actions/ruff
1
0
Fork 0
mirror of https://github.com/astral-sh/ruff-action.git synced 2026-09-26 07:20:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

Use JSON for known checksums (#415)

Browse Source 
Ports the hardening from astral-sh/setup-uv#1025 to ruff-action.\n\nThis
stores generated checksums as JSON data behind a small typed TypeScript
wrapper, preventing values sourced from release metadata from being
mixed into generated executable code. It also updates the checksum
workflow and packaged action artifacts, and adds a regression test for
code-like keys and escaped checksum values.\n\nTests: npm run build, npm
run check, npm test, npm run package
This commit is contained in:
eifinger-bot
2026-08-28 16:15:05 -04:00
committed by GitHub
parent 6d5deb5cee
commit 127e6a115e
10 changed files with 6706 additions and 6676 deletions
Download Patch File Download Diff File Expand all files Collapse all files
dist/ruff-action/index.cjs
Generated Vendored
+5 -2
View File
@@ -24769,8 +24769,8 @@ var ASTRAL_MIRROR_PREFIX = "https://releases.astral.sh/github/ruff/releases/down
var crypto3 = __toESM(require("node:crypto"), 1);
var fs4 = __toESM(require("node:fs"), 1);
// src/download/checksum/known-checksums.ts
var KNOWN_CHECKSUMS = {
// src/download/checksum/known-checksums.json
var known_checksums_default = {
"aarch64-apple-darwin-0.16.5": "ed142f8656e0092828c103dd058b55b871c88e13a801cade8f860d8a9ca8943e",
"aarch64-pc-windows-msvc-0.16.5": "30874e50be1f31626022358bbcaa80112ce1065b9297e5a9c4654f0b5a230d39",
"aarch64-unknown-linux-gnu-0.16.5": "796079ea998dba3e455394077ba51a4c500c2402d3920580c646a0580f20370c",
@@ -28094,6 +28094,9 @@ var KNOWN_CHECKSUMS = {
"x86_64-unknown-linux-musl-0.0.247": "d14f59b09a83e3bdba4a54687158534f7c8ae702f8df770b8eaabf4445fb8b60"
};
// src/download/checksum/known-checksums.ts
var KNOWN_CHECKSUMS = known_checksums_default;
// src/download/checksum/checksum.ts
async function validateChecksum(checkSum2, downloadPath, arch3, platform2, version2) {
let isValid;