 
+## Using `setup-go` on GHES
+
+`setup-go` comes pre-installed on the appliance with GHES if Actions is enabled. When dynamically downloading Go distributions, `setup-go` downloads distributions from [`actions/go-versions`](https://github.com/actions/go-versions) on github.com (outside of the appliance). These calls to `actions/go-versions` are made via unauthenticated requests, which are limited to [60 requests per hour per IP](https://docs.github.com/en/rest/overview/resources-in-the-rest-api#rate-limiting). If more requests are made within the time frame, then you will start to see rate-limit errors during downloading that looks like: `##[error]API rate limit exceeded for...`. After that error the action will try to download versions directly from https://storage.googleapis.com/golang, but it also can have rate limit so it's better to put token.
+
+To get a higher rate limit, you can [generate a personal access token on github.com](https://github.com/settings/tokens/new) and pass it as the `token` input for the action:
+
+```yaml
+uses: actions/setup-go@v3
+with:
+  token: ${{ secrets.GH_DOTCOM_TOKEN }}
+  go-version: 1.18
+```
+
+If the runner is not able to access github.com, any Go versions requested during a workflow run must come from the runner's tool cache. See "[Setting up the tool cache on self-hosted runners without internet access](https://docs.github.com/en/enterprise-server@3.2/admin/github-actions/managing-access-to-actions-from-githubcom/setting-up-the-tool-cache-on-self-hosted-runners-without-internet-access)" for more information.
+
 # License
 
 The scripts and documentation in this project are released under the [MIT License](LICENSE)

__tests__/data/go.work

@@ -0,0 +1,3 @@
+go 1.19
+
+use .

__tests__/setup-go.test.ts

@@ -41,6 +41,7 @@ describe('setup-go', () => {
   let mkdirpSpy: jest.SpyInstance;
   let execSpy: jest.SpyInstance;
   let getManifestSpy: jest.SpyInstance;
+  let getAllVersionsSpy: jest.SpyInstance;
 
   beforeAll(async () => {
     process.env['GITHUB_ENV'] = ''; // Stub out Environment file functionality so we can verify it writes to standard out (toolkit is backwards compatible)
@@ -83,6 +84,7 @@ describe('setup-go', () => {
     cacheSpy = jest.spyOn(tc, 'cacheDir');
     getSpy = jest.spyOn(im, 'getVersionsDist');
     getManifestSpy = jest.spyOn(tc, 'getManifestFromRepo');
+    getAllVersionsSpy = jest.spyOn(im, 'getManifest');
 
     // io
     whichSpy = jest.spyOn(io, 'which');
@@ -700,7 +702,7 @@ describe('setup-go', () => {
 
       findSpy.mockImplementation(() => '');
       dlSpy.mockImplementation(async () => '/some/temp/path');
-      const toolPath = path.normalize('/cache/go/1.17.5/x64');
+      const toolPath = path.normalize('/cache/go/1.17.6/x64');
       extractTarSpy.mockImplementation(async () => '/some/other/temp/path');
       cacheSpy.mockImplementation(async () => toolPath);
 
@@ -779,6 +781,7 @@ describe('setup-go', () => {
       getManifestSpy.mockImplementation(() => {
         throw new Error('Unable to download manifest');
       });
+      getAllVersionsSpy.mockImplementationOnce(() => undefined);
 
       dlSpy.mockImplementation(async () => '/some/temp/path');
       let toolPath = path.normalize('/cache/go/1.13.7/x64');
@@ -824,6 +827,12 @@ require (
 
 replace example.com/thatmodule => ../thatmodule
 exclude example.com/thismodule v1.3.0
+`;
+
+    const goWorkContents = `go 1.19
+
+use .
+
 `;
 
     it('reads version from go.mod', async () => {
@@ -838,6 +847,18 @@ exclude example.com/thismodule v1.3.0
       expect(logSpy).toHaveBeenCalledWith('matching 1.14...');
     });
 
+    it('reads version from go.work', async () => {
+      inputs['go-version-file'] = 'go.work';
+      existsSpy.mockImplementation(() => true);
+      readFileSpy.mockImplementation(() => Buffer.from(goWorkContents));
+
+      await main.run();
+
+      expect(logSpy).toHaveBeenCalledWith('Setup go version spec 1.19');
+      expect(logSpy).toHaveBeenCalledWith('Attempting to download 1.19...');
+      expect(logSpy).toHaveBeenCalledWith('matching 1.19...');
+    });
+
     it('reads version from .go-version', async () => {
       inputs['go-version-file'] = '.go-version';
       existsSpy.mockImplementation(() => true);
@@ -908,5 +929,32 @@ exclude example.com/thismodule v1.3.0
         );
       }
     }, 100000);
+
+    it.each(['stable', 'oldstable'])(
+      'acquires latest go version with %s go-version input',
+      async (alias: string) => {
+        const arch = 'x64';
+        os.platform = 'darwin';
+        os.arch = arch;
+
+        inputs['go-version'] = alias;
+        inputs['architecture'] = os.arch;
+
+        // ... but not in the local cache
+        findSpy.mockImplementation(() => '');
+
+        dlSpy.mockImplementation(async () => '/some/temp/path');
+        let toolPath = path.normalize(`/cache/go/${alias}/${arch}`);
+        cacheSpy.mockImplementation(async () => toolPath);
+
+        await main.run();
+
+        const releaseIndex = alias === 'stable' ? 0 : 1;
+
+        expect(logSpy).toHaveBeenCalledWith(
+          `${alias} version resolved as ${goTestManifest[releaseIndex].version}`
+        );
+      }
+    );
   });
 });

action.yml

@@ -5,13 +5,13 @@ inputs:
   go-version:
     description: 'The Go version to download (if necessary) and use. Supports semver spec and ranges.'
   go-version-file:
-    description: 'Path to the go.mod file.'
+    description: 'Path to the go.mod or go.work file.'
   check-latest:
     description: 'Set this option to true if you want the action to always check for the latest available version that satisfies the version spec'
     default: false
   token:
-    description: Used to pull node distributions from go-versions.  Since there's a default, this is typically not supplied by the user.
+    description: Used to pull node distributions from go-versions. Since there's a default, this is typically not supplied by the user. When running this action on github.com, the default value is sufficient. When running on GHES, you can pass a personal access token for github.com if you are experiencing rate limiting.
-    default: ${{ github.token }}
+    default: ${{ github.server_url == 'https://github.com' && github.token || '' }}
   cache:
     description: Used to specify whether caching is needed. Set to true, if you'd like to enable caching.
     default: false

package.json

@@ -23,7 +23,7 @@
   "author": "GitHub",
   "license": "MIT",
   "dependencies": {
-    "@actions/cache": "^3.0.0",
+    "@actions/cache": "^4.0.3",
     "@actions/core": "^1.10.0",
     "@actions/exec": "^1.1.0",
     "@actions/glob": "^0.2.0",
@@ -42,6 +42,6 @@
     "nock": "^10.0.6",
     "prettier": "^1.17.1",
     "ts-jest": "^27.0.5",
-    "typescript": "^3.8.3"
+    "typescript": "^4.3.3"
   }
 }

src/installer.ts

@@ -6,6 +6,7 @@ import * as httpm from '@actions/http-client';
 import * as sys from './system';
 import fs from 'fs';
 import os from 'os';
+import {StableReleaseAlias} from './utils';
 
 type InstallationType = 'dist' | 'manifest';
 
@@ -35,15 +36,43 @@ export async function getGo(
   auth: string | undefined,
   arch = os.arch()
 ) {
+  let manifest: tc.IToolRelease[] | undefined;
   let osPlat: string = os.platform();
 
+  if (
+    versionSpec === StableReleaseAlias.Stable ||
+    versionSpec === StableReleaseAlias.OldStable
+  ) {
+    manifest = await getManifest(auth);
+    let stableVersion = await resolveStableVersionInput(
+      versionSpec,
+      arch,
+      osPlat,
+      manifest
+    );
+
+    if (!stableVersion) {
+      stableVersion = await resolveStableVersionDist(versionSpec, arch);
+      if (!stableVersion) {
+        throw new Error(
+          `Unable to find Go version '${versionSpec}' for platform ${osPlat} and architecture ${arch}.`
+        );
+      }
+    }
+
+    core.info(`${versionSpec} version resolved as ${stableVersion}`);
+
+    versionSpec = stableVersion;
+  }
+
   if (checkLatest) {
     core.info('Attempting to resolve the latest version from the manifest...');
     const resolvedVersion = await resolveVersionFromManifest(
       versionSpec,
       true,
       auth,
-      arch
+      arch,
+      manifest
     );
     if (resolvedVersion) {
       versionSpec = resolvedVersion;
@@ -69,7 +98,7 @@ export async function getGo(
   // Try download from internal distribution (popular versions only)
   //
   try {
-    info = await getInfoFromManifest(versionSpec, true, auth, arch);
+    info = await getInfoFromManifest(versionSpec, true, auth, arch, manifest);
     if (info) {
       downloadPath = await installGoVersion(info, auth, arch);
     } else {
@@ -118,10 +147,17 @@ async function resolveVersionFromManifest(
   versionSpec: string,
   stable: boolean,
   auth: string | undefined,
-  arch: string
+  arch: string,
+  manifest: tc.IToolRelease[] | undefined
 ): Promise<string | undefined> {
   try {
-    const info = await getInfoFromManifest(versionSpec, stable, auth, arch);
+    const info = await getInfoFromManifest(
+      versionSpec,
+      stable,
+      auth,
+      arch,
+      manifest
+    );
     return info?.resolvedVersion;
   } catch (err) {
     core.info('Unable to resolve a version from the manifest...');
@@ -174,21 +210,26 @@ export async function extractGoArchive(archivePath: string): Promise<string> {
   return extPath;
 }
 
+export async function getManifest(auth: string | undefined) {
+  return tc.getManifestFromRepo('actions', 'go-versions', auth, 'main');
+}
+
 export async function getInfoFromManifest(
   versionSpec: string,
   stable: boolean,
   auth: string | undefined,
-  arch = os.arch()
+  arch = os.arch(),
+  manifest?: tc.IToolRelease[] | undefined
 ): Promise<IGoVersionInfo | null> {
   let info: IGoVersionInfo | null = null;
-  const releases = await tc.getManifestFromRepo(
+  if (!manifest) {
-    'actions',
+    core.debug('No manifest cached');
-    'go-versions',
+    manifest = await getManifest(auth);
-    auth,
+  }
-    'main'
+
-  );
   core.info(`matching ${versionSpec}...`);
-  const rel = await tc.findFromManifest(versionSpec, stable, releases, arch);
+
+  const rel = await tc.findFromManifest(versionSpec, stable, manifest, arch);
 
   if (rel && rel.files.length > 0) {
     info = <IGoVersionInfo>{};
@@ -316,10 +357,75 @@ export function makeSemver(version: string): string {
 export function parseGoVersionFile(versionFilePath: string): string {
   const contents = fs.readFileSync(versionFilePath).toString();
 
-  if (path.basename(versionFilePath) === 'go.mod') {
+  if (
+    path.basename(versionFilePath) === 'go.mod' ||
+    path.basename(versionFilePath) === 'go.work'
+  ) {
     const match = contents.match(/^go (\d+(\.\d+)*)/m);
     return match ? match[1] : '';
   }
 
   return contents.trim();
 }
+
+async function resolveStableVersionDist(versionSpec: string, arch: string) {
+  let archFilter = sys.getArch(arch);
+  let platFilter = sys.getPlatform();
+  const dlUrl: string = 'https://golang.org/dl/?mode=json&include=all';
+  let candidates: IGoVersion[] | null = await module.exports.getVersionsDist(
+    dlUrl
+  );
+  if (!candidates) {
+    throw new Error(`golang download url did not return results`);
+  }
+
+  const fixedCandidates = candidates.map(item => {
+    return {
+      ...item,
+      version: makeSemver(item.version)
+    };
+  });
+
+  const stableVersion = await resolveStableVersionInput(
+    versionSpec,
+    archFilter,
+    platFilter,
+    fixedCandidates
+  );
+
+  return stableVersion;
+}
+
+export async function resolveStableVersionInput(
+  versionSpec: string,
+  arch: string,
+  platform: string,
+  manifest: tc.IToolRelease[] | IGoVersion[]
+) {
+  const releases = manifest
+    .map(item => {
+      const index = item.files.findIndex(
+        item => item.arch === arch && item.filename.includes(platform)
+      );
+      if (index === -1) {
+        return '';
+      }
+      return item.version;
+    })
+    .filter(item => !!item && !semver.prerelease(item));
+
+  if (versionSpec === StableReleaseAlias.Stable) {
+    return releases[0];
+  } else {
+    const versions = releases.map(
+      release => `${semver.major(release)}.${semver.minor(release)}`
+    );
+    const uniqueVersions = Array.from(new Set(versions));
+
+    const oldstableVersion = releases.find(item =>
+      item.startsWith(uniqueVersions[1])
+    );
+
+    return oldstableVersion;
+  }
+}

src/main.ts

@@ -4,7 +4,7 @@ import * as installer from './installer';
 import * as semver from 'semver';
 import path from 'path';
 import {restoreCache} from './cache-restore';
-import {isGhes, isCacheFeatureAvailable} from './cache-utils';
+import {isCacheFeatureAvailable} from './cache-utils';
 import cp from 'child_process';
 import fs from 'fs';
 import os from 'os';
@@ -28,9 +28,10 @@ export async function run() {
 
     if (versionSpec) {
       let token = core.getInput('token');
-      let auth = !token || isGhes() ? undefined : `token ${token}`;
+      let auth = !token ? undefined : `token ${token}`;
 
       const checkLatest = core.getBooleanInput('check-latest');
+
       const installDir = await installer.getGo(
         versionSpec,
         checkLatest,
@@ -38,10 +39,12 @@ export async function run() {
         arch
       );
 
+      const installDirVersion = path.basename(path.dirname(installDir));
+
       core.addPath(path.join(installDir, 'bin'));
       core.info('Added go to the path');
 
-      const version = installer.makeSemver(versionSpec);
+      const version = installer.makeSemver(installDirVersion);
       // Go versions less than 1.9 require GOROOT to be set
       if (semver.lt(version, '1.9.0')) {
         core.info('Setting GOROOT for Go version < 1.9');

src/utils.ts

@@ -0,0 +1,4 @@
+export enum StableReleaseAlias {
+  Stable = 'stable',
+  OldStable = 'oldstable'
+}