Files
e4124f7635 Pin GitHub Actions to full-length commit SHAs (#329034)
* Pin GitHub Actions to full-length commit SHAs

* chore: attest to third-party action pinning changes

I have reviewed the action-pinning diff authored by OssSecurityBot and
verified that each pinned SHA resolves to the same commit the tag it
replaces pointed at, and that no workflow logic was altered beyond the
`uses:` references.

This commit is signed with my key from security/trusted-signing-keys.csv
so the attestation is bound to my identity and to this exact tree. Any
subsequent push replaces the head and invalidates it.

Refs #328868

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: OssSecurityBot <oss-security-bot@microsoft.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
2026-08-06 11:22:51 +02:00

62 lines
2.5 KiB
YAML

name: Restore node_modules cache
description: Computes the node_modules cache key, restores the cache, and extracts it on a hit.
inputs:
key-prefix:
description: Prefix for the cache key. The package-lock hash is appended automatically.
required: true
key-args:
description: Arguments passed to build/azure-pipelines/common/computeNodeModulesCacheKey.ts.
required: true
lookup-only:
description: When 'true', only checks whether the cache entry exists (sets cache-hit) without downloading or extracting the archive. Use for cache-warming jobs that only need the cache-hit result.
default: 'false'
outputs:
cache-hit:
description: "'true' when the node_modules cache was restored from an exact key match."
value: ${{ steps.restore.outputs.cache-hit }}
runs:
using: composite
steps:
- name: Prepare node_modules cache key
if: runner.os != 'Windows'
shell: bash
run: mkdir -p .build && node build/azure-pipelines/common/computeNodeModulesCacheKey.ts ${{ inputs.key-args }} > .build/packagelockhash
- name: Prepare node_modules cache key
if: runner.os == 'Windows'
shell: pwsh
run: |
mkdir .build -ea 0
node build/azure-pipelines/common/computeNodeModulesCacheKey.ts ${{ inputs.key-args }} > .build/packagelockhash
- name: Restore node_modules cache
id: restore
uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
with:
path: .build/node_modules_cache
key: "${{ inputs.key-prefix }}-${{ hashFiles('.build/packagelockhash') }}"
lookup-only: ${{ inputs.lookup-only }}
- name: Export node_modules cache key
if: runner.os != 'Windows'
shell: bash
run: echo "NODE_MODULES_CACHE_KEY=${{ steps.restore.outputs.cache-primary-key }}" >> "$GITHUB_ENV"
- name: Export node_modules cache key
if: runner.os == 'Windows'
shell: pwsh
run: Add-Content -Path $env:GITHUB_ENV -Value "NODE_MODULES_CACHE_KEY=${{ steps.restore.outputs.cache-primary-key }}"
- name: Extract node_modules cache
if: runner.os != 'Windows' && inputs.lookup-only != 'true' && steps.restore.outputs.cache-hit == 'true'
shell: bash
run: ./.github/workflows/node_modules_cache/cache.sh extract
- name: Extract node_modules cache
if: runner.os == 'Windows' && inputs.lookup-only != 'true' && steps.restore.outputs.cache-hit == 'true'
shell: pwsh
run: ./.github/workflows/node_modules_cache/cache.ps1 extract