Skip to content

feat(install): verify downloaded archives against pinned checksums #88

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
potiuk wants to merge 2 commits into
base: main
Choose a base branch
from
Open

feat(install): verify downloaded archives against pinned checksums #88

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
cb49c63
feat(install): verify the downloaded archive against its .sha512
potiuk Oct 31, 2026
c856524
feat(install): pin archive checksums in the repository
potiuk Oct 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions .github/workflows/sync-git-cliff-version.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,19 @@ jobs:
set -euo pipefail
sed -i "s|${CURRENT}|${LATEST}|g" action.yml
sed -i "s|${CURRENT}|${LATEST}|g" README.md
- name: Pin checksums
if: steps.latest.outputs.version != steps.current.outputs.version
env:
LATEST: ${{ steps.latest.outputs.version }}
run: |
set -euo pipefail
# GitHub computes a SHA-256 digest for every uploaded release asset.
CHECKSUMS=$(curl -s --fail "https://api.github.com/repos/orhun/git-cliff/releases/tags/${LATEST}" |
jq -r '.assets[] | select(.name | test("\\.(tar\\.gz|zip)$")) |
if (.digest // "" | startswith("sha256:")) then "\(.digest | ltrimstr("sha256:")) \(.name)"
else error("missing digest for \(.name)") end')
[[ -n "${CHECKSUMS}" ]]
echo "${CHECKSUMS}" >> checksums.sha256
- name: Create PR
if: steps.latest.outputs.version != steps.current.outputs.version
env:
Expand All @@ -57,6 +70,7 @@ jobs:
git checkout -B "${BRANCH}"
git add action.yml
git add README.md
git add checksums.sha256
git commit -m "${TITLE}" || echo "Nothing to commit"
git push origin "${BRANCH}" --force

Expand Down
2 changes: 1 addition & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ This action generates a changelog based on your Git history using [git-cliff](ht

### Input variables

- `version`: `git-cliff` version to use. (e.g. `"latest"`, `"v2.14.2"`)
- `version`: `git-cliff` version to use. (e.g. `"latest"`, `"v2.14.2"`) The downloaded archive must match a SHA-256 checksum pinned in [`checksums.sha256`](checksums.sha256), otherwise the action fails. New releases are pinned by the weekly version-sync workflow.
- `config`: Path of the configuration file. (Default: `"cliff.toml"`)
- `args`: [Arguments](https://github.com/orhun/git-cliff#usage) to pass to git-cliff. (Default: `"-v"`)
- `github_token`: The GitHub API token used to download `git-cliff` and to authenticate git-cliff's [GitHub integration](https://git-cliff.org/docs/integration/github) (e.g. extracting usernames, contributors, PR links) to avoid rate limits. Requires a classic or fine-grained token without permissions.
Expand Down
Loading