Skip to content

feat: Reimplement as composite action, removing Node.js dependencies - #42

Merged
damacus merged 1 commit into
mainfrom
refactor/composite-action
Feb 18, 2026
Merged

feat: Reimplement as composite action, removing Node.js dependencies#42
damacus merged 1 commit into
mainfrom
refactor/composite-action

Conversation

@damacus

@damacus damacus commented Feb 18, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Replace using: node20 with using: composite — bash and pwsh steps call the omnitruck installer directly, exactly as the JS was doing
  • Use env vars for input interpolation in shell steps to avoid injection risks
  • Preserve the chef-workstation version default (21.6.497) in shell logic
  • Remove index.js, package.json, package-lock.json, and all of node_modules/ (200+ files)
  • Add .gitignore to prevent node_modules/ being committed again

The call interface is unchanged — consumers continue to use uses: actionshub/chef-install@main with the same inputs.

Why

The Node.js wrapper was only reading inputs and shelling out to curl | bash (Linux/macOS) or a PowerShell one-liner (Windows). No npm packages were needed for that. Removing them eliminates:

  • The Node.js runtime requirement
  • Ongoing Dependabot noise for @actions/core, @actions/exec, undici, etc.
  • The npm supply chain as an attack surface

Test plan

  • Verify Linux/macOS install with default inputs
  • Verify Linux/macOS install with version: latest
  • Verify Linux/macOS install with a pinned version
  • Verify Windows install (PATH addition via $GITHUB_PATH)
  • Verify channel: current and non-default project values

Replace the node20 action with a composite action using bash/pwsh steps
directly. The JS wrapper was only reading inputs and shelling out to
curl/PowerShell, so no Node.js runtime or npm packages are needed.

- Convert action.yml to `using: composite` with bash and pwsh steps
- Use env vars for input interpolation (avoids shell injection)
- Preserve version-defaulting logic for chef-workstation (21.6.497)
- Remove index.js, package.json, package-lock.json
- Remove vendored node_modules (200+ files: @actions/core, @actions/exec, undici, etc.)
- Add .gitignore to prevent node_modules being committed again

Call interface is unchanged for consumers.
@damacus damacus changed the title Reimplement as composite action, removing Node.js dependencies feat: Reimplement as composite action, removing Node.js dependencies Feb 18, 2026
@damacus
damacus merged commit 715f6ec into main Feb 18, 2026
2 of 3 checks passed
@damacus
damacus deleted the refactor/composite-action branch February 18, 2026 22:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant