[tech-debt] sigv4/S3 client duplicated across artifact+cache actions and has drifted #11

New issue

Open

opened 2026-06-23 20:14:55 +00:00 by stephen · 0 comments

stephen commented

2026-06-23 20:14:55 +00:00

Owner

Autonomous audit finding (MED).

backend.js/sigv4.js/core.js are byte-identical across upload/download/cache actions, but backends/s3.js has drifted into 3 different versions (different remove()/listTree()), and glob.js/artifact-tar.js have drifted too. The signed-HTTP S3 client is maintained by copy-paste. Extract a shared package, or add a vendored known-answer sigv4 test in each repo to catch drift. (sigv4/s3 are only tested in cache-action today.)

Autonomous audit finding (MED). `backend.js`/`sigv4.js`/`core.js` are byte-identical across upload/download/cache actions, but `backends/s3.js` has drifted into 3 different versions (different `remove()`/`listTree()`), and `glob.js`/`artifact-tar.js` have drifted too. The signed-HTTP S3 client is maintained by copy-paste. Extract a shared package, or add a vendored known-answer sigv4 test in each repo to catch drift. (sigv4/s3 are only tested in cache-action today.)

stephen referenced this issue

2026-07-02 04:05:49 +00:00

Vendored SigV4 known-answer drift guard (#11) #14

stephen referenced this issue from a commit

2026-07-02 04:24:31 +00:00

Vendored SigV4 known-answer drift guard (#11) (#14)