fs: default writeSecureFile to 0600 (owner-only)

dist/fs.d.ts

@@ -18,13 +18,13 @@ export declare function forceRemove(pth: PathLike): Promise<void>;
  */
 export declare function isEmptyDir(dir: PathLike): Promise<boolean>;
 /**
- * writeSecureFile writes a file to disk with 0640 permissions and locks the
+ * writeSecureFile writes a file to disk with 0600 permissions and locks the
  * file during writing.
  *
  * @param outputPath Path in which to create the secure file.
  * @param data Data to write to file.
  * @param options additional options to pass to writeFile. The default options
- * are permissions of 0640, write-exclusive, and flush-on-success.
+ * are permissions of 0600, write-exclusive, and flush-on-success.
  *
  * @returns Path to written file.
  */

docs/fs/functions/writeSecureFile.md

@@ -10,7 +10,7 @@
 
 Defined in: [fs.ts:68](https://github.com/google-github-actions/actions-utils/blob/main/src/fs.ts#L68)
 
-writeSecureFile writes a file to disk with 0640 permissions and locks the
+writeSecureFile writes a file to disk with 0600 permissions and locks the
 file during writing.
 
 ## Type Parameters
@@ -38,7 +38,7 @@ Data to write to file.
 `ObjectEncodingOptions` & `object`
 
 additional options to pass to writeFile. The default options
-are permissions of 0640, write-exclusive, and flush-on-success.
+are permissions of 0600, write-exclusive, and flush-on-success.
 
 ## Returns
 

src/fs.ts

@@ -55,13 +55,13 @@ export async function isEmptyDir(dir: PathLike): Promise<boolean> {
 }
 
 /**
- * writeSecureFile writes a file to disk with 0640 permissions and locks the
+ * writeSecureFile writes a file to disk with 0600 permissions and locks the
  * file during writing.
  *
  * @param outputPath Path in which to create the secure file.
  * @param data Data to write to file.
  * @param options additional options to pass to writeFile. The default options
- * are permissions of 0640, write-exclusive, and flush-on-success.
+ * are permissions of 0600, write-exclusive, and flush-on-success.
  *
  * @returns Path to written file.
  */
@@ -74,7 +74,7 @@ export async function writeSecureFile<T extends PathLike>(
     flush?: boolean;
   },
 ): Promise<T> {
-  const opts = Object.assign({}, { mode: 0o640, flag: 'wx', flush: true }, options);
+  const opts = Object.assign({}, { mode: 0o600, flag: 'wx', flush: true }, options);
   await fs.writeFile(outputPath, data, opts);
   return outputPath;
 }

tests/fs.test.ts

@@ -85,14 +85,14 @@ describe('fs', { concurrency: true }, async () => {
 
       if (process.platform !== 'win32') {
         const stats = await fs.stat(filepath);
-        assert.deepStrictEqual(stats.mode.toString(8), '100640');
+        assert.deepStrictEqual(stats.mode.toString(8), '100600');
       }
     });
 
     await suite.test('writes a file with custom options', async () => {
       const filepath = randomFilepath();
       const result = await writeSecureFile(filepath, 'my data', {
-        mode: 0o600,
+        mode: 0o700,
         encoding: 'utf8',
       });
       assert.deepStrictEqual(filepath, result);
@@ -102,7 +102,7 @@ describe('fs', { concurrency: true }, async () => {
 
       if (process.platform !== 'win32') {
         const stats = await fs.stat(filepath);
-        assert.deepStrictEqual(stats.mode.toString(8), '100600');
+        assert.deepStrictEqual(stats.mode.toString(8), '100700');
       }
     });
   });