Use JSON + a typed wrapper instead of TS codegen (#1025)

Signed-off-by: William Woodruff <william@yossarian.net>

.gitattributes

@@ -1,2 +1,3 @@
 * text=auto eol=lf
 dist/** -diff linguist-generated=true
+src/download/checksum/known-checksums.json linguist-generated=true

.github/workflows/update-known-checksums.yml

@@ -26,7 +26,7 @@ jobs:
         id: update-known-checksums
         run:
           node dist/update-known-checksums/index.cjs
-          src/download/checksum/known-checksums.ts
+          src/download/checksum/known-checksums.json
       - name: Check for changes
         id: changes-exist
         run: |

__tests__/download/checksum/update-known-checksums.test.ts

@@ -0,0 +1,27 @@
+import { promises as fs } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { expect, test } from "@jest/globals";
+import { updateChecksums } from "../../../src/download/checksum/update-known-checksums";
+
+test("serializes checksum entries as JSON data", async () => {
+  const tempDirectory = await fs.mkdtemp(
+    path.join(os.tmpdir(), "setup-uv-checksums-test-"),
+  );
+  const outputPath = path.join(tempDirectory, "known-checksums.json");
+  const key = 'platform-1.0.0"\n};\nglobalThis.compromised = true;';
+  const checksum = 'checksum"\\\nvalue';
+
+  try {
+    await updateChecksums(outputPath, [
+      { checksum, key },
+      { checksum: "duplicate", key },
+    ]);
+
+    const content = await fs.readFile(outputPath, "utf8");
+    expect(JSON.parse(content)).toEqual({ [key]: checksum });
+    expect(content.endsWith("\n")).toBe(true);
+  } finally {
+    await fs.rm(tempDirectory, { force: true, recursive: true });
+  }
+});

dist/setup/index.cjs

@@ -94506,8 +94506,8 @@ var ASTRAL_MIRROR_PREFIX = "https://releases.astral.sh/github/uv/releases/downlo
 var crypto6 = __toESM(require("node:crypto"), 1);
 var fs10 = __toESM(require("node:fs"), 1);
 
-// src/download/checksum/known-checksums.ts
+// src/download/checksum/known-checksums.json
-var KNOWN_CHECKSUMS = {
+var known_checksums_default = {
   "aarch64-apple-darwin-0.12.5": "5bb0e5fe008a773c3dbcb97ff79cd89e1241464fe9d2f986d52ad8f1b037bd62",
   "aarch64-pc-windows-msvc-0.12.5": "724279317fee6e5fa8ad1908e4eba2bbe764ef1ece5b3f4597927b62b1fe562a",
   "aarch64-unknown-linux-gnu-0.12.5": "9bf43b4d1a07665bf64d4c4e710930b382321a785e0eb10aac07f46471f86a31",
@@ -99672,6 +99672,9 @@ var KNOWN_CHECKSUMS = {
   "x86_64-unknown-linux-musl-0.0.5": "705bbe04a93a9d4d9db5224c2f980a88bba272538a33a78ea2e966f46b4d5eb7"
 };
 
+// src/download/checksum/known-checksums.ts
+var KNOWN_CHECKSUMS = known_checksums_default;
+
 // src/download/checksum/checksum.ts
 async function validateChecksum(checksum, downloadPath, arch3, platform2, version3) {
   const key = `${arch3}-${platform2}-${version3}`;

dist/update-known-checksums/index.cjs

@@ -47180,8 +47180,8 @@ var semver2 = __toESM(require_semver(), 1);
 // src/download/checksum/known-version.ts
 var semver = __toESM(require_semver(), 1);
 
-// src/download/checksum/known-checksums.ts
+// src/download/checksum/known-checksums.json
-var KNOWN_CHECKSUMS = {
+var known_checksums_default = {
   "aarch64-apple-darwin-0.12.5": "5bb0e5fe008a773c3dbcb97ff79cd89e1241464fe9d2f986d52ad8f1b037bd62",
   "aarch64-pc-windows-msvc-0.12.5": "724279317fee6e5fa8ad1908e4eba2bbe764ef1ece5b3f4597927b62b1fe562a",
   "aarch64-unknown-linux-gnu-0.12.5": "9bf43b4d1a07665bf64d4c4e710930b382321a785e0eb10aac07f46471f86a31",
@@ -52346,6 +52346,9 @@ var KNOWN_CHECKSUMS = {
   "x86_64-unknown-linux-musl-0.0.5": "705bbe04a93a9d4d9db5224c2f980a88bba272538a33a78ea2e966f46b4d5eb7"
 };
 
+// src/download/checksum/known-checksums.ts
+var KNOWN_CHECKSUMS = known_checksums_default;
+
 // src/download/checksum/known-version.ts
 var VERSION_IN_CHECKSUM_KEY_PATTERN = /-(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)$/;
 function getLatestKnownVersion() {
@@ -52373,9 +52376,8 @@ async function updateChecksums(filePath, checksumEntries) {
     }
     deduplicatedEntries.set(entry.key, entry.checksum);
   }
-  const body = [...deduplicatedEntries.entries()].map(([key, checksum]) => `  "${key}":
+  const content = `${JSON.stringify(Object.fromEntries(deduplicatedEntries), null, 2)}
-    "${checksum}"`).join(",\n");
+`;
-  const content = "// AUTOGENERATED_DO_NOT_EDIT\nexport const KNOWN_CHECKSUMS: { [key: string]: string } = {\n" + body + (body === "" ? "" : ",\n") + "};\n";
   await import_node_fs.promises.writeFile(filePath, content);
 }
 

package.json

@@ -12,7 +12,7 @@
     "test:unit": "node --experimental-vm-modules ./node_modules/jest/bin/jest.js",
     "test": "npm run build && npm run test:unit",
     "act": "act pull_request -W .github/workflows/test.yml --container-architecture linux/amd64 -s GITHUB_TOKEN=\"$(gh auth token)\"",
-    "update-known-checksums": "RUNNER_TEMP=known_versions node dist/update-known-checksums/index.cjs src/download/checksum/known-checksums.ts",
+    "update-known-checksums": "RUNNER_TEMP=known_versions node dist/update-known-checksums/index.cjs src/download/checksum/known-checksums.json",
     "all": "npm run build && npm run check && npm run package && npm run test:unit"
   },
   "repository": {

src/download/checksum/update-known-checksums.ts

@@ -19,16 +19,7 @@ export async function updateChecksums(
     deduplicatedEntries.set(entry.key, entry.checksum);
   }
 
-  const body = [...deduplicatedEntries.entries()]
+  const content = `${JSON.stringify(Object.fromEntries(deduplicatedEntries), null, 2)}\n`;
-    .map(([key, checksum]) => `  "${key}":\n    "${checksum}"`)
-    .join(",\n");
-
-  const content =
-    "// AUTOGENERATED_DO_NOT_EDIT\n" +
-    "export const KNOWN_CHECKSUMS: { [key: string]: string } = {\n" +
-    body +
-    (body === "" ? "" : ",\n") +
-    "};\n";
 
   await fs.writeFile(filePath, content);
 }

tsconfig.json

@@ -5,6 +5,7 @@
     "module": "esnext",
     "moduleResolution": "bundler",
     "noImplicitAny": true,
+    "resolveJsonModule": true,
     "strict": true,
     "target": "ES2022"
   },