Action-ref warning (#149)

* chore: ref warning added

* chore: empty commit

* chore: removed warning conditional

* chore: changed method name

* chore: dist updated

* chore: updated action-ref warning

* chore: build updated

* chore: tests fixed

* chore: actions-tookit updated

dist/index.js

@@ -3784,6 +3784,43 @@ exports.request = request;
 //# sourceMappingURL=index.js.map
 
 
+/***/ }),
+
+/***/ 2183:
+/***/ ((module, __unused_webpack_exports, __nccwpck_require__) => {
+
+"use strict";
+
+
+const core = __nccwpck_require__(2186)
+const github = __nccwpck_require__(5438)
+
+/**
+ * Displays warning message if the action reference is pinned to master/main
+ */
+function logActionRefWarning() {
+  const actionRef = process.env.GITHUB_ACTION_REF
+  const repoName = github.context.payload.repository.full_name
+
+  if (actionRef === 'main' || actionRef === 'master') {
+    core.warning(
+      `${repoName} is pinned at HEAD. We strongly ` +
+        `advise against pinning to "@${actionRef}" as it may be unstable. Please ` +
+        `update your GitHub Action YAML from:\n\n` +
+        `    uses: '${repoName}@${actionRef}'\n\n` +
+        `to:\n\n` +
+        `    uses: '${repoName}@<release/tag version>'\n\n` +
+        `Alternatively, you can pin to any git tag or git SHA in the ` +
+        `repository.`
+    )
+  }
+}
+
+module.exports = {
+  logActionRefWarning
+}
+
+
 /***/ }),
 
 /***/ 3682:
@@ -9027,6 +9064,7 @@ const core = __nccwpck_require__(2186)
 const github = __nccwpck_require__(5438)
 const semverMajor = __nccwpck_require__(6688)
 const semverCoerce = __nccwpck_require__(3466)
+const toolkit = __nccwpck_require__(2183)
 
 const { githubClient } = __nccwpck_require__(3386)
 const checkTargetMatchToPR = __nccwpck_require__(7186)
@@ -9047,6 +9085,8 @@ const {
 
 module.exports = async function run() {
   try {
+    toolkit.logActionRefWarning()
+
     const { pull_request } = github.context.payload
 
     if (!pull_request && !PR_NUMBER) {

package.json

@@ -28,6 +28,7 @@
   "dependencies": {
     "@actions/core": "^1.6.0",
     "@actions/github": "^5.0.0",
+    "actions-toolkit": "github:nearform/actions-toolkit",
     "semver": "^7.3.5"
   },
   "devDependencies": {

src/action.js

@@ -4,6 +4,7 @@ const core = require('@actions/core')
 const github = require('@actions/github')
 const semverMajor = require('semver/functions/major')
 const semverCoerce = require('semver/functions/coerce')
+const toolkit = require('actions-toolkit')
 
 const { githubClient } = require('./github-client')
 const checkTargetMatchToPR = require('./checkTargetMatchToPR')
@@ -24,6 +25,8 @@ const {
 
 module.exports = async function run() {
   try {
+    toolkit.logActionRefWarning()
+
     const { pull_request } = github.context.payload
 
     if (!pull_request && !PR_NUMBER) {

test/action.test.js

@@ -7,6 +7,7 @@ const sinon = require('sinon')
 // Stubbing modules
 const core = require('@actions/core')
 const github = require('@actions/github')
+const toolkit = require('actions-toolkit')
 
 const actionLog = require('../src/log')
 const actionUtil = require('../src/util')
@@ -21,6 +22,9 @@ function buildStubbedAction({
 }) {
 
   const coreStub = sinon.stub(core)
+  const toolkitStub = sinon.stub(toolkit, 'logActionRefWarning')
+    .get(() => sinon.stub())
+
   const githubStub = sinon.stub(github, 'context')
     .get(() => { return { payload } })
 
@@ -40,6 +44,7 @@ function buildStubbedAction({
 
   const action = proxyquire('../src/action', {
     '@actions/core': coreStub,
+    'actions-toolkit': toolkitStub,
     '@actions/github': githubStub,
     './log': logStub,
     './util': utilStub,