actions/ruff
1
0
Fork 0
mirror of https://github.com/astral-sh/ruff-action.git synced 2026-09-25 15:20:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

Use JSON for known checksums (#415)

Browse Source 
Ports the hardening from astral-sh/setup-uv#1025 to ruff-action.\n\nThis
stores generated checksums as JSON data behind a small typed TypeScript
wrapper, preventing values sourced from release metadata from being
mixed into generated executable code. It also updates the checksum
workflow and packaged action artifacts, and adds a regression test for
code-like keys and escaped checksum values.\n\nTests: npm run build, npm
run check, npm test, npm run package
This commit is contained in:
eifinger-bot
2026-08-28 16:15:05 -04:00
committed by GitHub
parent 6d5deb5cee
commit 127e6a115e
10 changed files with 6706 additions and 6676 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dist/ruff-action/index.cjs
Generated Vendored
+5 -2
View File
@@ -24769,8 +24769,8 @@ var ASTRAL_MIRROR_PREFIX = "https://releases.astral.sh/github/ruff/releases/down
var crypto3 = __toESM(require("node:crypto"), 1);
var fs4 = __toESM(require("node:fs"), 1);
// src/download/checksum/known-checksums.ts
var KNOWN_CHECKSUMS = {
// src/download/checksum/known-checksums.json
var known_checksums_default = {
"aarch64-apple-darwin-0.16.5": "ed142f8656e0092828c103dd058b55b871c88e13a801cade8f860d8a9ca8943e",
"aarch64-pc-windows-msvc-0.16.5": "30874e50be1f31626022358bbcaa80112ce1065b9297e5a9c4654f0b5a230d39",
"aarch64-unknown-linux-gnu-0.16.5": "796079ea998dba3e455394077ba51a4c500c2402d3920580c646a0580f20370c",
@@ -28094,6 +28094,9 @@ var KNOWN_CHECKSUMS = {
"x86_64-unknown-linux-musl-0.0.247": "d14f59b09a83e3bdba4a54687158534f7c8ae702f8df770b8eaabf4445fb8b60"
};
// src/download/checksum/known-checksums.ts
var KNOWN_CHECKSUMS = known_checksums_default;
// src/download/checksum/checksum.ts
async function validateChecksum(checkSum2, downloadPath, arch3, platform2, version2) {
let isValid;
dist/update-known-checksums/index.cjs
Generated Vendored
+9 -15
View File
@@ -26771,8 +26771,8 @@ function _getGlobal(key, defaultValue) {
return value !== void 0 ? value : defaultValue;
}
// src/download/checksum/known-checksums.ts
var KNOWN_CHECKSUMS = {
// src/download/checksum/known-checksums.json
var known_checksums_default = {
"aarch64-apple-darwin-0.16.5": "ed142f8656e0092828c103dd058b55b871c88e13a801cade8f860d8a9ca8943e",
"aarch64-pc-windows-msvc-0.16.5": "30874e50be1f31626022358bbcaa80112ce1065b9297e5a9c4654f0b5a230d39",
"aarch64-unknown-linux-gnu-0.16.5": "796079ea998dba3e455394077ba51a4c500c2402d3920580c646a0580f20370c",
@@ -30096,28 +30096,22 @@ var KNOWN_CHECKSUMS = {
"x86_64-unknown-linux-musl-0.0.247": "d14f59b09a83e3bdba4a54687158534f7c8ae702f8df770b8eaabf4445fb8b60"
};
// src/download/checksum/known-checksums.ts
var KNOWN_CHECKSUMS = known_checksums_default;
// src/download/checksum/update-known-checksums.ts
async function updateChecksums(filePath, downloadUrls) {
await import_node_fs.promises.rm(filePath);
await import_node_fs.promises.appendFile(
filePath,
"// AUTOGENERATED_DO_NOT_EDIT\nexport const KNOWN_CHECKSUMS: { [key: string]: string } = {\n"
);
let firstLine = true;
const checksums = {};
for (const downloadUrl of downloadUrls) {
const key = getKey(downloadUrl);
if (key === void 0) {
continue;
}
const checksum = await getOrDownloadChecksum(key, downloadUrl);
if (!firstLine) {
await import_node_fs.promises.appendFile(filePath, ",\n");
}
await import_node_fs.promises.appendFile(filePath, ` "${key}":
"${checksum}"`);
firstLine = false;
checksums[key] = checksum;
}
await import_node_fs.promises.appendFile(filePath, ",\n};\n");
await import_node_fs.promises.writeFile(filePath, `${JSON.stringify(checksums, null, 2)}
`);
}
function getKey(downloadUrl) {
const parts = downloadUrl.split("/");