Safe-output integrity guards repeatedly read and hash full bundles for unrelated Git commands #68789

Summary

Review of #68732 at commit 40c71f95ad05d3f2da56bc19e38e3f041495f7e9 found a P2 performance regression: every guarded command checks the entirety of every captured artifact before and after execution, including commands that do not read a transport file.

Location

actions/setup/js/transport_integrity.cjs:52–63,114–125

Reproduction and evidence

With an 8 MiB captured bundle and an existing private snapshot, execute 100 guarded mocked git rev-parse HEAD calls.

Instrumenting fs.readFileSync observed:

• 600 file reads across the captured patch, original bundle, and bundle snapshot.
• Approximately 3,200 MiB of file reads.
• Additional repeated SHA-256 hashing of the captured in-memory bundle, not included in the file-read total.

The local probe took approximately 1.8 seconds despite the Git commands themselves being no-ops. Actual impact scales with artifact size and command count; history-bearing bundles can be substantially larger than their patch preview.

Expected behavior

Preserve validation/application integrity without repeatedly scanning full transport artifacts around every unrelated local command.

Suggested fix and coverage

Review the necessary trust boundaries for full integrity checks, retain publication/apply protections, and avoid recomputing digests of unchanged captured buffers. Do not replace byte-integrity guarantees with metadata-only checks.

Add deterministic instrumentation-based tests that bound full-file reads and digest work for repeated unrelated commands, plus realistic large-bundle coverage.

No fix was applied.