From 869ebbce46147fd478d09fd562a55c66463a8d51 Mon Sep 17 00:00:00 2001 From: Peter Steinberger Date: Thu, 19 Feb 2026 16:33:28 +0100 Subject: [PATCH] fix(ci): verify actionlint release checksum before install --- .github/workflows/workflow-sanity.yml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/workflows/workflow-sanity.yml b/.github/workflows/workflow-sanity.yml index 4629db63f8..8f13df1b72 100644 --- a/.github/workflows/workflow-sanity.yml +++ b/.github/workflows/workflow-sanity.yml @@ -53,8 +53,12 @@ jobs: set -euo pipefail ACTIONLINT_VERSION="1.7.11" archive="actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz" - curl -sSfL "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/${archive}" | tar -xz actionlint - sudo mv actionlint /usr/local/bin/actionlint + base_url="https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}" + curl -sSfL -o "${archive}" "${base_url}/${archive}" + curl -sSfL -o checksums.txt "${base_url}/checksums.txt" + grep " ${archive}\$" checksums.txt | sha256sum -c - + tar -xzf "${archive}" actionlint + sudo install -m 0755 actionlint /usr/local/bin/actionlint - name: Lint workflows run: actionlint