Update setup perl action

[guhetier]

Description

The build CI started to fail with errors like:

Run shogo82148/actions-setup-perl@fa3bdcb0144a50651e317f30949bb4491e74a6e4
install perl
  verifying download: D:\a\_temp\d7077245-f8e5-4d0c-bca6-93c64dc8f837
  Warning: failed to verify attestation: TypeError: Cannot read properties of null (reading 'mediaType'), continue to next attestation
  Warning: failed to verify attestation: TypeError: Cannot read properties of null (reading 'mediaType'), continue to next attestation
Error: Error: failed to verify D:\a\_temp\d7077245-f8e5-4d0c-bca6-93c64dc8f837

https://github.com/microsoft/msquic/actions/runs/22020983438/job/63904220521?pr=5794

This has been fixed in shogo82148/actions-setup-perl#2481.

Update the action to fix the CI.

Testing

CI

Documentation

N/A

[mtfriesen]

LGTM but we need to figure out how to not depend on shogo82148.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 84.78%. Comparing base (ed14762) to head (a4d70bc).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5796      +/-   ##
==========================================
- Coverage   85.99%   84.78%   -1.21%     
==========================================
  Files          60       60              
  Lines       18729    18729              
==========================================
- Hits        16106    15880     -226     
- Misses       2623     2849     +226     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[guhetier]

LGTM but we need to figure out how to not depend on shogo82148.

It seems to be the standard way to install perl in CI. I don't think we have a need / reason to not depend on it in our public CI.

[mtfriesen]

LGTM but we need to figure out how to not depend on shogo82148.

It seems to be the standard way to install perl in CI. I don't think we have a need / reason to not depend on it in our public CI.

Hmm, maybe the more pertinent but ignorant question is "why do we even use perl?" if the rest of the industry seems not to bother supporting it.

In general, we want to take dependencies with both clear support and security policies - if the action is not a first party (GitHub or Microsoft) action, then it becomes a more nuanced decision.

[guhetier]

...

Hmm, maybe the more pertinent but ignorant question is "why do we even use perl?" if the rest of the industry seems not to bother supporting it.

In general, we want to take dependencies with both clear support and security policies - if the action is not a first party (GitHub or Microsoft) action, then it becomes a more nuanced decision.

Perl is needed to build OpenSSL.

[mtfriesen]

Hmm, maybe the more pertinent but ignorant question is "why do we even use perl?" if the rest of the industry seems not to bother supporting it.

Perl is needed to build OpenSSL.

Now it all makes sense! 😆