fix: correct v2.0.1 sha256s and harden update-formula sha256 validation

- Replace garbage 'Not' sha256 values (committed from 404 response) with
  the real v2.0.1 checksums:
    darwin-arm64:  435a330e3b2f9ad987740ef01be04445b823757fe83fb3a2620f836acbf6fce7
    linux-x86_64:  426eacde20837835674cd04397caa2407bd1e2a4f41bda738254b41298e4da9d
- Switch curl to -f so HTTP 4xx/5xx errors are fatal (prevents silent 404 body capture)
- Add regex validation: abort with a clear error if the downloaded sha256 is
  not exactly 64 lowercase hex chars, preventing garbage commits like 7989b4a

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: crimson-knight

.github/workflows/update-formula.yml

@@ -24,14 +24,31 @@ jobs:
         CLEAN_VERSION="${VERSION#v}"
         echo "version=${CLEAN_VERSION}" >> $GITHUB_OUTPUT
 
-        # Download checksums
+        # Download checksums — fail if assets return 404 or content is not a 64-char hex string
         BASE_URL="https://github.com/amberframework/amber_cli/releases/download/${VERSION}"
 
-        curl -sL "${BASE_URL}/amber_cli-darwin-arm64.tar.gz.sha256" -o darwin.sha256
-        curl -sL "${BASE_URL}/amber_cli-linux-x86_64.tar.gz.sha256" -o linux.sha256
-
-        echo "darwin_sha256=$(cut -d' ' -f1 < darwin.sha256)" >> $GITHUB_OUTPUT
-        echo "linux_sha256=$(cut -d' ' -f1 < linux.sha256)" >> $GITHUB_OUTPUT
+        curl -fsSL "${BASE_URL}/amber_cli-darwin-arm64.tar.gz.sha256" -o darwin.sha256 || {
+          echo "ERROR: failed to download darwin sha256 for ${VERSION}" >&2; exit 1
+        }
+        curl -fsSL "${BASE_URL}/amber_cli-linux-x86_64.tar.gz.sha256" -o linux.sha256 || {
+          echo "ERROR: failed to download linux sha256 for ${VERSION}" >&2; exit 1
+        }
+
+        DARWIN_SHA="$(cut -d' ' -f1 < darwin.sha256)"
+        LINUX_SHA="$(cut -d' ' -f1 < linux.sha256)"
+
+        # Validate: must be exactly 64 lowercase hex characters
+        if ! echo "${DARWIN_SHA}" | grep -qE '^[0-9a-f]{64}$'; then
+          echo "ERROR: darwin sha256 is not a valid 64-char hex string: '${DARWIN_SHA}'" >&2
+          exit 1
+        fi
+        if ! echo "${LINUX_SHA}" | grep -qE '^[0-9a-f]{64}$'; then
+          echo "ERROR: linux sha256 is not a valid 64-char hex string: '${LINUX_SHA}'" >&2
+          exit 1
+        fi
+
+        echo "darwin_sha256=${DARWIN_SHA}" >> $GITHUB_OUTPUT
+        echo "linux_sha256=${LINUX_SHA}" >> $GITHUB_OUTPUT
 
     - name: Update formula
       env:

Formula/amber_cli.rb

@@ -14,14 +14,14 @@ class AmberCli < Formula
   on_macos do
     if Hardware::CPU.arm?
       url "https://github.com/amberframework/amber_cli/releases/download/v2.0.1/amber_cli-darwin-arm64.tar.gz"
-      sha256 "Not"
+      sha256 "435a330e3b2f9ad987740ef01be04445b823757fe83fb3a2620f836acbf6fce7"
     end
   end
 
   on_linux do
     if Hardware::CPU.intel?
       url "https://github.com/amberframework/amber_cli/releases/download/v2.0.1/amber_cli-linux-x86_64.tar.gz"
-      sha256 "Not"
+      sha256 "426eacde20837835674cd04397caa2407bd1e2a4f41bda738254b41298e4da9d"
     end
   end