ts-apt is now published to npm, so depend on the exact release instead
of a git commit SHA. check_deps_pin accepts an exact registry version
whose lockfile entry resolves from registry.npmjs.org with a sha512
integrity hash, and still accepts a full SHA pin for unreleased ts-apt
changes. Ranges, tags and branch refs are still rejected.
1.1.1 keeps the 1.1.0 public API; the dpkg-query listInstalled output
format change does not affect the action, which doesn't call it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Replace the hand-rolled .githooks/ directory and core.hooksPath prepare
script with husky, matching ts-apt. The pre-push hook moves to
.husky/pre-push and still runs npm run check:deps-pin.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* build(deps): pin ts-apt to v1.1.0-rc.1
The previous pin, 342c7d0, was the ts-apt v2-support head before that
branch was rewritten, so no ts-apt branch or tag contains it anymore.
Pin 67d450e, the commit released as ts-apt v1.1.0-rc.1 on staging.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* build(deps): pin ts-apt to v1.1.0
Merging main-2 into this branch restored the unreachable 342c7d0 pin in
package.json while package-lock.json kept 67d450e. Pin both to 64aaab8,
the commit released as ts-apt v1.1.0.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Replace scripts/ops/check_tsapt_pin.sh with scripts/ops/check_deps_pin.mts,
which takes dependency names as arguments and checks each one for a
local symlink, a full commit SHA pin in package.json, and a matching,
non-link package-lock.json entry.
Rename the npm script to check:deps-pin (run with ts-apt) and use it from
the pre-push hook, the CI action-deps-pinned job and AGENTS.md.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* chore: remove unused dist directory
* build: remove unused dependencies and address npm audit findings
Remove dependencies nothing imports or runs: class-transformer, tar and
@types/tar (archives use system tar), internet-message,
@devcontainers/cli, @typescript-eslint/eslint-plugin, typedoc and
typedoc-plugin-markdown (with the dead docs:api script). Move rollup to
devDependencies since it is only used to build the bundle.
Update dependencies within their declared ranges and add scoped
overrides: glob 9.0.0 - 14.0.1 to ^14.0.4, and minimatch ^11.0.5 for
eslint, @typescript-eslint/parser and type-coverage only. minimatch is
not overridden for @actions/glob because minimatch 11 removed matchOne,
which @actions/glob calls (breaking cache hashFiles).
npm audit goes from 66 (2 critical, 10 high) to 39 (0 critical, 0 high).
Remaining: minimatch inside @actions/glob (production), npm's bundled
dependencies under @semantic-release/npm, and deepmerge (no fix).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Add scripts/ops/check_tsapt_pin.sh, which fails when node_modules/ts-apt
is a symlink, package.json does not pin ts-apt to a full commit SHA, or
package-lock.json resolves ts-apt to a link or a different SHA.
Run it from a .githooks/pre-push hook (installed by the npm prepare
script via core.hooksPath) and from the CI action-deps-pinned job, and
document the rule in AGENTS.md.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* ci: bundle the action with rollup and upload it for integration jobs
The integration jobs download an action-bundle-<sha> artifact that
nothing built or uploaded, so all of them failed on their first step.
v2 also had no bundle: action.yml runs dist/index.js, and an action has
no node_modules at runtime.
- Add rollup.config.mjs, which bundles the tsc output (dist/src) into a
self-contained dist/index.js. npm run build now runs it.
- Fix the setup action, which never built: with if_no_artifact_found:
ignore the download step always succeeds, so check found_artifact.
Download cached builds into dist/, and overwrite the build artifact
since several jobs in a run can build it.
- Upload action.yml and the bundle as action-bundle-<sha> from
setup-and-cache.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* chor: remove stale file
* fix: write logs under the home cache directory and await artifact upload
Instruments opened its log files at the relative path cache-apt-pkgs/
before that directory existed, so the action crashed at startup with
ENOENT. It also pointed artifact uploads there while Cache uses
~/cache-apt-pkgs. Resolve both with a shared resolveCacheDir helper and
create the directory before opening the logs.
The artifact upload was also never awaited, so a failed upload became an
unhandled rejection. Await it and report failures as a warning.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: ship ts-apt's apt-fast script with the bundle
On runners with aria2 installed, ts-apt uses apt-fast and spawns
scripts/dist/apt-fast.sh relative to its own module. Bundling moved that
module, so the action failed with "spawn .../scripts/dist/apt-fast.sh
ENOENT".
Write the bundle to dist/action/index.js and copy ts-apt's scripts/dist
to dist/scripts/dist, which is where ts-apt looks from there. Point
action.yml at the new entrypoint and include both in the action bundle
artifact. Workflow artifacts drop file modes, so the action marks the
script executable at startup.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* build: pin ts-apt to e627c3b for install timeout and dpkg-query fixes
ts-apt killed every apt command after 30 seconds, so installs failed
with exit code 124, and listInstalledFiles passed name=version to
dpkg-query -L, which rejects it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: make diagnostic artifact names unique per step
Every job in a run uploaded capa_artifacts-<run id>, so only the first
upload succeeded. Add the run attempt, job and step IDs.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* ci: run cache restore jobs after the jobs that create the cache
The restore and add-package jobs all only needed testing, so they ran in
parallel with standard_workflow_install and raced on the same cache key.
Restore the ordering v1 uses.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* ci: authenticate the action pin check to avoid API rate limits
The check called the GitHub API anonymously and hit the rate limit for
the shared runner IP. The script uses GITHUB_TOKEN when it's set.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* build: pin ts-apt to 342c7d0 for native arch and stdin input
Adds PackageManager.getNativeArchitecture and CommandOptions.input, used by the version-list outputs and archive creation.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: report requested and dependency package versions separately
package-version-list held every installed package and both outputs were
identical. Outputs also carried arch suffixes inconsistently and followed
install order.
- package-version-list lists only requested packages; all-package-version-list
lists every installed package.
- Entries are name=version, with :arch only for packages installed for a
non-native architecture (e.g. libc6:i386), so native output matches v1.
- Entries are sorted with PackageName.compareTo.
- Requested packages are matched by name, and by arch when both specify one.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* fix: archive and restore packages with system tar under sudo
The in-process tar library ran as the runner user, so archiving failed on
root-only files such as /etc/default/cacerts from ca-certificates-java
(regression #72), and extraction could skip root-owned paths without failing.
- Create and extract with sudo tar; the file list is piped NUL-separated on
stdin so large packages don't exceed the argument size limit.
- Keep directory symlinks such as /lib on extract.
- Hand archives back to the runner user for the cache save.
- Disable the command timeout for tar and maintainer scripts.
- Record the installed (versioned) entries in manifest_main.json; it held
unversioned names with no files.
- Return every installed package on a cache hit so outputs include deps.
- Split runInstallScripts into per-script runs.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* ci: update package expectations for Ubuntu 24.04
libasound2 is libasound2t64 on 24.04 (regression #81), and gir1.2-gdkpixbuf-2.0 moved to 2.42.10+dfsg-3ubuntu3.3.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* docs: add ts-apt boundary rules to AGENTS.md
APT and dpkg logic belongs in ts-apt; ts-apt changes are pushed before the action bumps its pin.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* ci: pin version-list jobs to ubuntu-24.04 and fix spaces-in-paths tests
- list_versions / list_all_versions: run on ubuntu-24.04. The expected
versions are from 24.04, but ubuntu-latest now resolves newer ones
(e.g. rolldice=1.16-1build4, xdot=1.6-1).
- regression_76: cache libopenal-data ("Default HRTF.mhr") instead of
Intel oneAPI. Drops the Intel repo and the unused opencl and
libsundials-dev installs (188 MB, 155 packages), which made the job
take 75+ minutes when the Ubuntu mirror was slow. Cap at 15 minutes.
- regression_81: list alsa-ucm-conf explicitly so the test caches a
package with spaces in its file paths.
Same fixes as #235 and #236 on master.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* build: install ts-apt from GitHub instead of a local path
package.json pointed ts-apt at file:../ts-apt, which only exists on a
dev machine, so every test suite in CI failed with "Cannot find package
'ts-apt'". ts-apt isn't on npm, so pin it to a commit on GitHub. Its
prepare script builds dist on install.
The dev:tsapt:link script used --save, which is how the local path got
committed. Use --no-save so linking a local ts-apt doesn't change
package.json, and restore with npm ci on unlink.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* test: clear GITHUB_RUN_ID when testing the run ID fallback
GitHub Actions always sets GITHUB_RUN_ID, so the fallback test failed
once CI could run the tests at all.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
