feat(action): Verify checksum and version after installing relune#131
Merged
Conversation
- Validate downloaded archive against checksums.txt (sha256, with sha256sum/shasum fallback) - Reject missing or duplicated checksum entries - Confirm extracted archive contains a relune binary - Run `relune --version` post-install and assert it matches the requested version - Document the new checksum-mismatch failure mode in action/README.md
Code Metrics Report
Details | | main (ec8eaf5) | #131 (462b869) | +/- |
|---------------------|----------------|----------------|------|
| Coverage | 94.8% | 94.8% | 0.0% |
| Files | 81 | 81 | 0 |
| Lines | 39175 | 39175 | 0 |
| Covered | 37160 | 37160 | 0 |
+ | Test Execution Time | 1m35s | 1m26s | -9s |Reported by octocov |
Schema reviewTip ✅ No risk findings — schema changes look safe to merge. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
checksums.txt(SHA-256, withsha256sum/shasumfallback) before extractingrelune --versionafter install and assert the output matches the requested version, so a stale tool-cache or wrong archive surfaces immediatelyaction/README.md, with an honest caveat that fetchingchecksums.txtfrom the same release URL is not a substitute for signature verificationChanges
checksums.txt, rejecting missing or duplicated entriesrelunebinary before chmod / PATH updaterelune --versionpost-install and fail when the output does not contain the requested version