chore(deps): bump js-yaml from 5.2.3 to 5.4.1 in the npm group

Bumps the npm group with 1 update: [js-yaml](https://github.com/nodeca/js-yaml).


Updates `js-yaml` from 5.2.3 to 5.4.1
- [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md)
- [Commits](https://github.com/nodeca/js-yaml/compare/5.2.3...5.4.1)

---
updated-dependencies:
- dependency-name: js-yaml
  dependency-version: 5.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm
...

Signed-off-by: dependabot[bot] <support@github.com>

README.md

@@ -21,7 +21,6 @@ ___
   * [Signing](#signing)
   * [Upload artifacts](#upload-artifacts)
   * [Install Only](#install-only)
-  * [Cache the binary](#cache-the-binary)
 * [Customizing](#customizing)
   * [inputs](#inputs)
   * [outputs](#outputs)
@@ -218,27 +217,6 @@ steps:
     run: goreleaser -v
 ```
 
-### Cache the binary
-
-The action looks for GoReleaser in the [runner tool cache][toolcache] before it
-downloads. A second use of the action in the same job, or any job on a
-self-hosted runner that already has the version, installs immediately.
-
-A binary taken from the tool cache is not verified again, because the checksum
-and the cosign signature were verified when it was first written. On a
-self-hosted runner the tool cache is kept between jobs, so it must be trusted
-like the runner itself. GitHub-hosted runners start with an empty tool cache in
-every job, so they always download and verify.
-
-The action does not use the [GitHub Actions cache][ghcache]. It was measured and
-it is slower than a download: restoring the 24 MB entry takes about 1.3 s, while
-downloading, verifying the checksum, verifying the cosign signature and
-extracting the release takes about 0.9 s on a GitHub-hosted runner. It would
-also skip the verification it is supposed to protect.
-
-[toolcache]: https://github.com/actions/toolkit/tree/main/packages/tool-cache
-[ghcache]: https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/cache-dependencies
-
 ## Customizing
 
 ### inputs

__tests__/goreleaser.test.ts

@@ -57,38 +57,6 @@ describe('install', () => {
     const bin = await goreleaser.install('goreleaser-pro', 'latest');
     expect(fs.existsSync(bin)).toBe(true);
   }, 100000);
-
-  it('reuses the runner tool cache instead of downloading again', async () => {
-    const first = await goreleaser.install('goreleaser', 'v2.15.3');
-
-    const written: string[] = [];
-    const stdout = process.stdout.write.bind(process.stdout);
-    // eslint-disable-next-line @typescript-eslint/no-explicit-any
-    process.stdout.write = ((chunk: any, ...rest: any[]): boolean => {
-      written.push(chunk.toString());
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      return (stdout as any)(chunk, ...rest);
-    }) as typeof process.stdout.write;
-    let second: string;
-    try {
-      second = await goreleaser.install('goreleaser', 'v2.15.3');
-    } finally {
-      process.stdout.write = stdout;
-    }
-
-    const logs = written.join('');
-    expect(logs).toContain('found in the runner tool cache');
-    expect(logs).not.toContain('Downloading https://github.com/goreleaser');
-    expect(second).toEqual(first);
-    expect(fs.existsSync(second)).toBe(true);
-  }, 100000);
-
-  it('does not share the tool cache between distributions', async () => {
-    const oss = await goreleaser.install('goreleaser', 'v2.15.3');
-    const pro = await goreleaser.install('goreleaser-pro', 'v2.15.3');
-    expect(pro).not.toEqual(oss);
-    expect(fs.existsSync(pro)).toBe(true);
-  }, 100000);
 });
 
 describe('distribSuffix', () => {

package-lock.json

@@ -11,7 +11,7 @@
         "@actions/exec": "^3.0.0",
         "@actions/http-client": "^4.0.1",
         "@actions/tool-cache": "^4.0.0",
-        "js-yaml": "^5.2.3",
+        "js-yaml": "^5.4.1",
         "semver": "^7.8.5",
         "yargs": "^18.1.0"
       },
@@ -4263,9 +4263,9 @@
       "license": "MIT"
     },
     "node_modules/js-yaml": {
-      "version": "5.2.3",
-      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.2.3.tgz",
-      "integrity": "sha512-n+mUVyUX5bVv7G/G2zyIHOhdxfuU1dY2NOFzTQUWiMUbFss8b57NFlgCCaggU78wSw5KVS9cllzeLyzyR+n5nw==",
+      "version": "5.4.1",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.4.1.tgz",
+      "integrity": "sha512-28R/k+NAjeuf7+CKlTxWZVExJGwVVLwY06DgEnOMz2gEpfNkDcD7QvyiVPT0xy0XXhU8vHsd4Ot42OOPdJG7dQ==",
       "funding": [
         {
           "type": "github",

package.json

@@ -28,7 +28,7 @@
     "@actions/exec": "^3.0.0",
     "@actions/http-client": "^4.0.1",
     "@actions/tool-cache": "^4.0.0",
-    "js-yaml": "^5.2.3",
+    "js-yaml": "^5.4.1",
     "semver": "^7.8.5",
     "yargs": "^18.1.0"
   },

src/goreleaser.ts

@@ -11,48 +11,39 @@ import * as tc from '@actions/tool-cache';
 
 export async function install(distribution: string, version: string): Promise<string> {
   const release: github.GitHubRelease = await github.getRelease(distribution, version);
-  const tag = release.tag_name;
-  const toolVersion = tag.replace(/^v/, '');
-
-  const toolPath = tc.find(distribution, toolVersion);
-  if (toolPath) {
-    core.info(`GoReleaser ${tag} found in the runner tool cache: ${toolPath}`);
-    return getExePath(toolPath);
-  }
-
   const filename = getFilename(distribution);
-  const baseUrl = `https://github.com/goreleaser/${distribution}/releases/download/${tag}`;
+  const baseUrl = `https://github.com/goreleaser/${distribution}/releases/download/${release.tag_name}`;
   const downloadUrl = `${baseUrl}/${filename}`;
 
   core.info(`Downloading ${downloadUrl}`);
   const downloadPath: string = await tc.downloadTool(downloadUrl);
   core.debug(`Downloaded to ${downloadPath}`);
 
-  await verifyChecksum(distribution, tag, downloadPath, filename);
+  await verifyChecksum(distribution, release.tag_name, downloadPath, filename);
 
   core.info('Extracting GoReleaser');
   let extPath: string;
   if (context.osPlat == 'win32') {
-    let zipPath = downloadPath;
-    if (!zipPath.endsWith('.zip')) {
-      zipPath = `${downloadPath}.zip`;
-      fs.renameSync(downloadPath, zipPath);
+    if (!downloadPath.endsWith('.zip')) {
+      const newPath = downloadPath + '.zip';
+      fs.renameSync(downloadPath, newPath);
+      extPath = await tc.extractZip(newPath);
+    } else {
+      extPath = await tc.extractZip(downloadPath);
     }
-    extPath = await tc.extractZip(zipPath);
   } else {
     extPath = await tc.extractTar(downloadPath);
   }
   core.debug(`Extracted to ${extPath}`);
 
-  const cachePath: string = await tc.cacheDir(extPath, distribution, toolVersion);
+  const cachePath: string = await tc.cacheDir(extPath, 'goreleaser-action', release.tag_name.replace(/^v/, ''));
   core.debug(`Cached to ${cachePath}`);
 
-  return getExePath(cachePath);
-}
+  const exePath: string = path.join(cachePath, context.osPlat == 'win32' ? 'goreleaser.exe' : 'goreleaser');
+  core.debug(`Exe path is ${exePath}`);
 
-const getExePath = (dir: string): string => {
-  return path.join(dir, context.osPlat == 'win32' ? 'goreleaser.exe' : 'goreleaser');
-};
+  return exePath;
+}
 
 export async function verifyChecksum(
   distribution: string,