feat: fix nondeterministic hash with globbing, update to node20 and update pipelines

.github/workflows/check-dist.yml

@@ -21,12 +21,12 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
-      - name: Set Node.js 16.x
-        uses: actions/setup-node@v3.6.0
+      - name: Set Node.js 20.x
+        uses: actions/setup-node@v4
         with:
-          node-version: 16.x
+          node-version: 20.x
 
       - name: Install dependencies
         run: npm ci
@@ -46,7 +46,7 @@ jobs:
         id: diff
 
       # If index.js was different than expected, upload the expected version as an artifact
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         if: ${{ failure() && steps.diff.conclusion == 'failure' }}
         with:
           name: dist

.github/workflows/codeql-analysis.yml

@@ -38,11 +38,11 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@v3
       with:
         languages: ${{ matrix.language }}
         source-root: src
@@ -54,7 +54,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v2
+      uses: github/codeql-action/autobuild@v3
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -68,4 +68,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@v3

.github/workflows/test.yml

@@ -10,7 +10,7 @@ jobs:
   build: # make sure build/ci work properly
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - run: |
           npm install
       - run: |
@@ -19,7 +19,7 @@ jobs:
   test: # make sure the action works on a clean machine without building
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - uses: ./
         id: get-hash

.vscode/settings.json

@@ -1,12 +1,15 @@
 {
-  // 保存时执行eslint
+  // Run eslint on save
   "editor.codeActionsOnSave": {
     "source.fixAll.eslint": true
   },
-  // 从不展示扩展缩写
+  // Never show expanded abbreviation
   "emmet.showExpandedAbbreviation": "never",
-  // 关闭代码区域小地图
+  // Disable code minimap
   "editor.minimap.enabled": false,
-  // 代码过长换行
-  "editor.wordWrap": "on"
+  // Wrap long lines
+  "editor.wordWrap": "on",
+  "yaml.schemas": {
+    "https://www.artillery.io/schema.json": []
+  }
 }

__tests__/main.test.ts

@@ -4,25 +4,26 @@ import * as process from 'process'
 import * as cp from 'child_process'
 import * as path from 'path'
 import {test} from '@jest/globals'
+import {expect} from '@jest/globals'
 
 test('test sha256', async () => {
-  console.log(hashHex('this is content'))
+  console.info(hashHex('this is content'))
 })
 
 test('test sha512', async () => {
-  console.log(hashHex('this is content', 'sha512'))
+  console.info(hashHex('this is content', 'sha512'))
 })
 
 test('test readFile', async () => {
   const content = await readFile('./.prettierignore')
-  console.log(content)
+  console.info(content)
 })
 
 test('test getFiles', async () => {
   const paths = await getFiles('./', ['**/*.ts', '**/package-lock.json'], {
     gitignore: true
   })
-  console.log(paths)
+  console.info(paths)
 })
 
 test('test runs', () => {
@@ -34,5 +35,27 @@ test('test runs', () => {
   const options: cp.ExecFileSyncOptions = {
     env: process.env
   }
-  console.log(cp.execFileSync(np, [ip], options).toString())
+  console.info(cp.execFileSync(np, [ip], options).toString())
+})
+
+test('test runs - hash is consistent', () => {
+  process.env['INPUT_WORKDIR'] = './'
+  process.env['INPUT_PATTERNS'] = '**/*.ts\n**/package-lock.json'
+  process.env['INPUT_GITIGNORE'] = 'true'
+  const np = process.execPath
+  const ip = path.join(__dirname, '..', 'lib', 'main.js')
+  const options: cp.ExecFileSyncOptions = {
+    env: process.env
+  }
+  const results: string[] = []
+  for (let i = 0; i < 5; i++) {
+    results.push(cp.execFileSync(np, [ip], options).toString())
+  }
+  // Extract hash from output and check all are the same
+  const hashes = results.map(output => {
+    const match = output.match(/Hash: ([a-fA-F0-9]+)/)
+    return match ? match[1] : null
+  })
+  expect(new Set(hashes).size).toBe(1)
+  console.info('All hashes:', hashes)
 })

action.yml

@@ -15,10 +15,10 @@ inputs:
   gitignore:
     description: >
       Respect ignore patterns in .gitignore files that apply to the globbed files.
-    default: true
+    default: 'true'
     required: false
   ignoreFiles:
-    descruption: >
+    description: >
       Glob patterns to look for ignore files, which are then used to ignore globbed files.
       This is a more generic form of the gitignore option, allowing you to find ignore files with a compatible syntax.
       For instance, this works with Babel's .babelignore, Prettier's .prettierignore, or ESLint's .eslintignore files.
@@ -29,5 +29,5 @@ outputs:
   matched-files:
     description: 'The files matched by the patterns'
 runs:
-  using: 'node16'
+  using: 'node20'
   main: 'dist/index.js'