Merge b0f1a15a39 into 802632921f

* Bump @actions/glob from 0.4.0 to 0.5.0

Bumps [@actions/glob](https://github.com/actions/toolkit/tree/HEAD/packages/glob) from 0.4.0 to 0.5.0.
- [Changelog](https://github.com/actions/toolkit/blob/main/packages/glob/RELEASES.md)
- [Commits](https://github.com/actions/toolkit/commits/HEAD/packages/glob)

---
updated-dependencies:
- dependency-name: "@actions/glob"
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* fix for check-dist and license failures

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Aparna Jyothi <aparnajyothi-y@github.com>

.github/dependabot.yml

@@ -0,0 +1,22 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+  # Enable version updates for npm
+  - package-ecosystem: 'npm'
+    # Look for `package.json` and `lock` files in the `root` directory
+    directory: '/'
+    # Check the npm registry for updates every day (weekdays)
+    schedule:
+      interval: 'weekly'
+
+  # Enable version updates for GitHub Actions
+  - package-ecosystem: 'github-actions'
+    # Workflow files stored in the default location of `.github/workflows`
+    # You don't need to specify `/.github/workflows` for `directory`. You can use `directory: "/"`.
+    directory: '/'
+    schedule:
+      interval: 'weekly'

.github/workflows/e2e-cache.yml

@@ -46,7 +46,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Install pnpm
-        uses: pnpm/action-setup@v2
+        uses: pnpm/action-setup@v4
         with:
           version: 6.10.0
       - name: Generate pnpm file

.github/workflows/publish-immutable-actions.yml

@@ -17,4 +17,4 @@ jobs:
         uses: actions/checkout@v4
       - name: Publish
         id: publish
-        uses: actions/publish-immutable-action@0.0.3
+        uses: actions/publish-immutable-action@v0.0.4

.github/workflows/versions.yml

@@ -159,7 +159,7 @@ jobs:
       matrix:
         os: [ubuntu-latest, windows-latest, macos-latest, macos-13]
         node-version-file:
-          [.nvmrc, .tool-versions, .tool-versions-node, package.json]
+          [.nvmrc, .tool-versions, .tool-versions-node, package.json, .npmrc]
     steps:
       - uses: actions/checkout@v4
       - name: Setup node from node version file

README.md

@@ -204,6 +204,15 @@ If the runner is not able to access github.com, any Nodejs versions requested du
  - [Publishing to npmjs and GPR with yarn](docs/advanced-usage.md#publish-to-npmjs-and-gpr-with-yarn)
  - [Using private packages](docs/advanced-usage.md#use-private-packages)
 
+## Recommended permissions
+
+When using the `setup-node` action in your GitHub Actions workflow, it is recommended to set the following permissions to ensure proper functionality:
+
+```yaml
+permissions:
+  contents: read # access to check out code and install dependencies
+```
+
 ## License
 
 The scripts and documentation in this project are released under the [MIT License](LICENSE)

__tests__/data/.npmrc

@@ -0,0 +1 @@
+use-node-version=20.0.0

__tests__/main.test.ts

@@ -103,10 +103,13 @@ describe('main tests', () => {
       ${''}                                        | ${''}
       ${'unknown format'}                          | ${'unknown format'}
       ${'  14.1.0  '}                              | ${'14.1.0'}
+      ${'use-node-version=lts/iron'}               | ${'lts/iron'}
       ${'{"volta": {"node": ">=14.0.0 <=17.0.0"}}'}| ${'>=14.0.0 <=17.0.0'}
       ${'{"volta": {"extends": "./package.json"}}'}| ${'18.0.0'}
       ${'{"engines": {"node": "17.0.0"}}'}         | ${'17.0.0'}
       ${'{}'}                                      | ${null}
+      ${'[section]use-node-version=16'}            | ${null}
+      ${'[section]\nuse-node-version=20'}          | ${null}
     `.it('parses "$contents"', ({contents, expected}) => {
       const existsSpy = jest.spyOn(fs, 'existsSync');
       existsSpy.mockImplementation(() => true);

package.json

@@ -25,19 +25,20 @@
   "author": "GitHub",
   "license": "MIT",
   "dependencies": {
-    "@actions/cache": "^3.2.4",
+    "@actions/cache": "^4.0.0",
-    "@actions/core": "^1.10.0",
+    "@actions/core": "^1.11.1",
-    "@actions/exec": "^1.1.0",
+    "@actions/exec": "^1.1.1",
     "@actions/github": "^5.1.1",
-    "@actions/glob": "^0.4.0",
+    "@actions/glob": "^0.5.0",
     "@actions/http-client": "^2.2.1",
     "@actions/io": "^1.0.2",
     "@actions/tool-cache": "^2.0.1",
-    "semver": "^7.6.0",
+    "ini": "^5.0.0",
+    "semver": "^7.6.3",
     "uuid": "^9.0.1"
   },
   "devDependencies": {
-    "@types/jest": "^29.5.12",
+    "@types/jest": "^29.5.14",
     "@types/node": "^20.11.25",
     "@types/semver": "^7.5.8",
     "@typescript-eslint/eslint-plugin": "^5.54.0",

src/ini.d.ts

@@ -0,0 +1,3 @@
+declare module 'ini' {
+  function parse(ini: string): Record<string, string | object>;
+}

src/util.ts

@@ -3,6 +3,7 @@ import * as exec from '@actions/exec';
 import * as io from '@actions/io';
 
 import fs from 'fs';
+import * as INI from 'ini';
 import path from 'path';
 
 export function getNodeVersionFromFile(versionFilePath: string): string | null {
@@ -56,6 +57,25 @@ export function getNodeVersionFromFile(versionFilePath: string): string | null {
     core.info('Node version file is not JSON file');
   }
 
+  // Try parsing the file as an NPM `.npmrc` file.
+  //
+  // If the file contents contain the use-node-version key, we conclude it's an
+  // `.npmrc` file.
+  if (contents.match(/use-node-version *=/)) {
+    const manifest = INI.parse(contents);
+    const key = 'use-node-version';
+
+    if (key in manifest && typeof manifest[key] === 'string') {
+      const version = manifest[key];
+      core.info(`Using node version ${version} from global INI ${key}`);
+      return version;
+    }
+
+    // We didn't find the key `use-node-version` in the global scope of the
+    // `.npmrc` file, so we return.
+    return null;
+  }
+
   const found = contents.match(/^(?:node(js)?\s+)?v?(?<version>[^\s]+)$/m);
   return found?.groups?.version ?? contents.trim();
 }