fix: replace package installation with files copying

install-internal-package/action.yml

@@ -31,7 +31,7 @@ runs:
       working-directory: ${{ inputs.working-directory }}
       run: |
         npm pack @devexpress/devextreme-internal@${{ steps.devextreme_version.outputs.version }} --registry https://npm.pkg.github.com
-        echo "packageFile=$(find . -name devexpress-devextreme-internal-*.tgz)" >> $GITHUB_OUTPUT
+        echo "packageFile=$(find . -maxdepth 1 -name 'devexpress-devextreme-internal-*.tgz' -print -quit)" >> $GITHUB_OUTPUT
 
     - name: Check if DevExtreme File is Downloaded
       if: steps.download_devextreme.outputs.packageFile == ''
@@ -40,11 +40,9 @@ runs:
       run: exit 1
 
     - name: Install Internal devextreme Package
-      env:
-        PACKAGE_FILE: ${{ steps.download_devextreme.outputs.packageFile }}
       shell: bash
       working-directory: ${{ inputs.working-directory }}
-      run: npm i devextreme@$PACKAGE_FILE
+      run: node "$GITHUB_ACTION_PATH/replace-package.js" devextreme "${{ steps.download_devextreme.outputs.packageFile }}"
 
     - name: Download Internal devextreme-dist Package
       if: inputs.install-dist
@@ -53,7 +51,7 @@ runs:
       working-directory: ${{ inputs.working-directory }}
       run: |
         npm pack @devexpress/devextreme-dist-internal@${{ steps.devextreme_version.outputs.version }} --registry https://npm.pkg.github.com
-        echo "packageFile=$(find . -name devexpress-devextreme-dist-internal-*.tgz)" >> $GITHUB_OUTPUT
+        echo "packageFile=$(find . -maxdepth 1 -name 'devexpress-devextreme-dist-internal-*.tgz' -print -quit)" >> $GITHUB_OUTPUT
 
     - name: Check if DevExtreme-Dist File is Downloaded
       if: inputs.install-dist && steps.download_devextreme_dist.outputs.packageFile == ''
@@ -63,8 +61,6 @@ runs:
 
     - name: Install Internal devextreme-dist Package
       if: inputs.install-dist
-      env:
-        PACKAGE_FILE: ${{ steps.download_devextreme_dist.outputs.packageFile }}
       shell: bash
       working-directory: ${{ inputs.working-directory }}
-      run: npm i devextreme-dist@$PACKAGE_FILE
+      run: node "$GITHUB_ACTION_PATH/replace-package.js" devextreme-dist "${{ steps.download_devextreme_dist.outputs.packageFile }}"

install-internal-package/replace-package.js

@@ -0,0 +1,36 @@
+const assert = require('node:assert');
+const { execFileSync } = require('node:child_process');
+const { rmSync, mkdirSync, lstatSync, unlinkSync } = require('node:fs');
+const { join } = require('node:path');
+const { createRequire } = require('node:module');
+
+const [packageName, packageFile] = process.argv.slice(2);
+
+assert(packageName && packageFile, 'Usage: node replace-package.js <package-name> <package-file>');
+
+const cwdRequire = createRequire(process.cwd() + '/');
+
+let entryPath;
+for (const searchDir of cwdRequire.resolve.paths(packageName) || []) {
+  const candidate = join(searchDir, packageName);
+  if (lstatSync(candidate, { throwIfNoEntry: false })) {
+    entryPath = candidate;
+    break;
+  }
+}
+
+assert(entryPath, `Package "${packageName}" is not installed. It must be installed before it can be replaced.`);
+
+if (lstatSync(entryPath).isSymbolicLink()) {
+  unlinkSync(entryPath);
+} else {
+  rmSync(entryPath, { recursive: true, force: true });
+}
+
+mkdirSync(entryPath, { recursive: true });
+
+const listing = execFileSync('tar', ['-tzf', packageFile]).toString();
+const unsafeEntry = listing.split('\n').find(e => e.includes('..') || e.startsWith('/'));
+assert(!unsafeEntry, `Archive contains unsafe path: ${unsafeEntry}`);
+
+execFileSync('tar', ['-xzf', packageFile, '-C', entryPath, '--strip-components=1']);