mirror/checkout
1
0
Fork 0
mirror of https://github.com/actions/checkout.git synced 2026-07-18 03:50:07 +08:00
Code Issues Projects Releases Packages Wiki Activity

use mkdtempSync

Browse source
This commit is contained in:
darshanime 2026-07-14 18:25:02 +05:30
parent d6005557e6
commit 28b21c7d05
2 changed files with 14 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

10
dist/index.js vendored
View file

@ -42335,10 +42335,14 @@ async function httpPut(url, file) {
throw new Error(`PUT answered ${res.status}`);
}
}
// Bundles live in a private mkdtemp'd dir (0700) — a co-tenant can't pre-empt a write via a
// planted symlink, and mkdtempSync is the primitive CodeQL accepts (js/insecure-temporary-file).
let mirrorTmpDir;
function tempBundlePath(tag) {
// Unpredictable name so a bundle write can't be pre-empted by a symlink planted on a
// shared tmpdir.
return external_path_namespaceObject.join(external_os_namespaceObject.tmpdir(), `wb-${tag}-${external_crypto_namespaceObject.randomBytes(12).toString('hex')}.bundle`);
if (!mirrorTmpDir) {
mirrorTmpDir = external_fs_namespaceObject.mkdtempSync(external_path_namespaceObject.join(external_os_namespaceObject.tmpdir(), 'wb-mirror-'));
}
return external_path_namespaceObject.join(mirrorTmpDir, `wb-${tag}-${external_crypto_namespaceObject.randomBytes(12).toString('hex')}.bundle`);
}
// Kept for callers/tests: reset .git/objects to the empty `git init` shape.
async function resetGitObjects(gitDir) {

10
src/warpbuild/mirror-cache.ts
View file

@ -591,11 +591,15 @@ async function httpPut(url: string, file: string): Promise<void> {
}
}
// Bundles live in a private mkdtemp'd dir (0700) — a co-tenant can't pre-empt a write via a
// planted symlink, and mkdtempSync is the primitive CodeQL accepts (js/insecure-temporary-file).
let mirrorTmpDir: string | undefined
function tempBundlePath(tag: string): string {
// Unpredictable name so a bundle write can't be pre-empted by a symlink planted on a
// shared tmpdir.
if (!mirrorTmpDir) {
mirrorTmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'wb-mirror-'))
}
return path.join(
os.tmpdir(),
mirrorTmpDir,
`wb-${tag}-${crypto.randomBytes(12).toString('hex')}.bundle`
)
}