Verify the Zig toolchain checksum and pin noz by commit

[kwsantiago]

Summary

The CI toolchain was fetched and executed without any integrity check.

curl -L https://ziglang.org/download/0.16.0/zig-x86_64-linux-0.16.0.tar.xz | tar -xJ

The version was pinned, which is good, but nothing verified the bytes. The archive went straight from the network into tar and then onto PATH as the compiler that builds this relay. Anything able to affect that response, a compromised mirror or an intercepted connection, would have its output compiling and running in CI, and there was no point in the pipeline where a check could have failed. This ran in both jobs.

Now the tarball is downloaded to disk, verified against a pinned SHA-256 published by ziglang.org, and only extracted if it matches:

curl -fsSL --retry 3 -o "$tarball" "https://ziglang.org/download/$ZIG_VERSION/$tarball"
echo "$ZIG_SHA256  $tarball" | sha256sum -c -
tar -xJf "$tarball"

Also adds -f so an HTTP error page is a failure rather than something handed to tar, --retry 3 for transient network faults, and set -euo pipefail so a failing check actually stops the step.

noz pinned by commit

The integration job cloned privkeyio/noz at --branch v0.2.1. A tag is a moving pointer; a commit is not. Now pinned to 848a2e3, which is what v0.2.1 currently resolves to, so this is not a version change. Swapped --depth 1 for --filter=blob:none, since a shallow clone cannot check out an arbitrary commit.

Dependabot

Added for github-actions, weekly and grouped, matching the other repositories. Zig has no Dependabot ecosystem, so build.zig.zon and the toolchain checksum stay manual; the config records that.

Test plan

Verified locally rather than by reading:

• SHA-256 70e49664...ba3d00 confirmed against the actual bytes served (55478392 bytes, matching the published size)
• Full flow run end to end: download, sha256sum -c passes, extract, zig version reports 0.16.0
• Negative control: flipped a single byte at offset 1000000, sha256sum -c reports FAILED and exits 1, so the step aborts before tar runs
• noz pin verified: --filter=blob:none clone plus checkout --detach 848a2e3 succeeds, and v0.2.1 resolves to that same commit
• Both YAML files parse
• Confirmed the Setup Zig block appeared exactly twice before editing, so neither job kept the unverified path

The checksum is per-platform and per-version; changing ZIG_VERSION requires updating ZIG_SHA256 from the same index, and a mismatch fails loudly.

Summary by CodeRabbit

• Chores
  • Added automated weekly checks for GitHub Actions dependencies.
  • Improved build and integration checks with verified tool downloads and retry support.
  • Pinned integration tooling to a specific version for more consistent results.
  • Documented manual tracking requirements for select development dependencies and toolchain updates.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 36ce48b2-b9ae-4e1f-8605-be34ff997673

📥 Commits

Reviewing files that changed from the base of the PR and between 40ec89e and ca8ac46.

📒 Files selected for processing (2)

• .github/dependabot.yml
• .github/workflows/ci.yml

---

Walkthrough

The PR adds weekly Dependabot updates for GitHub Actions. Both CI jobs verify Zig archives before extraction. The integration job checks out noz at the pinned NOZ_COMMIT.

Changes

CI supply-chain hardening

Layer / File(s)	Summary
GitHub Actions update automation .github/dependabot.yml	Dependabot checks GitHub Actions weekly, groups dependencies, and limits open pull requests to five.
Verified Zig installation .github/workflows/ci.yml	Both CI jobs download Zig with retries, verify its SHA-256 checksum, extract it, and update PATH.
Pinned noz checkout .github/workflows/ci.yml	The integration job uses a filtered clone and checks out the pinned NOZ_COMMIT.

Estimated code review effort: 2 (Simple) | ~10 minutes

Poem

A rabbit checks the hash with care,
Then pins noz in its burrow there.
Zig downloads, verified and bright,
Dependabot checks each weeknight.
Safe steps hop through CI light.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the two primary CI changes: Zig checksum verification and pinning noz to a commit.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch harden-toolchain-supply-chain

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}