rasterstate/upload-artifact-action
2
0
Fork 0
Code Issues 1 Pull requests Activity Actions

Vendored SigV4 known-answer drift guard (#11) #9

Merged
stephen merged 1 commit from feat/11-sigv4-drift-guard into main 2026-07-02 04:24:49 +00:00
Conversation 0 Commits 1 Files changed 1 +52 -8
stephen commented 2026-07-02 04:05:49 +00:00
Owner
Copy link

Why

sigv4/S3 signed-HTTP client is copy-pasted across the artifact + cache actions and has drifted (download-artifact-action#11). This adds a vendored known-answer SigV4 test so any future drift in the signer fails CI.

What

  • tests/sigv4.test.js: pins canonical request, string-to-sign hash, signed headers, signature hex, and Authorization header for a fixed key/region/timestamp/payload.
  • Same vector vendored into all three action repos (download/upload/cache) so drift is caught everywhere.

Testing

  • npm test + npm run check pass locally.
  • Remote test.yml dispatched on the branch: green.
## Why sigv4/S3 signed-HTTP client is copy-pasted across the artifact + cache actions and has drifted (download-artifact-action#11). This adds a vendored known-answer SigV4 test so any future drift in the signer fails CI. ## What - tests/sigv4.test.js: pins canonical request, string-to-sign hash, signed headers, signature hex, and Authorization header for a fixed key/region/timestamp/payload. - Same vector vendored into all three action repos (download/upload/cache) so drift is caught everywhere. ## Testing - npm test + npm run check pass locally. - Remote test.yml dispatched on the branch: green.
Add SigV4 drift guard test
All checks were successful
ci / test (pull_request) Successful in 7s
Details
test / unit (pull_request) Successful in 5s
Details
test / e2e (pull_request) Successful in 4s
Details
a0973a61f2
stephen deleted branch feat/11-sigv4-drift-guard 2026-07-02 04:24:49 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
backlog
Accepted but not scheduled

  
blocked
Blocked or stalled waiting on external progress

  
converted
Converted into tracked work

  
opportunity
Potential product or business opportunity

  
p1
Priority 1

  
p2
Priority 2

  
p3
Priority 3

  
parked
Paused intentionally until later

No labels
backlog
blocked
converted
opportunity
p1
p2
p3
parked
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
rasterstate/upload-artifact-action!9
No description provided.