feat: use an exact version of wrangler as the default

Author: andykenward

.changeset/cold-cats-carry.md

@@ -0,0 +1,5 @@
+---
+'github-actions-cloudflare-pages': minor
+---
+
+Use an exact version of wrangler as the default version. This avoids using a version published that may have a potential security issue.

README.md

@@ -65,7 +65,7 @@ working-directory:
   description: 'Directory to run wrangler cli from'
   required: false
 wrangler-version:
-  description: 'Wrangler version to use. Otherwise a default version of ^4.6.0 will be used.'
+  description: 'Wrangler version to use. Otherwise a default version from the action will be used.'
   required: false
 ```
 

__tests__/common/batch-delete.test.ts

@@ -20,7 +20,7 @@ import {
   setMockApi
 } from '../helpers/api.js'
 
-vi.mock('@actions/core')
+vi.mock(import('@actions/core'))
 
 describe('batch-delete', () => {
   let mockApi: MockApi

__tests__/common/cloudflare/api/fetch-error.test.ts

@@ -7,7 +7,7 @@ import {throwFetchError} from '@/common/cloudflare/api/fetch-error.js'
 
 const RESOURCE_URL = `https://api.cloudflare.com/path`
 
-vi.mock('@actions/core')
+vi.mock(import('@actions/core'))
 
 describe(throwFetchError, () => {
   test('throws parsed error with notes', () => {

__tests__/common/cloudflare/api/fetch-result.test.ts

@@ -14,7 +14,7 @@ const RESOURCE_URL_DOMAIN = `https://api.cloudflare.com`
 const RESOURCE_URL_PATH = `/client/v4/accounts`
 const RESOURCE_URL = `${RESOURCE_URL_DOMAIN}${RESOURCE_URL_PATH}`
 
-vi.mock('@actions/core')
+vi.mock(import('@actions/core'))
 
 describe('api', () => {
   describe(fetchResult, () => {

__tests__/common/cloudflare/deployment/create.test.ts

@@ -17,8 +17,10 @@ import {
 import {execAsync} from '@/common/utils.js'
 import {INPUT_KEY_WORKING_DIRECTORY} from '@/input-keys'
 
-vi.mock('@/common/utils.js')
-vi.mock('@actions/core')
+import packageJson from '../../../../package.json' with {type: 'json'}
+
+vi.mock(import('@/common/utils.js'))
+vi.mock(import('@actions/core'))
 
 describe(createCloudflareDeployment, () => {
   describe('api calls', () => {
@@ -57,7 +59,7 @@ describe(createCloudflareDeployment, () => {
       ).rejects.toThrowErrorMatchingInlineSnapshot(`[Error: Oh no!]`)
 
       expect(execAsync).toHaveBeenCalledWith(
-        `npx wrangler@^4.34.0 pages deploy mock-directory --project-name=mock-cloudflare-project-name --branch=mock-github-head-ref --commit-dirty=true --commit-hash=mock-github-sha`,
+        `npx wrangler@${packageJson.devDependencies.wrangler} pages deploy mock-directory --project-name=mock-cloudflare-project-name --branch=mock-github-head-ref --commit-dirty=true --commit-hash=mock-github-sha`,
         {
           // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
           env: expect.objectContaining({
@@ -143,7 +145,7 @@ describe(createCloudflareDeployment, () => {
       // vi.advanceTimersByTime(2000)
 
       expect(execAsync).toHaveBeenCalledWith(
-        `npx wrangler@^4.34.0 pages deploy mock-directory --project-name=mock-cloudflare-project-name --branch=mock-github-head-ref --commit-dirty=true --commit-hash=mock-github-sha`,
+        `npx wrangler@${packageJson.devDependencies.wrangler} pages deploy mock-directory --project-name=mock-cloudflare-project-name --branch=mock-github-head-ref --commit-dirty=true --commit-hash=mock-github-sha`,
         {
           // eslint-disable-next-line @typescript-eslint/no-unsafe-assignment
           env: expect.objectContaining({

__tests__/common/github/comment.test.ts

@@ -12,7 +12,7 @@ import type {WorkflowEventExtract} from '@/common/github/workflow-event/types.js
 import {addComment, MutationAddComment} from '@/common/github/comment.js'
 import * as Context from '@/common/github/context.js'
 
-vi.mock('@actions/core')
+vi.mock(import('@actions/core'))
 
 describe(addComment, () => {
   const mockData = RESPONSE_DEPLOYMENTS.result[0] as unknown as PagesDeployment

__tests__/common/github/environment.test.ts

@@ -16,7 +16,7 @@ import {
   QueryGetEnvironment
 } from '@/common/github/environment.js'
 
-vi.mock('@actions/core')
+vi.mock(import('@actions/core'))
 
 describe('environment', () => {
   let mockApi: MockApi

__tests__/common/inputs.test.ts

@@ -9,6 +9,8 @@ import {
   INPUT_KEY_WRANGLER_VERSION
 } from '@/input-keys'
 
+import packageJson from '../../package.json' with {type: 'json'}
+
 const setup = async () => {
   return await import('@/common/inputs.js')
 }
@@ -70,7 +72,7 @@ describe('common', () => {
         cloudflareApiToken: 'mock-cloudflare-api-token',
         gitHubApiToken: 'mock-github-token',
         gitHubEnvironment: undefined,
-        wranglerVersion: '^4.34.0'
+        wranglerVersion: packageJson.devDependencies.wrangler
       })
     })
 
@@ -84,7 +86,7 @@ describe('common', () => {
 
       expect(useCommonInputs()).toStrictEqual(
         expect.objectContaining({
-          wranglerVersion: '^4.34.0'
+          wranglerVersion: packageJson.devDependencies.wrangler
         })
       )
     })

__tests__/deploy/main.test.ts

@@ -16,11 +16,11 @@ import {execAsync} from '@/common/utils.js'
 // import RESPONSE_PROJECT from '@/responses/api.cloudflare.com/pages/projects/project.response.json'
 import {run} from '@/deploy/main.js'
 
-vi.mock('@actions/core')
-vi.mock('@/common/utils.js')
-vi.mock('@/common/github/environment.js')
-vi.mock('@/common/github/deployment/create.js')
-vi.mock('@/common/github/comment.js')
+vi.mock(import('@actions/core'))
+vi.mock(import('@/common/utils.js'))
+vi.mock(import('@/common/github/environment.js'))
+vi.mock(import('@/common/github/deployment/create.js'))
+vi.mock(import('@/common/github/comment.js'))
 
 describe('deploy', () => {
   describe('main', () => {