Bump brace-expansion (#790)

* Bump brace-expansion

Bumps  and [brace-expansion](https://github.com/juliangruber/brace-expansion). These dependencies needed to be updated together.

Updates `brace-expansion` from 1.1.18 to 1.1.21
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](https://github.com/juliangruber/brace-expansion/compare/v1.1.18...v1.1.21)

Updates `brace-expansion` from 5.0.9 to 5.0.12
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](https://github.com/juliangruber/brace-expansion/compare/v1.1.18...v1.1.21)

Updates `brace-expansion` from 2.1.4 to 2.1.7
- [Release notes](https://github.com/juliangruber/brace-expansion/releases)
- [Commits](https://github.com/juliangruber/brace-expansion/compare/v1.1.18...v1.1.21)

---
updated-dependencies:
- dependency-name: brace-expansion
  dependency-version: 1.1.21
  dependency-type: indirect
- dependency-name: brace-expansion
  dependency-version: 5.0.12
  dependency-type: indirect
- dependency-name: brace-expansion
  dependency-version: 2.1.7
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

* Fix license failures

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: HarithaVattikuti <73516759+HarithaVattikuti@users.noreply.github.com>

.github/workflows/e2e-tests.yml

@@ -747,7 +747,7 @@ jobs:
         operating-system: [ubuntu-latest, windows-latest, macos-latest]
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Clear toolcache
         shell: pwsh
         run: __tests__/clear-toolcache.ps1 ${{ runner.os }}
@@ -769,3 +769,24 @@ jobs:
             throw "Expected 9.0.100 to be reused, got '${{ steps.reuse.outputs.dotnet-version }}'."
           }
           __tests__/verify-dotnet.ps1 -Patterns "^9\.0\.100$"
+
+  test-skip-lts-prepass:
+    runs-on: ${{ matrix.operating-system }}
+    strategy:
+      fail-fast: false
+      matrix:
+        operating-system: [ubuntu-latest, windows-latest]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - name: Clear toolcache
+        shell: pwsh
+        run: __tests__/clear-toolcache.ps1 ${{ runner.os }}
+      - name: Setup dotnet 9.0.308 with skip-lts-prepass
+        uses: ./
+        with:
+          dotnet-version: 9.0.308
+          skip-lts-prepass: true
+      - name: Verify dotnet
+        shell: pwsh
+        run: __tests__/verify-dotnet.ps1 -Patterns "^9\.0\.308$"

.licenses/npm/brace-expansion-1.1.21.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: brace-expansion
-version: 1.1.18
+version: 1.1.21
 type: npm
 summary: Brace expansion as known from sh/bash
 homepage: https://github.com/juliangruber/brace-expansion

.licenses/npm/brace-expansion-5.0.12.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: brace-expansion
-version: 5.0.9
+version: 5.0.12
 type: npm
 summary: Brace expansion as known from sh/bash
 homepage:

.licenses/npm/undici.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: undici
-version: 6.28.0
+version: 6.29.1
 type: npm
 summary: An HTTP/1.1 client, written from scratch for Node.js
 homepage: https://undici.nodejs.org

README.md

@@ -86,6 +86,21 @@ steps:
     dotnet-channel: LTS
 ```
 
+## Using the `skip-lts-prepass` input
+
+By default, `setup-dotnet` installs a minimal LTS runtime before installing the requested `dotnet-version`, to guarantee a stable `dotnet` executable is available. If your workflow doesn't need this safeguard (for example, the runner image already has a `dotnet` executable, or you're on a clean self-hosted/container environment and want to avoid the extra download), set `skip-lts-prepass: true` to install only the requested version.
+
+```yaml
+steps:
+- uses: actions/checkout@v7
+- uses: actions/setup-dotnet@v6
+  with:
+    dotnet-version: '9.0.x'
+    skip-lts-prepass: true
+```
+
+> **Note**: Setting skip-lts-prepass: true skips the LTS runtime pre-pass, so the action won't proactively install the latest LTS runtime. The existing dotnet executable and host components will be used if present; on a clean machine, they will come from the requested SDK installation. Consequently, dotnet --info may report a different Host: Version than when the pre-pass runs.
+
 ## Using the `architecture` input
 Using the architecture input, it is possible to specify the required .NET SDK architecture. Possible values:  `x64`, `x86`, `arm64`, `amd64`, `arm`, `s390x`, `ppc64le`, `riscv64`. If the input is not specified, the architecture defaults to the host OS architecture (not all of the architectures are available on all platforms).
 

__tests__/installer.test.ts

@@ -1218,6 +1218,135 @@ describe('installer tests', () => {
           }
         );
       });
+
+      describe('skip-lts-prepass tests', () => {
+        it('should run the LTS pre-pass by default (skip-lts-prepass not set)', async () => {
+          const inputVersion = '9.0.100';
+          const inputQuality = '';
+          const stdout = `Fictitious dotnet version ${inputVersion} is installed`;
+
+          getExecOutputSpy.mockImplementation(() => {
+            return Promise.resolve({exitCode: 0, stdout, stderr: ''});
+          });
+          maxSatisfyingSpy.mockImplementation(() => inputVersion);
+
+          const dotnetInstaller = new installer.DotnetCoreInstaller(
+            inputVersion,
+            inputQuality
+          );
+          await dotnetInstaller.installDotnet();
+
+          expect(getExecOutputSpy).toHaveBeenCalledTimes(2);
+          const ltsCallArguments = (
+            getExecOutputSpy.mock.calls[0][1] as string[]
+          ).join(' ');
+          expect(ltsCallArguments).toContain(
+            IS_WINDOWS ? '-Channel LTS' : '--channel LTS'
+          );
+        });
+
+        it('should skip the LTS pre-pass and install only the requested version when skip-lts-prepass is true', async () => {
+          const inputVersion = '9.0.100';
+          const inputQuality = '';
+          const stdout = `Fictitious dotnet version ${inputVersion} is installed`;
+
+          getExecOutputSpy.mockImplementation(() => {
+            return Promise.resolve({exitCode: 0, stdout, stderr: ''});
+          });
+          maxSatisfyingSpy.mockImplementation(() => inputVersion);
+
+          const dotnetInstaller = new installer.DotnetCoreInstaller(
+            inputVersion,
+            inputQuality,
+            undefined,
+            undefined,
+            true,
+            undefined,
+            undefined,
+            true
+          );
+          const installedVersion = await dotnetInstaller.installDotnet();
+
+          expect(getExecOutputSpy).toHaveBeenCalledTimes(1);
+          const scriptArguments = (
+            getExecOutputSpy.mock.calls[0][1] as string[]
+          ).join(' ');
+          expect(scriptArguments).not.toContain('LTS');
+          expect(scriptArguments).toContain(
+            IS_WINDOWS
+              ? `-Version ${inputVersion}`
+              : `--version ${inputVersion}`
+          );
+          expect(installedVersion).toBe(inputVersion);
+        });
+
+        it('should skip the LTS pre-pass for a cross-architecture install', async () => {
+          const inputVersion = '9.0.100';
+          const inputQuality = '';
+          const inputArchitecture =
+            installer.normalizeArch(os.arch()) === 'x64' ? 'arm64' : 'x64';
+          const stdout = `Fictitious dotnet version ${inputVersion} is installed`;
+
+          getExecOutputSpy.mockImplementation(() => {
+            return Promise.resolve({exitCode: 0, stdout, stderr: ''});
+          });
+          maxSatisfyingSpy.mockImplementation(() => inputVersion);
+
+          const dotnetInstaller = new installer.DotnetCoreInstaller(
+            inputVersion,
+            inputQuality,
+            inputArchitecture,
+            undefined,
+            true,
+            undefined,
+            undefined,
+            true
+          );
+          await dotnetInstaller.installDotnet();
+
+          expect(getExecOutputSpy).toHaveBeenCalledTimes(1);
+          const scriptArguments = (
+            getExecOutputSpy.mock.calls[0][1] as string[]
+          ).join(' ');
+          expect(scriptArguments).not.toContain('LTS');
+          expect(scriptArguments).toContain(
+            IS_WINDOWS ? '-Architecture' : '--architecture'
+          );
+        });
+
+        it('should skip the LTS pre-pass for each requested version', async () => {
+          const inputQuality = '';
+
+          getExecOutputSpy.mockImplementation(() => {
+            return Promise.resolve({
+              exitCode: 0,
+              stdout: `Fictitious dotnet version installed`,
+              stderr: ''
+            });
+          });
+          maxSatisfyingSpy.mockImplementation(() => '9.0.100');
+
+          for (const version of ['8.0.100', '9.0.100']) {
+            const dotnetInstaller = new installer.DotnetCoreInstaller(
+              version,
+              inputQuality,
+              undefined,
+              undefined,
+              true,
+              undefined,
+              undefined,
+              true
+            );
+            await dotnetInstaller.installDotnet();
+          }
+
+          // 2 versions x 1 call each (no LTS pre-pass call for either)
+          expect(getExecOutputSpy).toHaveBeenCalledTimes(2);
+          for (const call of getExecOutputSpy.mock.calls) {
+            expect((call[1] as string[]).join(' ')).not.toContain('LTS');
+          }
+        });
+      });
     });
 
     describe('addToPath() tests', () => {

__tests__/setup-dotnet.test.ts

@@ -315,6 +315,44 @@ describe('setup-dotnet tests', () => {
       expect(capturedCheckLatest).toBe(false);
     });
 
+    it("should read the 'skip-lts-prepass' input and pass it to DotnetCoreInstaller", async () => {
+      inputs['dotnet-version'] = ['10.0.101'];
+      inputs['dotnet-quality'] = '';
+      inputs['architecture'] = '';
+      inputs['skip-lts-prepass'] = 'true';
+
+      let capturedSkipLtsPrepass: boolean | undefined;
+      installDotnetSpy.mockImplementation(function (this: any) {
+        capturedSkipLtsPrepass = this.skipLtsPrepass;
+        return Promise.resolve('');
+      });
+
+      await setup.run();
+
+      expect(getBooleanInputSpy).toHaveBeenCalledWith('skip-lts-prepass');
+      expect(installDotnetSpy).toHaveBeenCalledTimes(1);
+      expect(capturedSkipLtsPrepass).toBe(true);
+    });
+
+    it("should default 'skip-lts-prepass' to false when the input isn't set", async () => {
+      inputs['dotnet-version'] = ['10.0.101'];
+      inputs['dotnet-quality'] = '';
+      inputs['architecture'] = '';
+      inputs['skip-lts-prepass'] = '';
+
+      let capturedSkipLtsPrepass: boolean | undefined;
+      installDotnetSpy.mockImplementation(function (this: any) {
+        capturedSkipLtsPrepass = this.skipLtsPrepass;
+        return Promise.resolve('');
+      });
+
+      await setup.run();
+
+      expect(getBooleanInputSpy).toHaveBeenCalledWith('skip-lts-prepass');
+      expect(installDotnetSpy).toHaveBeenCalledTimes(1);
+      expect(capturedSkipLtsPrepass).toBe(false);
+    });
+
     describe("'check-latest' resolution", () => {
       const captureCheckLatest = async () => {
         inputs['dotnet-version'] = ['10.0.101'];

action.yml

@@ -14,6 +14,10 @@ inputs:
   dotnet-channel:
     description: 'Optional channel for the installation. The possible values are: STS, LTS, A.B (e.g. 8.0), A.B.Cxx (e.g. 8.0.1xx, available since 5.0). To be used with "dotnet-version: latest".'
     required: false
+  skip-lts-prepass:
+    description: 'Optional. When true, skips the LTS runtime pre-pass and installs only the requested dotnet-version. Default: false.'
+    required: false
+    default: false
   global-json-file:
     description: 'Optional global.json location, if your global.json isn''t located in the root of the repo.'
     required: false

package-lock.json

@@ -2888,9 +2888,9 @@
       "license": "Apache-2.0"
     },
     "node_modules/brace-expansion": {
-      "version": "5.0.9",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.9.tgz",
-      "integrity": "sha512-ScQ4IuvIEF1TMlP7Zt+vjJ//9zlPb2SDcxWxM3bk8s6t6GGdJ7KO1dCcTidOPJKePW30LE/2cT7wCyPho9/Wxg==",
+      "version": "5.0.12",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz",
+      "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==",
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^4.0.2"
@@ -4035,9 +4035,9 @@
       "license": "MIT"
     },
     "node_modules/glob/node_modules/brace-expansion": {
-      "version": "2.1.4",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.4.tgz",
-      "integrity": "sha512-hGfVzPxthbf3+2yjg/RBs60cB0FhqBS/zvdV/4wn4/BmN0bNMMHPc4V/BbFieqf1TKAGGAHnY4eSjajCl0f2Xg==",
+      "version": "2.1.7",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.7.tgz",
+      "integrity": "sha512-uZbew1NqdmPDTMJ8ah1y+b+9QEJrfkXFk3RcTQw3X0jW/xRUvFKsg1CfQdSYGdTbXZWExtU3J3ccxtnfw1Fi0g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -4087,13 +4087,13 @@
       "dev": true
     },
     "node_modules/handlebars": {
-      "version": "4.7.9",
-      "resolved": "https://registry.npmjs.org/handlebars/-/handlebars-4.7.9.tgz",
-      "integrity": "sha512-4E71E0rpOaQuJR2A3xDZ+GM1HyWYv1clR58tC8emQNeQe3RH7MAzSbat+V0wG78LQBo6m6bzSG/L4pBuCsgnUQ==",
+      "version": "4.7.10",
+      "resolved": "https://registry.npmjs.org/handlebars/-/handlebars-4.7.10.tgz",
+      "integrity": "sha512-P5VJMVM7qgBn6vjXMw8WG9uVI+ncf2pi72j4de4yz5ZULLj2RGqLYaKOYGsgyrViQ0tePOVlN1tDCCXXtFqXKg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "minimist": "^1.2.5",
+        "minimist": "^1.2.8",
         "neo-async": "^2.6.2",
         "source-map": "^0.6.1",
         "wordwrap": "^1.0.0"
@@ -4108,6 +4108,16 @@
         "uglify-js": "^3.1.4"
       }
     },
+    "node_modules/handlebars/node_modules/minimist": {
+      "version": "1.2.8",
+      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.8.tgz",
+      "integrity": "sha512-2yyAR8qBkN3YuheJanUpWC5U3bb5osDywNB8RzDVlDwDHbocAJveqqj1u8+SVD7jkWT4yvsHCpWqqWqAxb0zCA==",
+      "dev": true,
+      "license": "MIT",
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
     "node_modules/has-flag": {
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
@@ -5246,9 +5256,9 @@
       "license": "MIT"
     },
     "node_modules/minimatch/node_modules/brace-expansion": {
-      "version": "1.1.18",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.18.tgz",
-      "integrity": "sha512-Edep/X9fGqVNmzKBVsDYIOtD+z1tuezV70LBjdCst9Tqu76lsnvRiZ6oTic1n+/BIwX6QDGAO94PN4N2SADvtw==",
+      "version": "1.1.21",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.21.tgz",
+      "integrity": "sha512-9zeA+KLZNNzglF2TPKRQEDyx6Yby7daAkuy8MiPzpXPsYDWi/DRM8jmwUDxokQjYqBpv5DgPiwD4h4ZZSy1Ujw==",
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^1.0.0",
@@ -6356,9 +6366,9 @@
       }
     },
     "node_modules/undici": {
-      "version": "6.28.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-6.28.0.tgz",
-      "integrity": "sha512-LIY910g9TI13YS95lrMFrs8Rm/u/irgHeTWoKCoteeJ04CUJ92eEfj0rVn+7VKMPBpUPiUoBKfhNyLI23EE/KA==",
+      "version": "6.29.1",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-6.29.1.tgz",
+      "integrity": "sha512-EvRlUt/QqAEvXdQeRMYUfwOQsfzpDztykrG2owGEE/rBOBoYv9uF39ZzsNDh4lTFHhTr2XOZjKkYgueD12ZmGA==",
       "license": "MIT",
       "engines": {
         "node": ">=18.17"

src/installer.ts

@@ -421,7 +421,8 @@ export class DotnetCoreInstaller {
     private dotnetChannel?: string,
     private checkLatest: boolean = true,
     private minimumVersion?: string,
-    private rollForward?: string
+    private rollForward?: string,
+    private skipLtsPrepass: boolean = false
   ) {
     this.version = version.trim();
   }
@@ -720,29 +721,34 @@ export class DotnetCoreInstaller {
       : [];
     /**
      * Install dotnet runtime first in order to get
-     * the latest stable version of dotnet CLI
+     * the latest stable version of dotnet CLI.
+     * Opt-out via skip-lts-prepass when this safeguard isn't needed.
      */
-    const runtimeInstallOutput = await new DotnetInstallScript()
-      .useArchitecture(this.architecture)
-      // If dotnet CLI is already installed - avoid overwriting it
-      .useArguments(
-        IS_WINDOWS ? '-SkipNonVersionedFiles' : '--skip-non-versioned-files'
-      )
-      // Install only runtime + CLI
-      .useArguments(IS_WINDOWS ? '-Runtime' : '--runtime', 'dotnet')
-      // Use latest stable version
-      .useArguments(IS_WINDOWS ? '-Channel' : '--channel', 'LTS')
-      .useArguments(...architectureArguments)
-      .execute();
+    if (!this.skipLtsPrepass) {
+      const runtimeInstallOutput = await new DotnetInstallScript()
+        .useArchitecture(this.architecture)
+        // If dotnet CLI is already installed - avoid overwriting it
+        .useArguments(
+          IS_WINDOWS ? '-SkipNonVersionedFiles' : '--skip-non-versioned-files'
+        )
+        // Install only runtime + CLI
+        .useArguments(IS_WINDOWS ? '-Runtime' : '--runtime', 'dotnet')
+        // Use latest stable version
+        .useArguments(IS_WINDOWS ? '-Channel' : '--channel', 'LTS')
+        .useArguments(...architectureArguments)
+        .execute();
 
-    if (runtimeInstallOutput.exitCode) {
-      /**
-       * dotnetInstallScript will install CLI and runtime even if previous script haven't succeded,
-       * so at this point it's too early to throw an error
-       */
-      core.warning(
-        `Failed to install dotnet runtime + cli, exit code: ${runtimeInstallOutput.exitCode}. ${runtimeInstallOutput.stderr}`
-      );
+      if (runtimeInstallOutput.exitCode) {
+        /**
+         * dotnetInstallScript will install CLI and runtime even if previous script haven't succeded,
+         * so at this point it's too early to throw an error
+         */
+        core.warning(
+          `Failed to install dotnet runtime + cli, exit code: ${runtimeInstallOutput.exitCode}. ${runtimeInstallOutput.stderr}`
+        );
+      }
+    } else {
+      core.info('Skipping LTS runtime pre-pass (skip-lts-prepass: true).');
     }
 
     /**

src/setup-dotnet.ts

@@ -130,6 +130,8 @@ export async function run() {
         );
       }
 
+      const skipLtsPrepass = core.getBooleanInput('skip-lts-prepass');
+
       let dotnetInstaller: DotnetCoreInstaller;
       const uniqueVersions = new Set<string>(
         versions.map(v => (v.toLowerCase() === 'latest' ? 'latest' : v))
@@ -143,7 +145,8 @@ export async function run() {
           version.toLowerCase() === 'latest' ? dotnetChannel : undefined,
           checkLatest,
           constraint?.minimumVersion,
-          constraint?.rollForward
+          constraint?.rollForward,
+          skipLtsPrepass
         );
         const installedVersion = await dotnetInstaller.installDotnet();
         installedDotnetVersions.push(installedVersion);