[pull] main from actions:main

[pull]

See Commits and Changes for more details.

---

Created by pull[bot]

Can you help keep this open source service alive? 💖 Please sponsor : )

[sourcery-ai]

Reviewer's Guide by Sourcery

This pull request includes several significant changes across multiple packages in the actions/toolkit repository. The changes primarily focus on updating dependencies, improving error handling, enhancing security, and refactoring code for better performance and maintainability. Key updates include modifications to the artifact upload process, changes to OIDC token handling, improvements to the HTTP client, and updates to the glob and attest packages.

Class diagram for OIDC Token Handling

classDiagram
    class OIDCConfig {
        string issuer
        string jwks_uri
    }

    class ClaimSet {
        string iss
        string ref
        string sha
        string repository
        string event_name
        string job_workflow_ref
        string workflow_ref
        string repository_id
        string repository_owner_id
    }

    class OIDC {
        +getIDTokenClaims(issuer: string): Promise<ClaimSet>
        +decodeOIDCToken(token: string, issuer: string): Promise<JWTPayload>
        +getJWKS(issuer: string): Promise<JSONWebKeySet>
        +getIssuer(): string
    }

    OIDC --> OIDCConfig
    OIDC --> ClaimSet

Loading

Class diagram for HTTP Client Proxy Handling

classDiagram
    class DecodedURL {
        string username
        string password
        string href
    }

    class HttpClient {
        +getProxyUrl(reqUrl: URL): URL | undefined
        +getAgent(url: string): any
    }

    HttpClient --> DecodedURL

Loading

File-Level Changes

Change	Details	Files
Refactored artifact upload process	Updated chunk timeout logic Implemented lazy stream to prevent issues with open file limits Fixed a regression with symlinks not being automatically resolved Improved error handling for upload progress stalling	packages/artifact/__tests__/upload-artifact.test.ts packages/artifact/src/internal/upload/blob-upload.ts packages/artifact/src/internal/upload/upload-zip-specification.ts packages/artifact/src/internal/upload/zip.ts
Enhanced OIDC token handling and attestation process	Updated OIDC token claim validation Improved handling of enterprise-specific OIDC issuers Added support for custom HTTP headers in attestation requests Updated SLSA provenance predicate generation	packages/attest/src/oidc.ts packages/attest/src/provenance.ts packages/attest/src/attest.ts packages/attest/src/store.ts
Improved HTTP client functionality	Fixed handling of proxy usernames and passwords Updated URL decoding for proxy authentication Improved error handling for network requests	packages/http-client/src/index.ts packages/http-client/src/proxy.ts
Updated glob package with new features	Added option to exclude hidden files in glob searches Improved handling of symlinks in glob results	packages/glob/src/internal-glob-options.ts packages/glob/src/internal-globber.ts
General dependency updates and security improvements	Updated various dependencies across packages Replaced uuid package with native crypto.randomUUID() Improved error messages and debugging information	packages/artifact/RELEASES.md packages/attest/RELEASES.md packages/core/RELEASES.md packages/glob/RELEASES.md packages/http-client/RELEASES.md

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time. You can also use
  this command to specify where the summary should be inserted.

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

We have skipped reviewing this pull request. It seems to have been created by a bot (hey, pull[bot]!). We assume it knows what it's doing!