actions/setup-java
1
0
Fork 0
mirror of https://github.com/actions/setup-java.git synced 2026-10-02 09:06:05 +03:00
Code Issues Packages Projects Releases Wiki Activity

Fix import-safe checks when scripts are run from a path with symlinks (#1265)

Browse Source 
* Fix import-safe checks when scripts are run from a path with symlinks

In v6, setup-java was made "import-safe" to facilitate testing. This
prevents setup-java & cleanup-java from doing anything when their
sources get imported.

This works fine in the general case, but actually invoking the script
(`node setup-java/index.js`) when the path to the script contains
symlinks led to the script incorrectly believing it was imported, and
refuse to actually run.

To fix this, we pass `process.argv[1]` through `fs.realpathSync`, which
resolves symlinks in the path.

Fixes #1264

* Preserve import safety when resolving symlink entrypoints

Share entrypoint detection between setup and cleanup, handle non-file entrypoints safely, and normalize both paths for preserved symlinks. Add real-process regression coverage and rebuild action bundles.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 831c32f2-a275-45bd-a92b-c387372a1554

* Update js-yaml to fix merge-source denial of service

Bump the transitive development dependency from 3.15.1 to 3.15.2 to address GHSA-2883-xcg3-v3hh without changing dependency ranges or CI checks.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 831c32f2-a275-45bd-a92b-c387372a1554

---------

Co-authored-by: Bruno Borges <brborges@microsoft.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 831c32f2-a275-45bd-a92b-c387372a1554
This commit is contained in:
otaconix
2026-09-09 02:20:21 -04:00
committed by GitHub
co-authored by Copilot App Bruno Borges
parent 0781fc6af3
commit 134912a529
10 changed files with 226 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/cleanup-java.ts
+2 -2
View File
@@ -6,7 +6,7 @@ import {
isJdkCacheEnabled,
isJobStatusSuccess
} from './util.js';
import {fileURLToPath} from 'url';
import {isMainModule} from './is-main-module.js';
async function removeGpgHome() {
const gpgHome = core.getState(constants.STATE_GPG_HOME);
@@ -77,7 +77,7 @@ export async function run() {
await ignoreError(saveCaches());
}
if (process.argv[1] === fileURLToPath(import.meta.url)) {
if (isMainModule(import.meta.url)) {
run();
} else {
// https://nodejs.org/api/modules.html#modules_accessing_the_main_module