fix: update snapshot for error test

chore: bump dependencies

.changeset/weak-lobsters-march.md

@@ -0,0 +1,9 @@
+---
+"wrangler-action": patch
+---
+
+Fixes issues with semver comparison, where version parts were treated lexicographically instead of numerically.
+
+Bulk secret uploading was introduced in wrangler `3.4.0`, and this action tries to check if the version used is greater than `3.4.0`, and then if so, using the new bulk secret API which is faster. Due to a bug in the semver comparison, `3.19.0` was being considered less than `3.4.0`, and then using an older and slower method for uploading secrets.
+
+Now the semver comparison is fixed, the faster bulk method is used for uploading secrets when available.

.github/workflows/pullrequests.yml

@@ -7,7 +7,4 @@ jobs:
     name: Add PR to workers-sdk GH project
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/add-to-project@v0.5.0
-        with:
-          project-url: https://github.com/orgs/cloudflare/projects/1
-          github-token: ${{ secrets.GH_ACCESS_TOKEN }}
+      - run: curl -X POST https://devprod-status-bot.devprod.workers.dev/pr-project/wrangler-action/${{ github.event.number }}

.github/workflows/release.yml

@@ -20,6 +20,9 @@ jobs:
     steps:
       - name: Checkout Repo
         uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+          fetch-tags: true
 
       - name: Setup Node.js
         uses: actions/setup-node@v3

CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 3.3.2
+
+### Patch Changes
+
+- [#171](https://github.com/cloudflare/wrangler-action/pull/171) [`76d614f`](https://github.com/cloudflare/wrangler-action/commit/76d614f400bd92237ed23c3df559f2c31b14a790) Thanks [@1000hz](https://github.com/1000hz)! - Fixed issues that caused the action to fail if any secret or var values contained shell metacharacters.
+
+- [#171](https://github.com/cloudflare/wrangler-action/pull/171) [`473d9cb`](https://github.com/cloudflare/wrangler-action/commit/473d9cbd296528b41c653af10062faba6540a7ab) Thanks [@1000hz](https://github.com/1000hz)! - Bumped `DEFAULT_WRANGLER_VERSION` to 3.13.2
+
+## 3.3.1
+
+### Patch Changes
+
+- [#193](https://github.com/cloudflare/wrangler-action/pull/193) [`a4509d5`](https://github.com/cloudflare/wrangler-action/commit/a4509d507c62dd7f49fba7df7d2db3997222393a) Thanks [@1000hz](https://github.com/1000hz)! - Fixed the package manager not being inferred based on lockfile when the `packageManager` input isn't set.
+
 ## 3.3.0
 
 ### Minor Changes

README.md

@@ -31,14 +31,14 @@ jobs:
       - name: Deploy
         uses: cloudflare/wrangler-action@v3
         with:
-          apiToken: ${{ secrets.CF_API_TOKEN }}
+          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
 ```
 
 ## Authentication
 
 You'll need to configure Wrangler using GitHub's Secrets feature - go to "Settings -> Secrets" and add your Cloudflare API token (for help finding this, see the [Workers documentation](https://developers.cloudflare.com/workers/quickstart/#api-token)). Your API token is encrypted by GitHub, and the action won't print it into logs, so it should be safe!
 
-With your API token set as a secret for your repository, pass it to the action in the `with` block of your workflow. Below, I've set the secret name to `CF_API_TOKEN`:
+With your API token set as a secret for your repository, pass it to the action in the `with` block of your workflow. Below, I've set the secret name to `CLOUDFLARE_API_TOKEN`:
 
 ```yaml
 jobs:
@@ -47,7 +47,7 @@ jobs:
     steps:
       uses: cloudflare/wrangler-action@v3
       with:
-        apiToken: ${{ secrets.CF_API_TOKEN }}
+        apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
 ```
 
 ## Configuration
@@ -60,7 +60,7 @@ jobs:
     steps:
       uses: cloudflare/wrangler-action@v3
       with:
-        apiToken: ${{ secrets.CF_API_TOKEN }}
+        apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
         wranglerVersion: "2.20.0"
 ```
 
@@ -72,7 +72,7 @@ jobs:
     steps:
       uses: cloudflare/wrangler-action@v3
       with:
-        apiToken: ${{ secrets.CF_API_TOKEN }}
+        apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
         workingDirectory: "subfoldername"
 ```
 
@@ -84,7 +84,7 @@ jobs:
     steps:
       uses: cloudflare/wrangler-action@v3
       with:
-        apiToken: ${{ secrets.CF_API_TOKEN }}
+        apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
         secrets: |
           SECRET1
           SECRET2
@@ -101,7 +101,7 @@ jobs:
     steps:
       uses: cloudflare/wrangler-action@v3
       with:
-        apiToken: ${{ secrets.CF_API_TOKEN }}
+        apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
         preCommands: echo "*** pre command ***"
         postCommands: |
           echo "*** post commands ***"
@@ -117,7 +117,7 @@ jobs:
     steps:
       uses: cloudflare/wrangler-action@v3
       with:
-        apiToken: ${{ secrets.CF_API_TOKEN }}
+        apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
         command: whoami
 ```
 
@@ -142,7 +142,7 @@ jobs:
       - name: Deploy
         uses: cloudflare/wrangler-action@v3
         with:
-          apiToken: ${{ secrets.CF_API_TOKEN }}
+          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
 ```
 
 Note that there are a number of possible events, like `push`, that can be used to trigger a workflow. For more details on the events available, refer to the [GitHub Actions documentation](https://help.github.com/en/articles/workflow-syntax-for-github-actions#on).
@@ -163,8 +163,8 @@ jobs:
       - name: Deploy
         uses: cloudflare/wrangler-action@v3
         with:
-          apiToken: ${{ secrets.CF_API_TOKEN }}
-          accountId: ${{ secrets.CF_ACCOUNT_ID }}
+          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
           command: pages deploy --project-name=example
 ```
 
@@ -186,7 +186,7 @@ jobs:
       - name: Deploy app
         uses: cloudflare/wrangler-action@v3
         with:
-          apiToken: ${{ secrets.CF_API_TOKEN }}
+          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
 ```
 
 If you need help defining the correct cron syntax, check out [crontab.guru](https://crontab.guru/), which provides a friendly user interface for validating your cron schedule.
@@ -212,7 +212,7 @@ jobs:
       - name: Deploy app
         uses: cloudflare/wrangler-action@v3
         with:
-          apiToken: ${{ secrets.CF_API_TOKEN }}
+          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           command: deploy --env ${{ github.event.inputs.environment }}
 ```
 
@@ -240,6 +240,6 @@ jobs:
       - name: Deploy app
         uses: cloudflare/wrangler-action@v3
         with:
-          apiToken: ${{ secrets.CF_API_TOKEN }}
-          accountId: ${{ secrets.CF_ACCOUNT_ID }}
+          apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
+          accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
 ```

action.yml

@@ -42,6 +42,5 @@ inputs:
     description: "A string of environment variable names, separated by newlines. These will be bound to your Worker using the values of matching environment variables declared in `env` of this workflow."
     required: false
   packageManager:
-    description: "The package manager you'd like to use to install and run wrangler. If not specified, a value will be inferred based on the presence of a lockfile. Valid values: [npm, pnpm, yarn, bun]"
+    description: "The package manager you'd like to use to install and run wrangler. If not specified, the preferred package manager will be inferred based on the presence of a lockfile or fallback to using npm if no lockfile is found. Valid values are `npm` | `pnpm` | `yarn` | `bun`."
     required: false
-    default: npm

package.json

@@ -1,6 +1,6 @@
 {
 	"name": "wrangler-action",
-	"version": "3.3.0",
+	"version": "3.3.2",
 	"description": "GitHub Action to use [Wrangler](https://developers.cloudflare.com/workers/cli-wrangler/).",
 	"author": "wrangler@cloudflare.com",
 	"license": "MIT OR Apache-2.0",
@@ -29,16 +29,18 @@
 		"check": "prettier --check ."
 	},
 	"dependencies": {
-		"@actions/core": "^1.10.0"
+		"@actions/core": "^1.10.1",
+		"@actions/exec": "^1.1.1"
 	},
 	"devDependencies": {
 		"@changesets/changelog-github": "^0.4.8",
 		"@changesets/cli": "^2.26.2",
-		"@cloudflare/workers-types": "^4.20230814.0",
-		"@types/node": "^20.5.0",
-		"@vercel/ncc": "^0.36.1",
-		"prettier": "^3.0.1",
-		"typescript": "^5.1.6",
-		"vitest": "^0.34.1"
+		"@cloudflare/workers-types": "^4.20231121.0",
+		"@types/node": "^20.10.4",
+		"@vercel/ncc": "^0.38.1",
+		"prettier": "^3.1.0",
+		"semver": "^7.5.4",
+		"typescript": "^5.3.3",
+		"vitest": "^1.0.3"
 	}
 }

src/exec.ts

@@ -0,0 +1,54 @@
+import {
+	exec as _childProcessExec,
+	type ExecException,
+} from "node:child_process";
+import { EOL } from "node:os";
+import { promisify } from "node:util";
+
+export { exec } from "@actions/exec";
+
+const childProcessExec = promisify(_childProcessExec);
+
+type ExecAsyncException = ExecException & {
+	stderr: string;
+	stdout: string;
+};
+
+function isExecAsyncException(err: unknown): err is ExecAsyncException {
+	return err instanceof Error && "code" in err && "stderr" in err;
+}
+
+export async function execShell(
+	command: string,
+	{
+		silent = false,
+		...options
+	}: Parameters<typeof childProcessExec>[1] & { silent?: boolean } = {},
+) {
+	if (!silent) {
+		process.stdout.write("[command]" + command + EOL);
+	}
+
+	try {
+		const promise = childProcessExec(command, {
+			...options,
+		});
+
+		const { child } = promise;
+
+		if (!silent) {
+			child.stdout?.on("data", (data: Buffer) => process.stdout.write(data));
+			child.stderr?.on("data", (data: Buffer) => process.stderr.write(data));
+		}
+
+		await promise;
+		return child.exitCode;
+	} catch (err: any) {
+		if (isExecAsyncException(err)) {
+			process.stderr.write(err.stderr);
+			throw new Error(`Process failed with exit code ${err.code}`);
+		}
+
+		throw err;
+	}
+}

src/index.ts

@@ -8,13 +8,11 @@ import {
 	startGroup as originalStartGroup,
 	setFailed,
 } from "@actions/core";
-import { exec, execSync } from "node:child_process";
-import * as util from "node:util";
+import { exec, execShell } from "./exec";
 import { checkWorkingDirectory, semverCompare } from "./utils";
 import { getPackageManager } from "./packageManagers";
-const execAsync = util.promisify(exec);
 
-const DEFAULT_WRANGLER_VERSION = "3.5.1";
+const DEFAULT_WRANGLER_VERSION = "3.13.2";
 
 /**
  * A configuration object that contains all the inputs & immutable state for the action.
@@ -62,8 +60,8 @@ function endGroup(): void {
 
 async function main() {
 	try {
-		installWrangler();
 		authenticationSetup();
+		await installWrangler();
 		await execCommands(getMultilineInput("preCommands"), "pre");
 		await uploadSecrets();
 		await wranglerCommands();
@@ -75,36 +73,28 @@ async function main() {
 	}
 }
 
-async function runProcess(
-	command: Parameters<typeof execAsync>[0],
-	options: Parameters<typeof execAsync>[1],
-) {
-	try {
-		const result = await execAsync(command, options);
-
-		result.stdout && info(result.stdout.toString());
-		result.stderr && error(result.stderr.toString(), true);
-
-		return result;
-	} catch (err: any) {
-		err.stdout && info(err.stdout.toString());
-		err.stderr && error(err.stderr.toString(), true);
-		throw new Error(`\`${command}\` returned non-zero exit code.`);
-	}
-}
-
-function installWrangler() {
+async function installWrangler() {
 	if (config["WRANGLER_VERSION"].startsWith("1")) {
 		throw new Error(
 			`Wrangler v1 is no longer supported by this action. Please use major version 2 or greater`,
 		);
 	}
+
 	startGroup("📥 Installing Wrangler");
-	const command = `${packageManager.install} wrangler@${config["WRANGLER_VERSION"]}`;
-	info(`Running command: ${command}`);
-	execSync(command, { cwd: config["workingDirectory"], env: process.env });
-	info(`✅ Wrangler installed`, true);
-	endGroup();
+	try {
+		await exec(
+			packageManager.install,
+			[`wrangler@${config["WRANGLER_VERSION"]}`],
+			{
+				cwd: config["workingDirectory"],
+				silent: config["QUIET_MODE"],
+			},
+		);
+
+		info(`✅ Wrangler installed`, true);
+	} finally {
+		endGroup();
+	}
 }
 
 function authenticationSetup() {
@@ -119,28 +109,21 @@ async function execCommands(commands: string[], cmdType: string) {
 
 	startGroup(`🚀 Running ${cmdType}Commands`);
 	try {
-		const arrPromises = commands.map(async (command) => {
+		for (const command of commands) {
 			const cmd = command.startsWith("wrangler")
 				? `${packageManager.exec} ${command}`
 				: command;
 
-			info(`🚀 Executing command: ${cmd}`);
-
-			return await runProcess(cmd, {
+			await execShell(cmd, {
 				cwd: config["workingDirectory"],
-				env: process.env,
+				silent: config["QUIET_MODE"],
 			});
-		});
-
-		await Promise.all(arrPromises);
+		}
 	} finally {
 		endGroup();
 	}
 }
 
-/**
- * A helper function to get the secret from the environment variables.
- */
 function getSecret(secret: string) {
 	if (!secret) {
 		throw new Error("Secret name cannot be blank.");
@@ -148,33 +131,43 @@ function getSecret(secret: string) {
 
 	const value = process.env[secret];
 	if (!value) {
-		throw new Error(`Value for secret ${secret} not found.`);
+		throw new Error(`Value for secret ${secret} not found in environment.`);
 	}
 
 	return value;
 }
 
-async function legacyUploadSecrets(
+function getEnvVar(envVar: string) {
+	if (!envVar) {
+		throw new Error("Var name cannot be blank.");
+	}
+
+	const value = process.env[envVar];
+	if (!value) {
+		throw new Error(`Value for var ${envVar} not found in environment.`);
+	}
+
+	return value;
+}
+
+function legacyUploadSecrets(
 	secrets: string[],
 	environment?: string,
 	workingDirectory?: string,
 ) {
-	const arrPromises = secrets
-		.map((secret) => {
-			const command = `echo ${getSecret(secret)} | ${
-				packageManager.exec
-			} wrangler secret put ${secret}`;
-			return environment ? command.concat(` --env ${environment}`) : command;
-		})
-		.map(
-			async (command) =>
-				await execAsync(command, {
-					cwd: workingDirectory,
-					env: process.env,
-				}),
-		);
-
-	await Promise.all(arrPromises);
+	return Promise.all(
+		secrets.map((secret) => {
+			const args = ["wrangler", "secret", "put", secret];
+			if (environment) {
+				args.push("--env", environment);
+			}
+			return exec(packageManager.exec, args, {
+				cwd: workingDirectory,
+				silent: config["QUIET_MODE"],
+				input: Buffer.from(getSecret(secret)),
+			});
+		}),
+	);
 }
 
 async function uploadSecrets() {
@@ -189,51 +182,34 @@ async function uploadSecrets() {
 	startGroup("🔑 Uploading secrets...");
 
 	try {
-		if (semverCompare(config["WRANGLER_VERSION"], "3.4.0"))
+		if (semverCompare(config["WRANGLER_VERSION"], "3.4.0")) {
 			return legacyUploadSecrets(secrets, environment, workingDirectory);
+		}
 
-		const secretObj = secrets.reduce((acc: any, secret: string) => {
-			acc[secret] = getSecret(secret);
-			return acc;
-		}, {});
+		const args = ["wrangler", "secret:bulk"];
 
-		const environmentSuffix = !environment.length
-			? ""
-			: ` --env ${environment}`;
+		if (environment) {
+			args.push("--env", environment);
+		}
 
-		const secretCmd = `echo "${JSON.stringify(secretObj).replaceAll(
-			'"',
-			'\\"',
-		)}" | ${packageManager.exec} wrangler secret:bulk ${environmentSuffix}`;
-
-		execSync(secretCmd, {
+		await exec(packageManager.exec, args, {
 			cwd: workingDirectory,
-			env: process.env,
-			stdio: "ignore",
+			silent: config["QUIET_MODE"],
+			input: Buffer.from(
+				JSON.stringify(
+					Object.fromEntries(
+						secrets.map((secret) => [secret, getSecret(secret)]),
+					),
+				),
+			),
 		});
-
-		info(`✅ Uploaded secrets`);
 	} catch (err) {
-		error(`❌ Upload failed`);
 		throw new Error(`Failed to upload secrets.`);
 	} finally {
 		endGroup();
 	}
 }
 
-function getVarArgs() {
-	const vars = config["VARS"];
-	const envVarArray = vars.map((envVar: string) => {
-		if (process.env[envVar] && process.env[envVar]?.length !== 0) {
-			return `${envVar}:${process.env[envVar]!}`;
-		} else {
-			throw new Error(`Value for var ${envVar} not found in environment.`);
-		}
-	});
-
-	return envVarArray.length > 0 ? `--var ${envVarArray.join(" ").trim()}` : "";
-}
-
 async function wranglerCommands() {
 	startGroup("🚀 Running Wrangler Commands");
 	try {
@@ -248,27 +224,29 @@ async function wranglerCommands() {
 			commands.push(deployCommand);
 		}
 
-		const arrPromises = commands.map(async (command) => {
-			if (environment.length > 0 && !command.includes(`--env`)) {
-				command = command.concat(` --env ${environment}`);
+		for (let command of commands) {
+			const args = [];
+
+			if (environment && !command.includes("--env")) {
+				args.push("--env", environment);
 			}
 
-			const cmd = `${packageManager.exec} wrangler ${command} ${
+			if (
+				config["VARS"].length &&
 				(command.startsWith("deploy") || command.startsWith("publish")) &&
-				!command.includes(`--var`)
-					? getVarArgs()
-					: ""
-			}`.trim();
+				!command.includes("--var")
+			) {
+				args.push("--var");
+				for (const v of config["VARS"]) {
+					args.push(`${v}:${getEnvVar(v)}`);
+				}
+			}
 
-			info(`🚀 Executing command: ${cmd}`);
-
-			return await runProcess(cmd, {
+			await exec(`${packageManager.exec} wrangler ${command}`, args, {
 				cwd: config["workingDirectory"],
-				env: process.env,
+				silent: config["QUIET_MODE"],
 			});
-		});
-
-		await Promise.all(arrPromises);
+		}
 	} finally {
 		endGroup();
 	}

src/packageManagers.test.ts

@@ -27,7 +27,7 @@ describe("getPackageManager", () => {
 				}
 			`);
 
-		expect(getPackageManager('bun', { workingDirectory: "test/bun" }))
+		expect(getPackageManager("bun", { workingDirectory: "test/bun" }))
 			.toMatchInlineSnapshot(`
 				{
 				  "exec": "bunx",

src/packageManagers.ts

@@ -21,7 +21,7 @@ const PACKAGE_MANAGERS = {
 	},
 	bun: {
 		install: "bun i",
-		exec: "bunx"
+		exec: "bunx",
 	},
 } as const satisfies Readonly<Record<string, PackageManager>>;
 

src/utils.test.ts

@@ -26,7 +26,30 @@ describe("checkWorkingDirectory", () => {
 		expect(() =>
 			checkWorkingDirectory("/does/not/exist"),
 		).toThrowErrorMatchingInlineSnapshot(
-			'"Directory /does/not/exist does not exist."',
+			`[Error: Directory /does/not/exist does not exist.]`,
 		);
 	});
 });
+
+describe("semverCompare", () => {
+	test.each([
+		["1.2.3", "1.2.3", false],
+		["1.2.2", "1.2.3", true],
+		["2.0.0", "3.0.0", true],
+		["3.1.0", "3.1.1", true],
+		["3.1.0", "3.5.0", true],
+		["3.1.0", "3.10.0", true],
+		["3.1.0", "3.15.0", true],
+		["3.10.0", "3.1.0", false],
+		["3.20.0", "3.2.0", false],
+		["3.1.0", "latest", true],
+		["4.0.0", "latest", true],
+	])(
+		"should semver compare %s vs %s correctly, expecting %s",
+		(version1, version2, expected) => {
+			const isVersion1LessThanVersion2 = semverCompare(version1, version2);
+
+			expect(isVersion1LessThanVersion2).toBe(expected);
+		},
+	);
+});

src/utils.ts

@@ -1,5 +1,6 @@
 import { existsSync } from "node:fs";
 import * as path from "node:path";
+import semverGt from "semver/functions/gt";
 
 /**
  * A helper function to compare two semver versions. If the second arg is greater than the first arg, it returns true.
@@ -7,18 +8,7 @@ import * as path from "node:path";
 export function semverCompare(version1: string, version2: string) {
 	if (version2 === "latest") return true;
 
-	const version1Parts = version1.split(".");
-	const version2Parts = version2.split(".");
-
-	for (const version1Part of version1Parts) {
-		const version2Part = version2Parts.shift();
-
-		if (version1Part !== version2Part && version2Part) {
-			return version1Part < version2Part ? true : false;
-		}
-	}
-
-	return false;
+	return semverGt(version2, version1);
 }
 
 export function checkWorkingDirectory(workingDirectory = ".") {

test/base/package.json

@@ -1,3 +1,5 @@
 {
-	"name": "wrangler-action-test"
+	"name": "wrangler-action-test",
+	"license": "MIT",
+	"private": true
 }

test/bun/package.json

@@ -1,3 +1,5 @@
 {
-  "name": "wrangler-action-bun-test",
+	"name": "wrangler-action-bun-test",
+	"license": "MIT",
+	"private": true
 }

test/empty/package.json

@@ -1,3 +1,5 @@
 {
-	"name": "wrangler-action-detect-package-manager-test"
+	"name": "wrangler-action-detect-package-manager-test",
+	"license": "MIT",
+	"private": true
 }

test/environment/package.json

@@ -1,3 +1,5 @@
 {
-	"name": "wrangler-action-environment-test"
+	"name": "wrangler-action-environment-test",
+	"license": "MIT",
+	"private": true
 }

test/pnpm/package.json

@@ -1,3 +1,5 @@
 {
-	"name": "wrangler-action-pnpm-test"
+	"name": "wrangler-action-pnpm-test",
+	"license": "MIT",
+	"private": true
 }

test/yarn/package.json

@@ -1,3 +1,5 @@
 {
-	"name": "wrangler-action-yarn-test"
+	"name": "wrangler-action-yarn-test",
+	"license": "MIT",
+	"private": true
 }