Fix cleanup & scan bugs and refactor workflow (#3)

Author: seeebiii

.github/workflows/main.yml

@@ -11,18 +11,16 @@ permissions:
   contents: write
 
 jobs:
-  test_scans:
-    name: Test local file, artifact, and release asset scanning
-    runs-on: ubuntu-latest
+  local_file_scan:
+    name: Test local file (<10MB)
+    runs-on: ubuntu-slim
     steps:
-      # Checkout the repository to access files
       - name: Checkout
         uses: actions/checkout@v6
 
-      # Test 1: Scan local file
       - name: Scan local .gitignore file
         id: scan_local
-        uses: ./ # Uses the action in the root directory
+        uses: ./
         with:
           local-file-path: .gitignore
           api-key: ${{ secrets.ATTACHMENTAV_API_KEY }}
@@ -37,7 +35,13 @@ jobs:
             echo "Finding: ${{ steps.scan_local.outputs.finding }}"
           fi
 
-      # Test 2: Create and scan artifact
+  artifact_scan:
+    name: Test artifact
+    runs-on: ubuntu-slim
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
       - name: Upload action.yml as artifact
         id: upload_artifact
         uses: actions/upload-artifact@v6
@@ -63,7 +67,13 @@ jobs:
             echo "Finding: ${{ steps.scan_artifact.outputs.finding }}"
           fi
 
-      # Test 3: Create release and scan asset
+  release_scan:
+    name: Test release
+    runs-on: ubuntu-slim
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
       - name: Create release with action.yml asset
         id: create_release
         run: |
@@ -102,15 +112,46 @@ jobs:
             echo "Finding: ${{ steps.scan_asset.outputs.finding }}"
           fi
 
-      # Test 4: Scan local file >10MB
+      - name: Cleanup test release
+        if: always() && steps.create_release.outcome == 'success'
+        run: |
+          if [ -n "${{ steps.create_release.outputs.tag_name }}" ]; then
+            gh release delete "${{ steps.create_release.outputs.tag_name }}" --yes --cleanup-tag || true
+          fi
+        env:
+          GH_TOKEN: ${{ github.token }}
+
+  local_file_scan_large:
+    name: Test large local file (80MB)
+    runs-on: ubuntu-slim
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
       - name: Generate 80MB local file
         run: |
           mkdir test-data
           head -c 83886080 </dev/urandom >test-data/random-80mb-file
 
+      - name: Create temporary branch and commit file
+        id: create_temp_branch
+        run: |
+          BRANCH_NAME="ci-tests-${{ github.run_number }}-${{ github.run_attempt }}"
+          echo "branch_name=$BRANCH_NAME" >> $GITHUB_OUTPUT
+
+          git config user.name "github-actions[bot]"
+          git config user.email "github-actions[bot]@users.noreply.github.com"
+          git checkout -b "$BRANCH_NAME"
+          git add test-data/random-80mb-file
+          git commit -m "Add 80MB test file for CI"
+          git push origin "$BRANCH_NAME"
+          echo "Temporary branch created: $BRANCH_NAME"
+
       - name: Scan local random-80mb-file
         id: scan_local_80mb
-        uses: ./ # Uses the action in the root directory
+        uses: ./
+        env:
+          GIT_REF: ${{ steps.create_temp_branch.outputs.branch_name }}
         with:
           local-file-path: test-data/random-80mb-file
           api-key: ${{ secrets.ATTACHMENTAV_API_KEY }}
@@ -126,9 +167,24 @@ jobs:
             echo "Finding: ${{ steps.scan_local_80mb.outputs.finding }}"
           fi
 
-      # Test 5: Create and scan >200MB artifact
-      - name: Duplicate test-data
+      - name: Cleanup temporary branch
+        if: always() && steps.create_temp_branch.outcome == 'success'
         run: |
+          if [ -n "${{ steps.create_temp_branch.outputs.branch_name }}" ]; then
+            git push origin --delete "${{ steps.create_temp_branch.outputs.branch_name }}" || true
+          fi
+
+  artifact_scan_large:
+    name: Test large artifact (>200MB)
+    runs-on: ubuntu-slim
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Create large test data
+        run: |
+          mkdir test-data
+          head -c 83886080 </dev/urandom >test-data/random-80mb-file
           cp test-data/random-80mb-file test-data/random-80mb-file2
           cp test-data/random-80mb-file test-data/random-80mb-file3
           cp test-data/random-80mb-file test-data/random-80mb-file4
@@ -159,7 +215,33 @@ jobs:
             echo "Finding: ${{ steps.scan_artifact_large.outputs.finding }}"
           fi
 
-      # Test 6: Create release with large asset and scan asset
+      - name: Cleanup large artifact file
+        if: always() && steps.upload_artifact_large.outcome == 'success'
+        run: |
+          if [ -n "${{ steps.upload_artifact_large.outputs.artifact-id }}" ]; then
+            curl -L \
+              -X DELETE \
+              -H "Accept: application/vnd.github+json" \
+              -H "Authorization: Bearer ${{ github.token }}" \
+              -H "X-GitHub-Api-Version: 2022-11-28" \
+              https://api.github.com/repos/${{ github.repository }}/actions/artifacts/${{ steps.upload_artifact_large.outputs.artifact-id }}
+          fi
+
+  release_scan_large:
+    name: Test large release (>200MB)
+    runs-on: ubuntu-slim
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Create large test data
+        run: |
+          mkdir test-data
+          head -c 83886080 </dev/urandom >test-data/random-80mb-file
+          cp test-data/random-80mb-file test-data/random-80mb-file2
+          cp test-data/random-80mb-file test-data/random-80mb-file3
+          cp test-data/random-80mb-file test-data/random-80mb-file4
+
       - name: Create release with test-data/ asset
         id: create_release_large
         run: |
@@ -201,33 +283,11 @@ jobs:
             echo "Finding: ${{ steps.scan_asset_large.outputs.finding }}"
           fi
 
-      # Cleanup: Delete test release
-      - name: Cleanup test release
-        if: steps.create_release.outcome == 'success'
-        run: |
-          if [ -n "${{ steps.create_release.outputs.tag_name }}" ]; then
-            gh release delete "${{ steps.create_release.outputs.tag_name }}" --yes --cleanup-tag || true
-          fi
-        env:
-          GH_TOKEN: ${{ github.token }}
-
-      - name: Cleanup large artifact file
-        if: steps.upload_artifact_large.outcome == 'success'
-        run: |
-          if [ -n "${{ steps.upload_artifact_large.outputs.artifact-id }}" ]; then
-            curl -L \
-              -X DELETE \
-              -H "Accept: application/vnd.github+json" \
-              -H "Authorization: Bearer ${{ github.token }}" \
-              -H "X-GitHub-Api-Version: 2022-11-28" \
-              https://api.github.com/repos/${{ github.repository }}/actions/artifacts/${{ steps.upload_artifact_large.outputs.artifact-id }}
-          fi
-
       - name: Cleanup large release
-        if: steps.create_release_large.outcome == 'success'
+        if: always() && steps.create_release_large.outcome == 'success'
         run: |
           if [ -n "${{ steps.create_release_large.outputs.tag_name }}" ]; then
             gh release delete "${{ steps.create_release_large.outputs.tag_name }}" --yes --cleanup-tag || true
           fi
         env:
-          GH_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ github.token }}

dist/index.mjs

@@ -32961,7 +32961,9 @@ async function getContentsDownloadUrl(localFilePath, token) {
     const { owner, repo } = context.repo;
     // Remove leading slash if present
     const cleanPath = localFilePath.startsWith('/') ? localFilePath.slice(1) : localFilePath;
-    const url = `https://api.github.com/repos/${owner}/${repo}/contents/${cleanPath}`;
+    const query = `ref=${encodeURIComponent(process.env.GIT_REF || context.ref)}`;
+    const url = `https://api.github.com/repos/${owner}/${repo}/contents/${cleanPath}?${query}`;
+    debug(`using download url ${url}`);
     try {
         const response = await fetch(url, {
             method: "GET",

dist/index.mjs.map

@@ -11,7 +11,10 @@ export async function getContentsDownloadUrl(localFilePath: string, token: strin
 
   // Remove leading slash if present
   const cleanPath = localFilePath.startsWith('/') ? localFilePath.slice(1) : localFilePath;
-  const url = `https://api.github.com/repos/${owner}/${repo}/contents/${cleanPath}`;
+  const query = `ref=${encodeURIComponent(process.env.GIT_REF || github.context.ref)}`;
+  const url = `https://api.github.com/repos/${owner}/${repo}/contents/${cleanPath}?${query}`;
+
+  core.debug(`using download url ${url}`);
 
   try {
     const response = await fetch(url, {