ci: verify codecov script before using it

martanne · Apr 20, 2021 · c452759 · c452759
1 parent cbd23b9
commit c452759
Show file tree

Hide file tree

Showing 3 changed files with 22 additions and 3 deletions.
diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
@@ -49,4 +49,10 @@ jobs:
       env:
         CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
       run: |
-        bash <(curl -s https://codecov.io/bash)
+        curl -s https://codecov.io/bash > codecov
+        curl -s https://raw.githubusercontent.com/codecov/codecov-bash/master/SHA256SUM > codecov.sha256
+        if ! sha256sum -c --ignore-missing --status codecov.sha256 ; then
+          echo "Download checksum verification failed"
+          exit 1
+        fi
+        bash < codecov
diff --git a/.github/workflows/ubuntu.yml b/.github/workflows/ubuntu.yml
@@ -55,4 +55,10 @@ jobs:
       env:
         CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
       run: |
-        bash <(curl -s https://codecov.io/bash)
+        curl -s https://codecov.io/bash > codecov
+        curl -s https://raw.githubusercontent.com/codecov/codecov-bash/master/SHA256SUM > codecov.sha256
+        if ! sha256sum -c --ignore-missing --status codecov.sha256 ; then
+          echo "Download checksum verification failed"
+          exit 1
+        fi
+        bash < codecov
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
@@ -54,4 +54,11 @@ jobs:
       shell: bash
       env:
         CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-      run: bash <(curl -s https://codecov.io/bash)
+      run: |
+        curl -s https://codecov.io/bash > codecov
+        curl -s https://raw.githubusercontent.com/codecov/codecov-bash/master/SHA256SUM > codecov.sha256
+        if ! sha256sum -c --ignore-missing --status codecov.sha256 ; then
+          echo "Download checksum verification failed"
+          exit 1
+        fi
+        bash < codecov