actions-mirror/ruff-action
1
0
Fork 0
mirror of https://github.com/astral-sh/ruff-action.git synced 2026-09-19 10:51:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

Use JSON for known checksums (#415)

Browse Source 
Ports the hardening from astral-sh/setup-uv#1025 to ruff-action.\n\nThis
stores generated checksums as JSON data behind a small typed TypeScript
wrapper, preventing values sourced from release metadata from being
mixed into generated executable code. It also updates the checksum
workflow and packaged action artifacts, and adds a regression test for
code-like keys and escaped checksum values.\n\nTests: npm run build, npm
run check, npm test, npm run package
This commit is contained in:
eifinger-bot
2026-08-28 16:15:05 -04:00
committed by GitHub
parent 6d5deb5cee
commit 127e6a115e
10 changed files with 6692 additions and 6659 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/update-known-checksums.yml
+1 -1
View File
@@ -22,7 +22,7 @@ jobs:
id: update-known-checksums
run:
node dist/update-known-checksums/index.cjs
src/download/checksum/known-checksums.ts ${{ secrets.GITHUB_TOKEN }}
src/download/checksum/known-checksums.json ${{ secrets.GITHUB_TOKEN }}
- run: npm ci --ignore-scripts && npm run all
- name: Create Pull Request
uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1