refactor: use hosted tool cache installer

.eslintrc.js

@@ -0,0 +1,76 @@
+// This is based on the reusable configuration from
+// https://github.com/actions/reusable-workflows/tree/main/reusable-configurations.
+const js = require('@eslint/js');
+const tsParser = require('@typescript-eslint/parser');
+const tsPlugin = require('@typescript-eslint/eslint-plugin');
+const nodePlugin = require('eslint-plugin-n').default;
+const jestPlugin = require('eslint-plugin-jest');
+const prettierConfig = require('eslint-config-prettier');
+
+module.exports = [
+  {
+    ignores: ['coverage/**', 'dist/**', 'lib/**', 'node_modules/**']
+  },
+  js.configs.recommended,
+  {
+    files: ['**/*.ts'],
+    languageOptions: {
+      parser: tsParser,
+      parserOptions: {
+        sourceType: 'module'
+      },
+      globals: {
+        Buffer: 'readonly',
+        NodeJS: 'readonly',
+        process: 'readonly'
+      }
+    },
+    plugins: {
+      '@typescript-eslint': tsPlugin,
+      n: nodePlugin,
+      jest: jestPlugin
+    },
+    rules: {
+      ...tsPlugin.configs.recommended.rules,
+      '@typescript-eslint/no-require-imports': 'error',
+      '@typescript-eslint/no-non-null-assertion': 'off',
+      '@typescript-eslint/no-explicit-any': 'off',
+      '@typescript-eslint/no-empty-function': 'off',
+      '@typescript-eslint/ban-ts-comment': [
+        'error',
+        {
+          'ts-ignore': 'allow-with-description'
+        }
+      ],
+      'no-console': 'error',
+      yoda: 'error',
+      'prefer-const': [
+        'error',
+        {
+          destructuring: 'all'
+        }
+      ],
+      'no-control-regex': 'off',
+      'no-constant-condition': ['error', {checkLoops: false}],
+      'n/no-extraneous-import': 'error'
+    }
+  },
+  {
+    files: ['**/*{test,spec}.ts'],
+    languageOptions: {
+      globals: {
+        describe: 'readonly',
+        expect: 'readonly',
+        it: 'readonly'
+      }
+    },
+    rules: {
+      ...jestPlugin.configs.recommended.rules,
+      '@typescript-eslint/no-unused-vars': 'off',
+      'jest/no-standalone-expect': 'off',
+      'jest/no-conditional-expect': 'off',
+      'no-console': 'off'
+    }
+  },
+  prettierConfig
+];

.github/dependabot.yml

@@ -2,22 +2,33 @@
 version: 2
 updates:
   - package-ecosystem: gomod
-    directory: "/"
+    directory: '/'
     schedule:
-      interval: "daily"
+      interval: 'daily'
     open-pull-requests-limit: 10
     groups:
       all:
         update-types:
-          - "patch"
+          - 'patch'
 
-  - package-ecosystem: "github-actions"
-    directory: "/"
+  - package-ecosystem: npm
+    directory: '/'
     schedule:
-      interval: "daily"
+      interval: 'daily'
     open-pull-requests-limit: 10
     groups:
       all:
         update-types:
-          - "minor"
-          - "patch"
+          - 'minor'
+          - 'patch'
+
+  - package-ecosystem: 'github-actions'
+    directory: '/'
+    schedule:
+      interval: 'daily'
+    open-pull-requests-limit: 10
+    groups:
+      all:
+        update-types:
+          - 'minor'
+          - 'patch'

.github/workflows/ci.yaml

@@ -8,7 +8,42 @@ on:
 permissions: {}
 
 jobs:
+  build:
+    permissions:
+      contents: read
+
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      - uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+        with:
+          version: 11.5.2
+
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: '24'
+          cache: pnpm
+
+      - run: pnpm install --frozen-lockfile
+
+      - run: pnpm run format-check
+
+      - run: pnpm run lint
+
+      - run: pnpm test
+
+      - run: pnpm run build
+
+      - name: Check generated dist
+        run: git diff --exit-code -- dist
+
   test-ko-action:
+    needs: build
+
     strategy:
       matrix:
         runner:
@@ -52,9 +87,7 @@ jobs:
           version: tip
 
       - name: Check installed version (tip)
-        run: |
-          sudo rm /usr/local/bin/ko # Uninstall previous versions.
-          ko version
+        run: ko version
 
       # If KO_DOCKER_REPO is set during setup, it's set for future steps.
       - name: Pre-set KO_DOCKER_REPO

.github/workflows/use-action.yaml

@@ -45,9 +45,7 @@ jobs:
           version: tip
 
       - name: Check installed version (tip)
-        run: |
-          sudo rm /usr/local/bin/ko # Uninstall previous versions.
-          ko version
+        run: ko version
 
       # If KO_DOCKER_REPO is set during setup, it's set for future steps.
       - name: Pre-set KO_DOCKER_REPO

.gitignore

@@ -0,0 +1,70 @@
+node_modules/
+lib/
+
+# Logs
+logs
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+lerna-debug.log*
+
+# Diagnostic reports
+report.[0-9]*.[0-9]*.[0-9]*.[0-9]*.json
+
+# Runtime data
+pids
+*.pid
+*.seed
+*.pid.lock
+
+# Directory for instrumented libs generated by jscoverage/JSCover
+lib-cov
+
+# Coverage directory used by tools like istanbul
+coverage
+*.lcov
+
+# nyc test coverage
+.nyc_output
+
+# Grunt intermediate storage
+.grunt
+
+# Compiled binary addons
+build/Release
+
+# Dependency directories
+jspm_packages/
+
+# TypeScript cache
+*.tsbuildinfo
+
+# Optional package manager caches
+.npm
+.pnpm-store
+
+# Optional eslint cache
+.eslintcache
+
+# Optional REPL history
+.node_repl_history
+
+# Output of package archives
+*.tgz
+
+# dotenv environment variables file
+.env
+.env.test
+
+# Bundler and framework caches
+.cache
+.next
+.nuxt
+.vuepress/dist
+.serverless/
+.fusebox/
+
+# IDE metadata
+.idea/
+.DS_Store

.prettierrc.js

@@ -0,0 +1,11 @@
+// This is a reusable configuration file copied from https://github.com/actions/reusable-workflows/tree/main/reusable-configurations.
+module.exports = {
+  printWidth: 80,
+  tabWidth: 2,
+  useTabs: false,
+  semi: true,
+  singleQuote: true,
+  trailingComma: 'none',
+  bracketSpacing: false,
+  arrowParens: 'avoid'
+};

action.yml

@@ -8,66 +8,10 @@ inputs:
     description: 'Version of ko to install (tip, latest-release, v0.18.1, etc.)'
     required: true
     default: 'latest-release'
-  use-sudo:
-    description: 'set to true if install-dir location requires sudo privs'
+  token:
+    description: 'The token used to authenticate requests to GitHub.'
     required: false
-    default: 'false'
+    default: ${{ github.token }}
 runs:
-  using: "composite"
-  steps:
-  - shell: bash
-    env:
-      KO_VERSION: ${{ inputs.version }}
-      USE_SUDO: ${{ inputs.use-sudo }}
-      GH_TOKEN: ${{ github.token }}
-    run: |
-      set -ex
-
-      SUDO=
-      if [[ "${USE_SUDO}" == "true" ]] && command -v sudo >/dev/null; then
-        SUDO=sudo
-      fi
-
-      # Install ko:
-      # - if version is "tip", install from tip of main.
-      # - if version is "latest-release", look up latest release.
-      # - otherwise, install the specified version.
-      case ${KO_VERSION} in
-      tip)
-        echo "Installing ko using go install"
-        go install github.com/google/ko@main
-        ;;
-      latest-release)
-        tag=$(curl -L -s -u "username:${GH_TOKEN}" https://api.github.com/repos/ko-build/ko/releases/latest | jq -r '.tag_name')
-        ;;
-      *)
-        tag="${KO_VERSION}"
-      esac
-
-      os=${{ runner.os }}
-      arch=$(echo "${{ runner.arch }}" | tr '[:upper:]' '[:lower:]')
-      if [[ $os == "macOS" ]]; then
-        os="Darwin"
-      fi
-      if [[ $arch == "x64" ]]; then
-        arch="x86_64"
-      fi
-      if [[ ! -z ${tag} ]]; then
-        echo "Installing ko @ ${tag} for ${os} ${arch}"
-        curl -fsL https://github.com/ko-build/ko/releases/download/${tag}/ko_${tag:1}_${os}_${arch}.tar.gz | $SUDO tar xzf - -C /usr/local/bin ko
-      fi
-
-      if [[ ! -z ${KO_DOCKER_REPO} ]]; then
-        echo "KO_DOCKER_REPO is already set"
-        echo "Skipping login to ghcr.io and passing KO_DOCKER_REPO=${KO_DOCKER_REPO} on to future steps"
-        echo "KO_DOCKER_REPO=${KO_DOCKER_REPO}" >> $GITHUB_ENV
-      else
-        # NB: username doesn't seem to matter.
-        echo "${GH_TOKEN}" | ko login ghcr.io --username "dummy" --password-stdin
-
-        # Set KO_DOCKER_REPO for future steps.
-        # We need to get the repository name in lowercase, otherwise it could fail
-        repo=$(echo "${{ github.repository }}" | tr '[:upper:]' '[:lower:]')
-        echo "KO_DOCKER_REPO=ghcr.io/${repo}"
-        echo "KO_DOCKER_REPO=ghcr.io/${repo}" >> $GITHUB_ENV
-      fi
+  using: 'node24'
+  main: 'dist/setup/index.js'