feat: build for release

README.md

@@ -1,6 +1,8 @@
 # codeclimate-action
 
-[![Build Status](https://github.com/paambaati/codeclimate-action/workflows/PR%20Checks/badge.svg)](https://actions-badge.atrox.dev/paambaati/codeclimate-action/goto) [![MIT License](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
+[![Test Coverage](https://api.codeclimate.com/v1/badges/8f2233d4c51c92ad427c/test_coverage)](https://codeclimate.com/github/paambaati/codeclimate-action/test_coverage)
+[![Build Status](https://github.com/paambaati/codeclimate-action/workflows/PR%20Checks/badge.svg)](https://actions-badge.atrox.dev/paambaati/codeclimate-action/goto)
+[![MIT License](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
 
 A GitHub action that publishes your code coverage to [Code Climate](http://codeclimate.com/).
 
@@ -15,8 +17,9 @@ This action requires that you set the [`CC_TEST_REPORTER_ID`](https://docs.codec
 | `coverageCommand`   |                 | The actual command that should be executed to run your tests and capture coverage. |
 | `workingDirectory`  |                 | Specify a custom working directory where the coverage command should be executed.  |
 | `debug`             | `false`         | Enable Code Coverage debug output when set to `true`.                              |
-| `coverageLocations` |                 | Locations to find code coverage as a multiline string.<br>Each line should be of the form `<location>:<type>`. See examples below.
+| `coverageLocations` |                 | Locations to find code coverage as a multiline string.<br>Each line should be of the form `<location>:<type>`.<br>`type` can be any one of `clover, cobertura, coverage.py, excoveralls, gcov, gocov, jacoco, lcov, lcov-json, simplecov, xccov`. See examples below. |
 | `prefix`            | `undefined`     | See [`--prefix`](https://docs.codeclimate.com/docs/configuring-test-coverage)      |
+| `verifyDownload`    | `true`          | Verifies the downloaded Code Climate reporter binary's checksum and GPG signature. See [Verifying binaries](https://github.com/codeclimate/test-reporter#verifying-binaries)      |
 
 #### Example
 

action.yml

@@ -25,6 +25,10 @@ inputs:
     required: false
     description: 'See https://docs.codeclimate.com/docs/configuring-test-coverage'
     default: ''
+  verifyDownload:
+    required: false
+    description: 'Verify the downloaded reporter\'s checksum and GPG signature'
+    default: 'true'
 runs:
   using: 'node12'
   main: 'lib/main.js'

lib/utils.js

@@ -1,8 +1,169 @@
 "use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.areObjectsEqual = exports.getOptionalString = void 0;
+exports.verifySignature = exports.verifyChecksum = exports.getFileChecksum = exports.getFileContentsAsString = exports.getFileContents = exports.downloadToFile = exports.areObjectsEqual = exports.getOptionalString = void 0;
+const crypto_1 = require("crypto");
+const fs_1 = require("fs");
+const util_1 = require("util");
 const core_1 = require("@actions/core");
-const getOptionalString = (name, defaultValue = '') => core_1.getInput(name, { required: false }) || defaultValue;
+const node_fetch_1 = __importDefault(require("node-fetch"));
+const openpgp_1 = require("openpgp");
+const readFileAsync = (0, util_1.promisify)(fs_1.readFile);
+/**
+ * Parses GitHub Action input and returns the optional value as a string.
+ *
+ * @param name Input name (declared in `action.yml`).
+ * @param defaultValue Default value as optional fallback.
+ * @returns Parsed input value.
+ */
+const getOptionalString = (name, defaultValue = '') => (0, core_1.getInput)(name, { required: false }) || defaultValue;
 exports.getOptionalString = getOptionalString;
+/**
+ * Naively checks if 2 given JSON objects are identical.
+ *
+ * @param obj1 First JSON.
+ * @param obj2 Second JSON.
+ * @returns `true` if same, `false` if not.
+ */
 const areObjectsEqual = (obj1, obj2) => JSON.stringify(obj1) === JSON.stringify(obj2);
 exports.areObjectsEqual = areObjectsEqual;
+/**
+ * Downloads the given URL as a file to the given file location.
+ *
+ * @param url URL to download.
+ * @param file File path to save the download to.
+ * @param mode (Optional) File mode.
+ */
+function downloadToFile(url, file, mode = 0o755) {
+    return new Promise((resolve, reject) => __awaiter(this, void 0, void 0, function* () {
+        try {
+            const response = yield (0, node_fetch_1.default)(url, { timeout: 2 * 60 * 1000 }); // Timeout in 2 minutes.
+            const writer = (0, fs_1.createWriteStream)(file, { mode });
+            response.body.pipe(writer);
+            writer.on('close', () => {
+                return resolve();
+            });
+        }
+        catch (err) {
+            return reject(err);
+        }
+    }));
+}
+exports.downloadToFile = downloadToFile;
+/**
+ * Returns file contents as a `Buffer`.
+ *
+ * @param filePath File path to read.
+ * @param options (Optional) File read options. @see https://nodejs.org/dist/latest-v16.x/docs/api/fs.html#fs_filehandle_readfile_options
+ * @returns File contents as `Buffer`.
+ */
+function getFileContents(filePath, options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        return yield readFileAsync(filePath, options);
+    });
+}
+exports.getFileContents = getFileContents;
+/**
+ * Returns file contents as a string. Useful for reading ASCII-encoded files.
+ *
+ * @param filePath File path to read.
+ * @param options (Optional) File read options. @see https://nodejs.org/dist/latest-v16.x/docs/api/fs.html#fs_filehandle_readfile_options
+ * @returns File contents as string.
+ */
+function getFileContentsAsString(filePath, options) {
+    return __awaiter(this, void 0, void 0, function* () {
+        return (yield getFileContents(filePath, options)).toString('utf8');
+    });
+}
+exports.getFileContentsAsString = getFileContentsAsString;
+/**
+ * Returns given file's checksum by calculating the hash for the given algorithm.
+ *
+ * @param filePath File to generate checksum for.
+ * @param algorithm Hashing algorithm. @default `sha256`
+ * @returns Checksum of file as string.
+ */
+function getFileChecksum(filePath, algorithm = 'sha256') {
+    return __awaiter(this, void 0, void 0, function* () {
+        const fileContents = yield getFileContents(filePath);
+        return (0, crypto_1.createHash)(algorithm).update(fileContents).digest('hex');
+    });
+}
+exports.getFileChecksum = getFileChecksum;
+/**
+ * Verifies that the file and its checksum file actually match. It generates
+ * the checksum and compares it with the checksum in the accompanying checksum file.
+ *
+ * Note that the checksum file is of the format `<checksum> <filename>`.
+ *
+ * @param originalFile Original file for which the checksum was generated.
+ * @param checksumFile Checksum file.
+ * @param algorithm (Optional) Hashing algorithm. @default `sha256`
+ * @returns Returns `true` if checksums match, `false` if they don't.
+ */
+function verifyChecksum(originalFile, checksumFile, algorithm = 'sha256') {
+    return __awaiter(this, void 0, void 0, function* () {
+        const binaryChecksum = yield getFileChecksum(originalFile, algorithm);
+        const declaredChecksumFileContents = yield getFileContents(checksumFile);
+        const declaredChecksum = declaredChecksumFileContents
+            .toString()
+            .trim()
+            .split(' ')[0];
+        try {
+            return (0, crypto_1.timingSafeEqual)(Buffer.from(binaryChecksum), Buffer.from(declaredChecksum));
+        }
+        catch (_a) {
+            // Fail on other errors that can definitely cause the comparison to fail, including
+            // mismatched Buffer byte lengths.
+            return false;
+        }
+    });
+}
+exports.verifyChecksum = verifyChecksum;
+/**
+ * Verifies the GPG signature of the given file.
+ *
+ * @param messageFilePath The message file that was signed.
+ * @param signatureFilePath GPG signature file.
+ * @param publicKeyFilePath GPG public key file.
+ * @returns Returns `true` if signatures match, `false` if they don't.
+ */
+function verifySignature(messageFilePath, signatureFilePath, publicKeyFilePath) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const messageText = yield getFileContentsAsString(messageFilePath);
+        const signatureBuffer = yield getFileContents(signatureFilePath);
+        const publicKeyText = yield getFileContentsAsString(publicKeyFilePath);
+        const publicKey = yield (0, openpgp_1.readKey)({
+            armoredKey: publicKeyText,
+        });
+        const signature = yield (0, openpgp_1.readSignature)({
+            binarySignature: signatureBuffer,
+        });
+        const message = yield (0, openpgp_1.createMessage)({ text: messageText });
+        const verificationResult = yield (0, openpgp_1.verify)({
+            message,
+            signature,
+            verificationKeys: publicKey,
+        });
+        const { verified } = verificationResult.signatures[0];
+        try {
+            yield verified;
+            return true;
+        }
+        catch (_a) {
+            return false;
+        }
+    });
+}
+exports.verifySignature = verifySignature;